Add zarafa from Fedora.
This commit is contained in:
Chris PeBenito
parent
ef77678865
commit
af82a77675
|
|
@ -222,6 +222,7 @@ network_port(xdmcp, udp,177,s0, tcp,177,s0)
|
|||
network_port(xen, tcp,8002,s0)
|
||||
network_port(xfs, tcp,7100,s0)
|
||||
network_port(xserver, tcp,6000-6020,s0)
|
||||
network_port(zarafa, tcp,236,s0, tcp,237,s0)
|
||||
network_port(zookeeper_client, tcp,2181,s0)
|
||||
network_port(zookeeper_election, tcp,3888,s0)
|
||||
network_port(zookeeper_leader, tcp,2888,s0)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,26 @@
|
|||
/etc/zarafa(/.*)? gen_context(system_u:object_r:zarafa_etc_t,s0)
|
||||
|
||||
/usr/bin/zarafa-dagent -- gen_context(system_u:object_r:zarafa_deliver_exec_t,s0)
|
||||
/usr/bin/zarafa-gateway -- gen_context(system_u:object_r:zarafa_gateway_exec_t,s0)
|
||||
/usr/bin/zarafa-ical -- gen_context(system_u:object_r:zarafa_ical_exec_t,s0)
|
||||
/usr/bin/zarafa-indexer -- gen_context(system_u:object_r:zarafa_indexer_exec_t,s0)
|
||||
/usr/bin/zarafa-monitor -- gen_context(system_u:object_r:zarafa_monitor_exec_t,s0)
|
||||
/usr/bin/zarafa-server -- gen_context(system_u:object_r:zarafa_server_exec_t,s0)
|
||||
/usr/bin/zarafa-spooler -- gen_context(system_u:object_r:zarafa_spooler_exec_t,s0)
|
||||
|
||||
/var/lib/zarafa-.* gen_context(system_u:object_r:zarafa_var_lib_t,s0)
|
||||
|
||||
/var/log/zarafa/gateway\.log -- gen_context(system_u:object_r:zarafa_gateway_log_t,s0)
|
||||
/var/log/zarafa/ical\.log -- gen_context(system_u:object_r:zarafa_ical_log_t,s0)
|
||||
/var/log/zarafa/indexer\.log -- gen_context(system_u:object_r:zarafa_indexer_log_t,s0)
|
||||
/var/log/zarafa/monitor\.log -- gen_context(system_u:object_r:zarafa_monitor_log_t,s0)
|
||||
/var/log/zarafa/server\.log -- gen_context(system_u:object_r:zarafa_server_log_t,s0)
|
||||
/var/log/zarafa/spooler\.log -- gen_context(system_u:object_r:zarafa_spooler_log_t,s0)
|
||||
|
||||
/var/run/zarafa -s gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
|
||||
/var/run/zarafa-gateway\.pid -- gen_context(system_u:object_r:zarafa_gateway_var_run_t,s0)
|
||||
/var/run/zarafa-ical\.pid -- gen_context(system_u:object_r:zarafa_ical_var_run_t,s0)
|
||||
/var/run/zarafa-indexer -- gen_context(system_u:object_r:zarafa_indexer_var_run_t,s0)
|
||||
/var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0)
|
||||
/var/run/zarafa-server\.pid -- gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
|
||||
/var/run/zarafa-spooler\.pid -- gen_context(system_u:object_r:zarafa_spooler_var_run_t,s0)
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
## <summary>Zarafa collaboration platform.</summary>
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Creates types and rules for a basic
|
||||
## zararfa init daemon domain.
|
||||
## </summary>
|
||||
## <param name="prefix">
|
||||
## <summary>
|
||||
## Prefix for the domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
template(`zarafa_domain_template',`
|
||||
gen_require(`
|
||||
attribute zarafa_domain;
|
||||
')
|
||||
|
||||
##############################
|
||||
#
|
||||
# $1_t declarations
|
||||
#
|
||||
|
||||
type zarafa_$1_t, zarafa_domain;
|
||||
type zarafa_$1_exec_t;
|
||||
init_daemon_domain(zarafa_$1_t, zarafa_$1_exec_t)
|
||||
|
||||
type zarafa_$1_log_t;
|
||||
logging_log_file(zarafa_$1_log_t)
|
||||
|
||||
type zarafa_$1_var_run_t;
|
||||
files_pid_file(zarafa_$1_var_run_t)
|
||||
|
||||
##############################
|
||||
#
|
||||
# $1_t local policy
|
||||
#
|
||||
|
||||
manage_files_pattern(zarafa_$1_t, zarafa_$1_var_run_t, zarafa_$1_var_run_t)
|
||||
manage_sock_files_pattern(zarafa_$1_t, zarafa_$1_var_run_t, zarafa_$1_var_run_t)
|
||||
files_pid_filetrans(zarafa_$1_t, zarafa_$1_var_run_t, { file sock_file })
|
||||
|
||||
manage_files_pattern(zarafa_$1_t, zarafa_$1_log_t, zarafa_$1_log_t)
|
||||
logging_log_filetrans(zarafa_$1_t, zarafa_$1_log_t, { file })
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Allow the specified domain to search
|
||||
## zarafa configuration dirs.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`zarafa_search_config',`
|
||||
gen_require(`
|
||||
type zarafa_etc_t;
|
||||
')
|
||||
|
||||
files_search_etc($1)
|
||||
allow $1 zarafa_etc_t:dir search_dir_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run zarafa_deliver.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`zarafa_domtrans_deliver',`
|
||||
gen_require(`
|
||||
type zarafa_deliver_t, zarafa_deliver_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1, zarafa_deliver_exec_t, zarafa_deliver_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run zarafa_server.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`zarafa_domtrans_server',`
|
||||
gen_require(`
|
||||
type zarafa_server_t, zarafa_server_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1, zarafa_server_exec_t, zarafa_server_t)
|
||||
')
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
## Connect to zarafa-server unix domain stream socket.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`zarafa_stream_connect_server',`
|
||||
gen_require(`
|
||||
type zarafa_server_t, zarafa_server_var_run_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
stream_connect_pattern($1, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t)
|
||||
')
|
||||
|
|
@ -0,0 +1,161 @@
|
|||
policy_module(zarafa, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
attribute zarafa_domain;
|
||||
|
||||
zarafa_domain_template(deliver)
|
||||
|
||||
type zarafa_deliver_tmp_t;
|
||||
files_tmp_file(zarafa_deliver_tmp_t)
|
||||
|
||||
type zarafa_etc_t;
|
||||
files_config_file(zarafa_etc_t)
|
||||
|
||||
zarafa_domain_template(gateway)
|
||||
zarafa_domain_template(ical)
|
||||
zarafa_domain_template(indexer)
|
||||
zarafa_domain_template(monitor)
|
||||
zarafa_domain_template(server)
|
||||
|
||||
type zarafa_server_tmp_t;
|
||||
files_tmp_file(zarafa_server_tmp_t)
|
||||
|
||||
type zarafa_share_t;
|
||||
files_type(zarafa_share_t)
|
||||
|
||||
zarafa_domain_template(spooler)
|
||||
|
||||
type zarafa_var_lib_t;
|
||||
files_tmp_file(zarafa_var_lib_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# zarafa-deliver local policy
|
||||
#
|
||||
|
||||
manage_dirs_pattern(zarafa_deliver_t, zarafa_deliver_tmp_t, zarafa_deliver_tmp_t)
|
||||
manage_files_pattern(zarafa_deliver_t, zarafa_deliver_tmp_t, zarafa_deliver_tmp_t)
|
||||
files_tmp_filetrans(zarafa_deliver_t, zarafa_deliver_tmp_t, { file dir })
|
||||
|
||||
########################################
|
||||
#
|
||||
# zarafa_gateway local policy
|
||||
#
|
||||
|
||||
allow zarafa_gateway_t self:capability { chown kill };
|
||||
allow zarafa_gateway_t self:process setrlimit;
|
||||
|
||||
corenet_all_recvfrom_unlabeled(zarafa_gateway_t)
|
||||
corenet_all_recvfrom_netlabel(zarafa_gateway_t)
|
||||
corenet_tcp_sendrecv_generic_if(zarafa_gateway_t)
|
||||
corenet_tcp_sendrecv_generic_node(zarafa_gateway_t)
|
||||
corenet_tcp_sendrecv_all_ports(zarafa_gateway_t)
|
||||
corenet_tcp_bind_generic_node(zarafa_gateway_t)
|
||||
corenet_tcp_bind_pop_port(zarafa_gateway_t)
|
||||
|
||||
#######################################
|
||||
#
|
||||
# zarafa-ical local policy
|
||||
#
|
||||
|
||||
allow zarafa_ical_t self:capability chown;
|
||||
|
||||
corenet_all_recvfrom_unlabeled(zarafa_ical_t)
|
||||
corenet_all_recvfrom_netlabel(zarafa_ical_t)
|
||||
corenet_tcp_sendrecv_generic_if(zarafa_ical_t)
|
||||
corenet_tcp_sendrecv_generic_node(zarafa_ical_t)
|
||||
corenet_tcp_sendrecv_all_ports(zarafa_ical_t)
|
||||
corenet_tcp_bind_generic_node(zarafa_ical_t)
|
||||
corenet_tcp_bind_http_cache_port(zarafa_ical_t)
|
||||
|
||||
######################################
|
||||
#
|
||||
# zarafa-monitor local policy
|
||||
#
|
||||
|
||||
allow zarafa_monitor_t self:capability chown;
|
||||
|
||||
########################################
|
||||
#
|
||||
# zarafa_server local policy
|
||||
#
|
||||
|
||||
allow zarafa_server_t self:capability { chown kill net_bind_service };
|
||||
allow zarafa_server_t self:process setrlimit;
|
||||
|
||||
manage_dirs_pattern(zarafa_server_t, zarafa_server_tmp_t, zarafa_server_tmp_t)
|
||||
manage_files_pattern(zarafa_server_t, zarafa_server_tmp_t, zarafa_server_tmp_t)
|
||||
files_tmp_filetrans(zarafa_server_t, zarafa_server_tmp_t, { file dir })
|
||||
|
||||
manage_dirs_pattern(zarafa_server_t, zarafa_var_lib_t, zarafa_var_lib_t)
|
||||
manage_files_pattern(zarafa_server_t, zarafa_var_lib_t, zarafa_var_lib_t)
|
||||
files_var_lib_filetrans(zarafa_server_t, zarafa_var_lib_t, { file dir })
|
||||
|
||||
stream_connect_pattern(zarafa_server_t, zarafa_indexer_var_run_t, zarafa_indexer_var_run_t, zarafa_indexer_t)
|
||||
|
||||
corenet_all_recvfrom_unlabeled(zarafa_server_t)
|
||||
corenet_all_recvfrom_netlabel(zarafa_server_t)
|
||||
corenet_tcp_sendrecv_generic_if(zarafa_server_t)
|
||||
corenet_tcp_sendrecv_generic_node(zarafa_server_t)
|
||||
corenet_tcp_sendrecv_all_ports(zarafa_server_t)
|
||||
corenet_tcp_bind_generic_node(zarafa_server_t)
|
||||
corenet_tcp_bind_zarafa_port(zarafa_server_t)
|
||||
|
||||
files_read_usr_files(zarafa_server_t)
|
||||
|
||||
logging_send_syslog_msg(zarafa_server_t)
|
||||
logging_send_audit_msgs(zarafa_server_t)
|
||||
|
||||
sysnet_dns_name_resolve(zarafa_server_t)
|
||||
|
||||
optional_policy(`
|
||||
kerberos_use(zarafa_server_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
mysql_stream_connect(zarafa_server_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# zarafa_spooler local policy
|
||||
#
|
||||
|
||||
allow zarafa_spooler_t self:capability { chown kill };
|
||||
|
||||
can_exec(zarafa_spooler_t, zarafa_spooler_exec_t)
|
||||
|
||||
corenet_all_recvfrom_unlabeled(zarafa_spooler_t)
|
||||
corenet_all_recvfrom_netlabel(zarafa_spooler_t)
|
||||
corenet_tcp_sendrecv_generic_if(zarafa_spooler_t)
|
||||
corenet_tcp_sendrecv_generic_node(zarafa_spooler_t)
|
||||
corenet_tcp_sendrecv_all_ports(zarafa_spooler_t)
|
||||
corenet_tcp_connect_smtp_port(zarafa_spooler_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# zarafa domains local policy
|
||||
#
|
||||
|
||||
# bad permission on /etc/zarafa
|
||||
allow zarafa_domain self:capability { dac_override setgid setuid };
|
||||
allow zarafa_domain self:process signal;
|
||||
allow zarafa_domain self:fifo_file rw_fifo_file_perms;
|
||||
allow zarafa_domain self:tcp_socket create_stream_socket_perms;
|
||||
allow zarafa_domain self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
stream_connect_pattern(zarafa_domain, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t)
|
||||
|
||||
read_files_pattern(zarafa_domain, zarafa_etc_t, zarafa_etc_t)
|
||||
|
||||
kernel_read_system_state(zarafa_domain)
|
||||
|
||||
files_read_etc_files(zarafa_domain)
|
||||
|
||||
auth_use_nsswitch(zarafa_domain)
|
||||
|
||||
miscfiles_read_localization(zarafa_domain)
|
||||
Loading…
Reference in New Issue