From 7b61fe506daa7e5bc9987e0987862eff5ff55351 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Wed, 27 Jun 2007 16:31:55 +0000 Subject: [PATCH] trunk: add rpcbind from dan --- Changelog | 1 + policy/modules/services/rpcbind.fc | 7 +++ policy/modules/services/rpcbind.if | 97 ++++++++++++++++++++++++++++++ policy/modules/services/rpcbind.te | 67 +++++++++++++++++++++ 4 files changed, 172 insertions(+) create mode 100644 policy/modules/services/rpcbind.fc create mode 100644 policy/modules/services/rpcbind.if create mode 100644 policy/modules/services/rpcbind.te diff --git a/Changelog b/Changelog index a919ef7b3..bb9f32929 100644 --- a/Changelog +++ b/Changelog @@ -32,6 +32,7 @@ - Added modules: amtu (Dan Walsh) apcupsd (Dan Walsh) + rpcbind (Dan Walsh) rwho (Nalin Dahyabhai) * Tue Apr 17 2007 Chris PeBenito - 20070417 diff --git a/policy/modules/services/rpcbind.fc b/policy/modules/services/rpcbind.fc new file mode 100644 index 000000000..6a546e4a8 --- /dev/null +++ b/policy/modules/services/rpcbind.fc @@ -0,0 +1,7 @@ +/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0) + +/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0) + +/var/run/rpc.statd.pid -- gen_context(system_u:object_r:rpcbind_var_run_t,s0) +/var/run/rpcbind.lock -- gen_context(system_u:object_r:rpcbind_var_run_t,s0) +/var/run/rpcbind.sock -s gen_context(system_u:object_r:rpcbind_var_run_t,s0) diff --git a/policy/modules/services/rpcbind.if b/policy/modules/services/rpcbind.if new file mode 100644 index 000000000..5271eb79a --- /dev/null +++ b/policy/modules/services/rpcbind.if @@ -0,0 +1,97 @@ +## Universal Addresses to RPC Program Number Mapper + +######################################## +## +## Execute a domain transition to run rpcbind. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`rpcbind_domtrans',` + gen_require(` + type rpcbind_t, rpcbind_exec_t; + ') + + domtrans_pattern($1,rpcbind_exec_t,rpcbind_t) +') + +######################################## +## +## Read rpcbind PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`rpcbind_read_pid_files',` + gen_require(` + type rpcbind_var_run_t; + ') + + files_search_pids($1) + allow $1 rpcbind_var_run_t:file read_file_perms; +') + + +######################################## +## +## Search rpcbind lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`rpcbind_search_lib',` + gen_require(` + type rpcbind_var_lib_t; + ') + + allow $1 rpcbind_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read rpcbind lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`rpcbind_read_lib_files',` + gen_require(` + type rpcbind_var_lib_t; + ') + + read_files_pattern($1,rpcbind_var_lib_t,rpcbind_var_lib_t) + files_search_var_lib($1) +') + +######################################## +## +## Create, read, write, and delete +## rpcbind lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`rpcbind_manage_lib_files',` + gen_require(` + type rpcbind_var_lib_t; + ') + + manage_files_pattern($1,rpcbind_var_lib_t,rpcbind_var_lib_t) + files_search_var_lib($1) +') diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te new file mode 100644 index 000000000..ca7d9502d --- /dev/null +++ b/policy/modules/services/rpcbind.te @@ -0,0 +1,67 @@ + +policy_module(rpcbind,1.0.0) + +######################################## +# +# Declarations +# + +type rpcbind_t; +type rpcbind_exec_t; +init_daemon_domain(rpcbind_t, rpcbind_exec_t) + +type rpcbind_var_run_t; +files_pid_file(rpcbind_var_run_t) + +type rpcbind_var_lib_t; +files_type(rpcbind_var_lib_t) + +######################################## +# +# rpcbind local policy +# + +allow rpcbind_t self:capability setuid; +allow rpcbind_t self:fifo_file rw_file_perms; +allow rpcbind_t self:unix_stream_socket create_stream_socket_perms; +allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms; +allow rpcbind_t self:udp_socket create_socket_perms; +allow rpcbind_t self:tcp_socket create_stream_socket_perms; + +manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) +manage_sock_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) +files_pid_filetrans(rpcbind_t,rpcbind_var_run_t, { file sock_file }) + +manage_dirs_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t) +manage_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t) +manage_sock_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t) +files_var_lib_filetrans(rpcbind_t,rpcbind_var_lib_t, { file dir sock_file }) + +kernel_read_network_state(rpcbind_t) + +corenet_all_recvfrom_unlabeled(rpcbind_t) +corenet_all_recvfrom_netlabel(rpcbind_t) +corenet_tcp_sendrecv_all_if(rpcbind_t) +corenet_udp_sendrecv_all_if(rpcbind_t) +corenet_tcp_sendrecv_all_nodes(rpcbind_t) +corenet_udp_sendrecv_all_nodes(rpcbind_t) +corenet_tcp_sendrecv_all_ports(rpcbind_t) +corenet_udp_sendrecv_all_ports(rpcbind_t) +corenet_tcp_bind_all_nodes(rpcbind_t) +corenet_udp_bind_all_nodes(rpcbind_t) +corenet_tcp_bind_portmap_port(rpcbind_t) +corenet_udp_bind_portmap_port(rpcbind_t) +corenet_udp_bind_all_rpc_ports(rpcbind_t) + +domain_use_interactive_fds(rpcbind_t) + +files_read_etc_files(rpcbind_t) + +libs_use_ld_so(rpcbind_t) +libs_use_shared_libs(rpcbind_t) + +logging_send_syslog_msg(rpcbind_t) + +miscfiles_read_localization(rpcbind_t) + +sysnet_dns_name_resolve(rpcbind_t)