Commit Graph

3375 Commits

Author SHA1 Message Date
Chris PeBenito ee4bdf2959 Rename audioentropy module to entropyd due to haveged support. 2011-07-25 08:46:03 -04:00
Chris PeBenito 004e272212 Module version bump and changelog for haveged support from Sven Vermeulen. 2011-07-25 08:43:51 -04:00
Sven Vermeulen 7b84ef7aae Add file context rules for haveged
Add file context rules for haveged within the audioentropyd module.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-07-25 08:38:45 -04:00
Sven Vermeulen 62cdea27c3 Update entropyd_t with privileges needed for haveged
Haveged by itself requires a few additional privileges (create a unix socket
and write access to some proc/sys/kernel files (like
/proc/sys/kernel/random/write_wakeup_threshold).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-07-25 08:38:40 -04:00
Sven Vermeulen 34aea93484 Separate sound specific items frmo general entropyd
Introduce a tunable called "entropyd_use_audio". This boolean triggers the
privileges that are specific for audio support (both device access as well
as the alsa-specific ones).

The idea to use a boolean is to support other entropy management
applications/daemons which use different sources (like haveged using the
HAVEGE algorithm).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-07-25 08:38:35 -04:00
Chris PeBenito 95995f5048 Module version bump for portage updates from Sven Vermeulen. 2011-07-22 08:36:33 -04:00
Chris PeBenito f2a85d7d04 Rearrange a few lines in portage. 2011-07-22 08:25:53 -04:00
Sven Vermeulen 204529101f Support proxy/cache servers
Portage supports the use of proxy systems (which usually run on port 8080)
for the fetching of software archives.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-07-22 08:20:51 -04:00
Sven Vermeulen be42fbd8d4 Support live ebuilds through portage_srcrepo_t
Portage supports the notion of "live ebuilds", which are packages that, when
installed, update a repository checkout on a specific location. This means
that a few portage-related domains need to have manage_* privileges on that
location whereas they usually have much more limited rights (when live
ebuilds aren't used).

To support live ebuilds, we introduce another label called portage_srcrepo_t
for those specific locations where the "higher" privileges are needed for,
and grant the proper permissions on the compile domains (like
portage_sandbox_t) to manage the checkouts.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-07-22 08:20:45 -04:00
Sven Vermeulen 77cefbf2b4 Support NFS mounts for portage related locations
When users want to use NFS mounted portage tree, distfiles, packages and
other locations, they need to use the proper context= mount option. However,
in the majority of cases, the users use a single NFS mount. In such
situation, context= cannot be used properly since it puts a label on the
entire mount (whereas we would then need other labels depending on
subdirectories).

Introducing a boolean "portage_use_nfs" which, when set (default off),
allows the necessary portage-related domains to manage files and directories
with the nfs_t label.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-07-22 08:20:36 -04:00
Chris PeBenito 6e742c4c63 Module version bump for NFS over TCP patchset. 2011-07-22 07:18:13 -04:00
Sven Vermeulen bdc0c3985b Allow kernel to access NFS/RPC TCP
Allow kernel_t to access the nfsd_t' tcp_sockets.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-07-22 07:03:51 -04:00
Sven Vermeulen 555cbbc5f5 Create interface for NFS/RPC TCP access
Create the rpc_tcp_rw_nfs_sockets() interface, allowing for the calling
domain to access the tcp_sockets managed by nfsd_t.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-07-22 07:03:41 -04:00
Chris PeBenito b594647caf Fix missing requires in /var/run and /var/lock symlink patch. 2011-07-18 14:12:07 -04:00
Chris PeBenito a29c7b86e1 Module version bump and Changelog for auth file patches from Matthew Ife. 2011-07-18 13:48:05 -04:00
Chris PeBenito a4912ae653 Whitespace fix in authlogin.if. 2011-07-18 13:46:18 -04:00
Matthew Ife 4ff4e1c505 Replace deprecated *_except_shadow macro calls with *_except_auth_files calls. 2011-07-18 13:40:38 -04:00
Matthew Ife 61fb2009ad Create a new attribute for auth_file types. Add shadow as an auth_file type. Add new interfaces to manage auth_file types Deprecate *_except_shadow macros in favour of *_except_auth_files 2011-07-18 13:40:37 -04:00
Chris PeBenito e5745955f9 Udev fc for /var/run/udev from Martin Orr.
This is intended to label /run/udev, but I am assuming that everyone
will use file_contexts.subs(_dist)? to substitute /var/run for /run,
since there are currently no other fcs for /run in refpolicy.

The label is udev_tbl_t instead of udev_var_run_t, because /run/udev
contains the data which used to be in /dev/.udev.
2011-07-18 13:36:27 -04:00
Chris PeBenito edfe67fd15 Relocated /var/run and /var/lock from Martin Orr.
Add read_lnk_file_perms to all interfaces giving access to var_run_t and
var_lock_t.

This is needed as on Debian /var/run and /var/lock are now symlinks to
/run and /run/lock.
2011-07-18 13:33:22 -04:00
Chris PeBenito 23f9cd7b4c Module version bump for mozilla plugin bug fix from Harry Ciao. 2011-06-24 09:04:41 -04:00
Harry Ciao 321f22231e Fix the call to mozilla_run_plugin.
When mozilla_role interface is called, 1st argument is the caller's
role and 2nd argument is the caller's domain, such as:

   mozilla_role(staff_r, staff_t)

When mozilla_role calls mozilla_run_plugin, the passed 2nd argument
should be the caller's role rather than its domain, so $1 not $2 should
be used.

Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
2011-06-24 08:58:48 -04:00
Chris PeBenito ccf8bdea90 Add agent support to zabbix from Sven Vermeulen. 2011-06-15 14:11:14 -04:00
Chris PeBenito 6583208a2d Fix packet interfaces in zabbix.if. 2011-06-15 14:10:28 -04:00
Chris PeBenito 5759f004a7 Whitespace cleanup in zabbix. 2011-06-15 13:51:33 -04:00
Chris PeBenito cae953ff01 Rearrange lines in zabbix. 2011-06-15 13:51:22 -04:00
Chris PeBenito 2c59cf9cf9 Remove unnecessary comments in zabbix.te. 2011-06-15 13:47:08 -04:00
Sven Vermeulen b6b23abade Allow zabbix agent to query system state and other monitorable aspects
The zabbix agent is responsible for collecting the system state and other
monitorable aspects. This include
- information from /proc
- read attributes of various files (tamper detection)
- connect to the ssh service (check if it is reachable)
- get file system information
- read login information
- ...

It should be noted that the agent can do a lot more, depending on the target
system (what is being monitored) and the running services. The allowed
privileges here will in the future expand more as more templates are
checked.

Update: follow styleguide

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:41:15 -04:00
Sven Vermeulen d30069e4dc Allow zabbix server to connect to agent (active monitoring)
The zabbix server also connects to the agents (this is called "active
monitoring" in the zabbix terms). So we create a zabbix_agent_tcp_connect
interface, use it for the zabbix_t domain and, since zabbix can use
hostname-based connections, allow DNS resolving for the zabbix server.

Update: Follow styleguide

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:41:09 -04:00
Sven Vermeulen 80b95df00a Zabbix agent binds on its own port, connects to zabbix server
The zabbix agent has its own dedicated port (10050) on which it needs to
bind/listen.

Also, the agent connects to the server so we add the zabbix_tcp_connect
interface (shamelessly copied from mysql_tcp_connect) and use it for the
zabbix_agent_t domain.

Update: structure interface calls more closely to styleguide

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:41:03 -04:00
Sven Vermeulen 5b85c03633 Support different domain for zabbix agent (start with skeleton)
The zabbix agent should be confined within its own domain. We start with the
definition of a small(er) skeleton to work from. This includes proper file
context definitions, standard interdomain privileges (which are quite
similar to those of the server) and the proper log- and pid access
privileges.

Update: attempt to follow styleguide more closely

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:40:58 -04:00
Sven Vermeulen 5b17d3e7d6 Define zabbix port and allow server to listen/bind on it
The zabbix server uses a dedicated port (10051). We define it and allow the
zabbix server to bind/listen on it.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:40:54 -04:00
Sven Vermeulen 1f1723e008 Support shared memory
On Mon, Jun 13, 2011 at 10:28:15AM +0200, Sven Vermeulen wrote:
> Zabbix servers use shared memory to keep common information and structures.
> This is implemented on tmpfs. We support this by introducing a
> zabbix_tmpfs_t type and allow the server proper access to it.

After a small discussion and a few more tests, drop the "dir" in
fs_tmpfs_filetrans.

For posterity's sake, this is the denial one gets when no tmpfs_t related
privileges are given:

Jun 13 11:24:06 build kernel: [  213.054230] type=1400
audit(1307957046.001:106): avc:  denied  { read write } for  pid=3162
comm="zabbix_agentd" path=2F535953563663303132323534202864656C6574656429
dev=tmpfs ino=32768 scontext=system_u:system_r:zabbix_agent_t
tcontext=system_u:object_r:tmpfs_t tclass=file

With fs_tmpfs_filetrans(..., file) the same denial is given, but as
tcontext=zabbix_tmpfs_t. Hence the rw_files_pattern() enhancement.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:40:49 -04:00
Sven Vermeulen ae5814904e zabbix server spawns multiple processes
The zabbix server process is a multi-process system.

In order to, for instance, shut it down, signalling within the domain is
necessary. Otherwise, the processes remain running.

Also, since there are multiple processes trying to use the same log file,
the zabbix server uses semaphores to ensure proper access to the log files
(concurrency).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:40:45 -04:00
Chris PeBenito b598c4421c Merge various apps layer changes from the Fedora policy. 2011-06-08 13:05:34 -04:00
Chris PeBenito 003dbe0c66 Cyrus file context update for Gentoo from Corentin Labbe. 2011-06-08 08:51:55 -04:00
Chris PeBenito 78b1d1182c Merge ncftool from Fedora. 2011-06-07 09:14:53 -04:00
Chris PeBenito 508df21fab Fix incorrect parameter in semanage call in likewise. 2011-05-25 08:30:54 -04:00
Chris PeBenito 8c3e30f913 Module version bump and changelog for Fedora modules. 2011-05-24 09:12:43 -04:00
Chris PeBenito af82a77675 Add zarafa from Fedora. 2011-05-24 09:11:56 -04:00
Chris PeBenito ef77678865 Move passenger to admin layer. 2011-05-20 10:29:20 -04:00
Chris PeBenito f5df601718 Add passenger from Fedora. 2011-05-20 10:27:47 -04:00
Chris PeBenito 0d62ce9373 Move mediawiki to services layer. 2011-05-20 10:20:28 -04:00
Chris PeBenito ffca31359c Add mediawiki from Fedora. 2011-05-20 10:17:12 -04:00
Chris PeBenito d2defd81e3 Add telepathy from Fedora. 2011-05-20 10:16:09 -04:00
Chris PeBenito 2e6db061ce Rename qpidd to qpid. 2011-05-20 09:32:13 -04:00
Chris PeBenito 10672e1e2a Add qpidd from Fedora. 2011-05-20 09:31:04 -04:00
Chris PeBenito 0895456538 Add vnstatd from Fedora. 2011-05-20 09:15:25 -04:00
Chris PeBenito 30e4a4eda1 Add bugzilla policy from Fedora. 2011-05-20 09:11:07 -04:00
Chris PeBenito 8630e36c5c Add mpd from Fedora. 2011-05-19 09:56:59 -04:00