add smartmon

refpolicy/Changelog

@@ -5,6 +5,7 @@
 - Added modules:
 	automount
 	fetchmail
+	smartmon
 	sysstat
 	vbetool (Dan Walsh)
 

refpolicy/policy/modules/kernel/files.fc

@@ -52,6 +52,7 @@ ifdef(`distro_redhat',`
 /etc/motd		--	gen_context(system_u:object_r:etc_runtime_t,s0)
 /etc/nohotplug		--	gen_context(system_u:object_r:etc_runtime_t,s0)
 /etc/nologin.*		--	gen_context(system_u:object_r:etc_runtime_t,s0)
+/etc/smartd\.conf	--	gen_context(system_u:object_r:etc_runtime_t,s0)
 
 /etc/cups/client\.conf	--	gen_context(system_u:object_r:etc_t,s0)
 

refpolicy/policy/modules/kernel/terminal.if

@@ -259,6 +259,24 @@ interface(`term_search_ptys',`
 	allow $1 devpts_t:dir search;
 ')
 
+########################################
+## <summary>
+##	Do not audit attempts to search the
+##	contents of the /dev/pts directory.
+## </summary>
+## <param name="domain">
+##	Domain allowed access.
+## </param>
+#
+interface(`term_dontaudit_search_ptys',`
+	gen_require(`
+		type devpts_t;
+	')
+
+	dev_dontaudit_list_all_dev_nodes($1)
+	dontaudit $1 devpts_t:dir search;
+')
+
 ########################################
 ## <summary>
 ##	Read the /dev/pts directory to

refpolicy/policy/modules/services/mta.te

@@ -1,5 +1,5 @@
 
-policy_module(mta,1.1.1)
+policy_module(mta,1.1.2)
 
 ########################################
 #
@@ -157,6 +157,10 @@ optional_policy(`sendmail',`
 	')
 ')
 
+optional_policy(`smartmon',`
+	smartmon_read_tmp(system_mail_t)
+')
+
 # should break this up among sections:
 
 optional_policy(`arpwatch',`

refpolicy/policy/modules/services/smartmon.fc

@@ -0,0 +1,10 @@
+#
+# /usr
+#
+/usr/sbin/smartd	--	gen_context(system_u:object_r:fsdaemon_exec_t,s0)
+
+#
+# /var
+#
+/var/run/smartd\.pid	--	gen_context(system_u:object_r:fsdaemon_var_run_t,s0)
+

refpolicy/policy/modules/services/smartmon.if

@@ -0,0 +1,17 @@
+## <summary>Smart disk monitoring daemon policy</summary>
+
+#######################################
+## <summary>
+##	Allow caller to read smartmon temporary files.
+## </summary>
+## <param name="domain">
+##	The process type reading the temporary files.
+## </param>
+#
+interface(`smartmon_read_tmp',`
+	gen_require(`
+		type fsdaemon_tmp_t;
+	')
+
+	allow $1 fsdaemon_tmp_t:file { getattr ioctl read };
+')

refpolicy/policy/modules/services/smartmon.te

@@ -0,0 +1,107 @@
+
+policy_module(smartmon,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type fsdaemon_t;
+type fsdaemon_exec_t;
+init_daemon_domain(fsdaemon_t,fsdaemon_exec_t)
+
+type fsdaemon_var_run_t;
+files_pid_file(fsdaemon_var_run_t)
+
+type fsdaemon_tmp_t;
+files_tmp_file(fsdaemon_tmp_t)
+
+########################################
+#
+# Local policy
+#
+
+allow fsdaemon_t self:capability { setgid sys_rawio sys_admin };
+dontaudit fsdaemon_t self:capability sys_tty_config;
+allow fsdaemon_t self:process signal_perms;
+allow fsdaemon_t self:fifo_file rw_file_perms;
+allow fsdaemon_t self:unix_dgram_socket create_socket_perms;
+allow fsdaemon_t self:unix_stream_socket create_stream_socket_perms;
+allow fsdaemon_t self:udp_socket create_socket_perms;
+
+allow fsdaemon_t fsdaemon_tmp_t:dir create_dir_perms;
+allow fsdaemon_t fsdaemon_tmp_t:file create_file_perms;
+files_create_tmp_files(fsdaemon_t, fsdaemon_tmp_t, { file dir })
+
+allow fsdaemon_t fsdaemon_var_run_t:file create_file_perms;
+allow fsdaemon_t fsdaemon_var_run_t:dir rw_dir_perms;
+files_create_pid(fsdaemon_t,fsdaemon_var_run_t)
+
+kernel_read_kernel_sysctl(fsdaemon_t)
+kernel_read_software_raid_state(fsdaemon_t)
+kernel_read_system_state(fsdaemon_t)
+
+corecmd_exec_bin(fsdaemon_t)
+corecmd_exec_sbin(fsdaemon_t)
+
+corenet_non_ipsec_sendrecv(fsdaemon_t)
+corenet_udp_sendrecv_generic_if(fsdaemon_t)
+corenet_raw_sendrecv_generic_if(fsdaemon_t)
+corenet_udp_sendrecv_all_nodes(fsdaemon_t)
+corenet_raw_sendrecv_all_nodes(fsdaemon_t)
+corenet_udp_sendrecv_all_ports(fsdaemon_t)
+corenet_udp_bind_all_nodes(fsdaemon_t)
+
+dev_read_sysfs(fsdaemon_t)
+
+domain_exec_all_entry_files(fsdaemon_t)
+domain_use_wide_inherit_fd(fsdaemon_t)
+
+files_exec_etc_files(fsdaemon_t)
+files_read_etc_runtime_files(fsdaemon_t)
+# for config
+files_read_etc_files(fsdaemon_t)
+
+fs_getattr_all_fs(fsdaemon_t)
+fs_search_auto_mountpoints(fsdaemon_t)
+
+storage_raw_read_fixed_disk(fsdaemon_t)
+storage_raw_write_fixed_disk(fsdaemon_t)
+
+term_dontaudit_use_console(fsdaemon_t)
+term_dontaudit_search_ptys(fsdaemon_t)
+
+init_use_fd(fsdaemon_t)
+init_use_script_pty(fsdaemon_t)
+
+libs_use_ld_so(fsdaemon_t)
+libs_use_shared_libs(fsdaemon_t)
+libs_exec_ld_so(fsdaemon_t)
+libs_exec_lib_files(fsdaemon_t)
+
+logging_send_syslog_msg(fsdaemon_t)
+
+miscfiles_read_localization(fsdaemon_t)
+
+sysnet_read_config(fsdaemon_t)
+
+userdom_dontaudit_use_unpriv_user_fd(fsdaemon_t)
+userdom_dontaudit_search_sysadm_home_dir(fsdaemon_t)
+
+ifdef(`targeted_policy',`
+	term_dontaudit_use_unallocated_tty(fsdaemon_t)
+	term_dontaudit_use_generic_pty(fsdaemon_t)
+	files_dontaudit_read_root_file(fsdaemon_t)
+')
+
+optional_policy(`mta',`
+        mta_send_mail(fsdaemon_t)
+')
+
+optional_policy(`selinuxutil',`
+	seutil_sigchld_newrole(fsdaemon_t)
+')
+
+optional_policy(`udev',`
+	udev_read_db(fsdaemon_t)
+')