From 10672e1e2a2deada2a47d03cfc86832d5064c394 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Fri, 20 May 2011 09:31:04 -0400 Subject: [PATCH] Add qpidd from Fedora. --- policy/modules/services/qpidd.fc | 8 ++ policy/modules/services/qpidd.if | 186 +++++++++++++++++++++++++++++++ policy/modules/services/qpidd.te | 63 +++++++++++ 3 files changed, 257 insertions(+) create mode 100644 policy/modules/services/qpidd.fc create mode 100644 policy/modules/services/qpidd.if create mode 100644 policy/modules/services/qpidd.te diff --git a/policy/modules/services/qpidd.fc b/policy/modules/services/qpidd.fc new file mode 100644 index 000000000..4f9422929 --- /dev/null +++ b/policy/modules/services/qpidd.fc @@ -0,0 +1,8 @@ +/etc/rc\.d/init\.d/qpidd -- gen_context(system_u:object_r:qpidd_initrc_exec_t,s0) + +/usr/sbin/qpidd -- gen_context(system_u:object_r:qpidd_exec_t,s0) + +/var/lib/qpidd(/.*)? gen_context(system_u:object_r:qpidd_var_lib_t,s0) + +/var/run/qpidd(/.*)? gen_context(system_u:object_r:qpidd_var_run_t,s0) +/var/run/qpidd\.pid gen_context(system_u:object_r:qpidd_var_run_t,s0) diff --git a/policy/modules/services/qpidd.if b/policy/modules/services/qpidd.if new file mode 100644 index 000000000..5a9630c06 --- /dev/null +++ b/policy/modules/services/qpidd.if @@ -0,0 +1,186 @@ +## Apache QPID AMQP messaging server. + +######################################## +## +## Execute a domain transition to run qpidd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`qpidd_domtrans',` + gen_require(` + type qpidd_t, qpidd_exec_t; + ') + + domtrans_pattern($1, qpidd_exec_t, qpidd_t) +') + +##################################### +## +## Allow read and write access to qpidd semaphores. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_rw_semaphores',` + gen_require(` + type qpidd_t; + ') + + allow $1 qpidd_t:sem rw_sem_perms; +') + +######################################## +## +## Read and write to qpidd shared memory. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_rw_shm',` + gen_require(` + type qpidd_t; + ') + + allow $1 qpidd_t:shm rw_shm_perms; +') + +######################################## +## +## Execute qpidd server in the qpidd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_initrc_domtrans',` + gen_require(` + type qpidd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, qpidd_initrc_exec_t) +') + +######################################## +## +## Read qpidd PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_read_pid_files',` + gen_require(` + type qpidd_var_run_t; + ') + + files_search_pids($1) + allow $1 qpidd_var_run_t:file read_file_perms; +') + +######################################## +## +## Search qpidd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_search_lib',` + gen_require(` + type qpidd_var_lib_t; + ') + + allow $1 qpidd_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read qpidd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_read_lib_files',` + gen_require(` + type qpidd_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t) +') + +######################################## +## +## Create, read, write, and delete +## qpidd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_manage_lib_files',` + gen_require(` + type qpidd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t) +') + +######################################## +## +## All of the rules required to administrate +## an qpidd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`qpidd_admin',` + gen_require(` + type qpidd_t, qpidd_initrc_exec_t; + ') + + allow $1 qpidd_t:process { ptrace signal_perms }; + ps_process_pattern($1, qpidd_t) + + # Allow qpidd_t to restart the apache service + qpidd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 qpidd_initrc_exec_t system_r; + allow $2 system_r; + + admin_pattern($1, qpidd_var_lib_t) + + admin_pattern($1, qpidd_var_run_t) +') diff --git a/policy/modules/services/qpidd.te b/policy/modules/services/qpidd.te new file mode 100644 index 000000000..cb7ecb546 --- /dev/null +++ b/policy/modules/services/qpidd.te @@ -0,0 +1,63 @@ +policy_module(qpid, 1.0.0) + +######################################## +# +# Declarations +# + +type qpidd_t; +type qpidd_exec_t; +init_daemon_domain(qpidd_t, qpidd_exec_t) + +type qpidd_initrc_exec_t; +init_script_file(qpidd_initrc_exec_t) + +type qpidd_var_lib_t; +files_type(qpidd_var_lib_t) + +type qpidd_var_run_t; +files_pid_file(qpidd_var_run_t) + +######################################## +# +# qpidd local policy +# + +allow qpidd_t self:process { setsched signull }; +allow qpidd_t self:fifo_file rw_fifo_file_perms; +allow qpidd_t self:sem create_sem_perms; +allow qpidd_t self:shm create_shm_perms; +allow qpidd_t self:tcp_socket create_stream_socket_perms; +allow qpidd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t) +manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t) +files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir }) + +manage_dirs_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t) +manage_files_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t) +files_pid_filetrans(qpidd_t, qpidd_var_run_t, { file dir }) + +kernel_read_system_state(qpidd_t) + +corenet_all_recvfrom_unlabeled(qpidd_t) +corenet_all_recvfrom_netlabel(qpidd_t) +corenet_tcp_sendrecv_generic_if(qpidd_t) +corenet_tcp_sendrecv_generic_node(qpidd_t) +corenet_tcp_sendrecv_all_ports(qpidd_t) +corenet_tcp_bind_generic_node(qpidd_t) +corenet_tcp_bind_amqp_port(qpidd_t) + +dev_read_urand(qpidd_t) + +files_read_etc_files(qpidd_t) + +logging_send_syslog_msg(qpidd_t) + +miscfiles_read_localization(qpidd_t) + +sysnet_dns_name_resolve(qpidd_t) + +optional_policy(` + corosync_stream_connect(qpidd_t) +')