selinux-refpolicy/policy/modules/services/kerberos.te


policy_module(kerberos, 1.8.0)

########################################
#
# Declarations
#

## <desc>
## <p>
## Allow confined applications to run with kerberos.
## </p>
## </desc>
gen_tunable(allow_kerberos, false)

type kadmind_t;
type kadmind_exec_t;
init_daemon_domain(kadmind_t, kadmind_exec_t)
domain_obj_id_change_exemption(kadmind_t)

type kadmind_log_t;
logging_log_file(kadmind_log_t)

type kadmind_tmp_t;
files_tmp_file(kadmind_tmp_t)

type kadmind_var_run_t;
files_pid_file(kadmind_var_run_t)

type kerberos_initrc_exec_t;
init_script_file(kerberos_initrc_exec_t)

type kpropd_t;
type kpropd_exec_t;
init_daemon_domain(kpropd_t, kpropd_exec_t)

type krb5_conf_t;
files_type(krb5_conf_t)

type krb5_host_rcache_t;
files_tmp_file(krb5_host_rcache_t)

# types for general configuration files in /etc
type krb5_keytab_t;
files_security_file(krb5_keytab_t)

# types for KDC configs and principal file(s)
type krb5kdc_conf_t;
files_type(krb5kdc_conf_t)

type krb5kdc_lock_t;
files_type(krb5kdc_lock_t)

# types for KDC principal file(s)
type krb5kdc_principal_t;
files_type(krb5kdc_principal_t)

type krb5kdc_t;
type krb5kdc_exec_t;
init_daemon_domain(krb5kdc_t, krb5kdc_exec_t)
domain_obj_id_change_exemption(krb5kdc_t)

type krb5kdc_log_t;
logging_log_file(krb5kdc_log_t)

type krb5kdc_tmp_t;
files_tmp_file(krb5kdc_tmp_t)

type krb5kdc_var_run_t;
files_pid_file(krb5kdc_var_run_t)

########################################
#
# kadmind local policy
#

# Use capabilities. Surplus capabilities may be allowed.
allow kadmind_t self:capability { setuid setgid chown fowner dac_override sys_nice };
dontaudit kadmind_t self:capability sys_tty_config;
allow kadmind_t self:process { setfscreate signal_perms };
allow kadmind_t self:netlink_route_socket r_netlink_socket_perms;
allow kadmind_t self:unix_dgram_socket { connect create write };
allow kadmind_t self:tcp_socket connected_stream_socket_perms;
allow kadmind_t self:udp_socket create_socket_perms;

allow kadmind_t kadmind_log_t:file manage_file_perms;
logging_log_filetrans(kadmind_t,kadmind_log_t,file)

allow kadmind_t krb5_conf_t:file read_file_perms;
dontaudit kadmind_t krb5_conf_t:file write;

read_files_pattern(kadmind_t, krb5kdc_conf_t, krb5kdc_conf_t)
dontaudit kadmind_t krb5kdc_conf_t:file { write setattr };

allow kadmind_t krb5kdc_lock_t:file { rw_file_perms setattr };

allow kadmind_t krb5kdc_principal_t:file manage_file_perms;
filetrans_pattern(kadmind_t, krb5kdc_conf_t, krb5kdc_principal_t, file)

can_exec(kadmind_t, kadmind_exec_t)

manage_dirs_pattern(kadmind_t, kadmind_tmp_t, kadmind_tmp_t)
manage_files_pattern(kadmind_t, kadmind_tmp_t, kadmind_tmp_t)
files_tmp_filetrans(kadmind_t, kadmind_tmp_t, { file dir })

manage_files_pattern(kadmind_t, kadmind_var_run_t, kadmind_var_run_t)
files_pid_filetrans(kadmind_t, kadmind_var_run_t, file)

kernel_read_kernel_sysctls(kadmind_t)
kernel_list_proc(kadmind_t)
kernel_read_proc_symlinks(kadmind_t)
kernel_read_system_state(kadmind_t)

corenet_all_recvfrom_unlabeled(kadmind_t)
corenet_all_recvfrom_netlabel(kadmind_t)
corenet_tcp_sendrecv_all_if(kadmind_t)
corenet_udp_sendrecv_all_if(kadmind_t)
corenet_tcp_sendrecv_all_nodes(kadmind_t)
corenet_udp_sendrecv_all_nodes(kadmind_t)
corenet_tcp_sendrecv_all_ports(kadmind_t)
corenet_udp_sendrecv_all_ports(kadmind_t)
corenet_tcp_bind_all_nodes(kadmind_t)
corenet_udp_bind_all_nodes(kadmind_t)
corenet_tcp_bind_kerberos_admin_port(kadmind_t)
corenet_udp_bind_kerberos_admin_port(kadmind_t)
corenet_tcp_bind_reserved_port(kadmind_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(kadmind_t)
corenet_sendrecv_kerberos_admin_server_packets(kadmind_t)

dev_read_sysfs(kadmind_t)
dev_read_rand(kadmind_t)
dev_read_urand(kadmind_t)

fs_getattr_all_fs(kadmind_t)
fs_search_auto_mountpoints(kadmind_t)

domain_use_interactive_fds(kadmind_t)

files_read_etc_files(kadmind_t)
files_read_usr_symlinks(kadmind_t)
files_read_usr_files(kadmind_t)
files_read_var_files(kadmind_t)

selinux_validate_context(kadmind_t)

libs_use_ld_so(kadmind_t)
libs_use_shared_libs(kadmind_t)

logging_send_syslog_msg(kadmind_t)

miscfiles_read_localization(kadmind_t)

seutil_read_file_contexts(kadmind_t)

sysnet_read_config(kadmind_t)
sysnet_use_ldap(kadmind_t)

userdom_dontaudit_use_unpriv_user_fds(kadmind_t)

sysadm_dontaudit_search_home_dirs(kadmind_t)

optional_policy(`
	nis_use_ypbind(kadmind_t)
')

optional_policy(`
	seutil_sigchld_newrole(kadmind_t)
')

optional_policy(`
	udev_read_db(kadmind_t)
')

########################################
#
# Krb5kdc local policy
#

# Use capabilities. Surplus capabilities may be allowed.
allow krb5kdc_t self:capability { setuid setgid net_admin chown fowner dac_override sys_nice };
dontaudit krb5kdc_t self:capability sys_tty_config;
allow krb5kdc_t self:process { setfscreate setsched getsched signal_perms };
allow krb5kdc_t self:netlink_route_socket r_netlink_socket_perms;
allow krb5kdc_t self:tcp_socket create_stream_socket_perms;
allow krb5kdc_t self:udp_socket create_socket_perms;
allow krb5kdc_t self:fifo_file rw_fifo_file_perms;

allow krb5kdc_t krb5_conf_t:file read_file_perms;
dontaudit krb5kdc_t krb5_conf_t:file write;

can_exec(krb5kdc_t, krb5kdc_exec_t)

read_files_pattern(krb5kdc_t, krb5kdc_conf_t, krb5kdc_conf_t)
dontaudit krb5kdc_t krb5kdc_conf_t:file write;

allow krb5kdc_t krb5kdc_lock_t:file { rw_file_perms setattr };

allow krb5kdc_t krb5kdc_log_t:file manage_file_perms;
logging_log_filetrans(krb5kdc_t, krb5kdc_log_t, file)

allow krb5kdc_t krb5kdc_principal_t:file read_file_perms;
dontaudit krb5kdc_t krb5kdc_principal_t:file write;

manage_dirs_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
manage_files_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
files_tmp_filetrans(krb5kdc_t, krb5kdc_tmp_t, { file dir })

manage_files_pattern(krb5kdc_t, krb5kdc_var_run_t, krb5kdc_var_run_t)
files_pid_filetrans(krb5kdc_t, krb5kdc_var_run_t, file)

kernel_read_system_state(krb5kdc_t)
kernel_read_kernel_sysctls(krb5kdc_t)
kernel_list_proc(krb5kdc_t)
kernel_read_proc_symlinks(krb5kdc_t)
kernel_read_network_state(krb5kdc_t)
kernel_search_network_sysctl(krb5kdc_t)

corecmd_exec_bin(krb5kdc_t)

corenet_all_recvfrom_unlabeled(krb5kdc_t)
corenet_all_recvfrom_netlabel(krb5kdc_t)
corenet_tcp_sendrecv_all_if(krb5kdc_t)
corenet_udp_sendrecv_all_if(krb5kdc_t)
corenet_tcp_sendrecv_all_nodes(krb5kdc_t)
corenet_udp_sendrecv_all_nodes(krb5kdc_t)
corenet_tcp_sendrecv_all_ports(krb5kdc_t)
corenet_udp_sendrecv_all_ports(krb5kdc_t)
corenet_tcp_bind_all_nodes(krb5kdc_t)
corenet_udp_bind_all_nodes(krb5kdc_t)
corenet_tcp_bind_kerberos_port(krb5kdc_t)
corenet_udp_bind_kerberos_port(krb5kdc_t)
corenet_tcp_connect_ocsp_port(krb5kdc_t)
corenet_sendrecv_kerberos_server_packets(krb5kdc_t)
corenet_sendrecv_ocsp_client_packets(krb5kdc_t)

dev_read_sysfs(krb5kdc_t)
dev_read_urand(krb5kdc_t)

fs_getattr_all_fs(krb5kdc_t)
fs_search_auto_mountpoints(krb5kdc_t)

domain_use_interactive_fds(krb5kdc_t)

files_read_etc_files(krb5kdc_t)
files_read_usr_symlinks(krb5kdc_t)
files_read_var_files(krb5kdc_t)

selinux_validate_context(krb5kdc_t)

libs_use_ld_so(krb5kdc_t)
libs_use_shared_libs(krb5kdc_t)

logging_send_syslog_msg(krb5kdc_t)

miscfiles_read_localization(krb5kdc_t)

seutil_read_file_contexts(krb5kdc_t)

sysnet_read_config(krb5kdc_t)
sysnet_use_ldap(krb5kdc_t)

userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t)

sysadm_dontaudit_search_home_dirs(krb5kdc_t)

optional_policy(`
	nis_use_ypbind(krb5kdc_t)
')

optional_policy(`
	seutil_sigchld_newrole(krb5kdc_t)
')

optional_policy(`
	udev_read_db(krb5kdc_t)
')

########################################
#
# kpropd local policy
#

allow kpropd_t self:capability net_bind_service;
allow kpropd_t self:fifo_file rw_file_perms;
allow kpropd_t self:unix_stream_socket create_stream_socket_perms;
allow kpropd_t self:tcp_socket create_stream_socket_perms;

allow kpropd_t krb5_host_rcache_t:file rw_file_perms;

allow kpropd_t krb5_keytab_t:file read_file_perms;

manage_files_pattern(kpropd_t, krb5kdc_conf_t, krb5kdc_principal_t)

corecmd_exec_bin(kpropd_t)

corenet_all_recvfrom_unlabeled(kpropd_t)
corenet_tcp_sendrecv_all_if(kpropd_t)
corenet_tcp_sendrecv_all_nodes(kpropd_t)
corenet_tcp_sendrecv_all_ports(kpropd_t)
corenet_tcp_bind_all_nodes(kpropd_t)

dev_read_urand(kpropd_t)

files_read_etc_files(kpropd_t)
files_search_tmp(kpropd_t)

libs_use_ld_so(kpropd_t)
libs_use_shared_libs(kpropd_t)

logging_send_syslog_msg(kpropd_t)

miscfiles_read_localization(kpropd_t)

sysnet_dns_name_resolve(kpropd_t)

kerberos_use(kpropd_t)
initial commit 2005-06-30 21:11:54 +00:00
trunk: bump version numbers for release. 2008-10-14 15:46:36 +00:00			`policy_module(kerberos, 1.8.0)`
initial commit 2005-06-30 21:11:54 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00			`## <desc>`
			`## <p>`
trunk: Improve several tunables descriptions from Dan Walsh. 2007-12-07 15:44:53 +00:00			`## Allow confined applications to run with kerberos.`
- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00			`## </p>`
			`## </desc>`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`gen_tunable(allow_kerberos, false)`
- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00
initial commit 2005-06-30 21:11:54 +00:00			`type kadmind_t;`
			`type kadmind_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_daemon_domain(kadmind_t, kadmind_exec_t)`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`domain_obj_id_change_exemption(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00
			`type kadmind_log_t;`
			`logging_log_file(kadmind_log_t)`

			`type kadmind_tmp_t;`
			`files_tmp_file(kadmind_tmp_t)`

			`type kadmind_var_run_t;`
			`files_pid_file(kadmind_var_run_t)`

trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`type kerberos_initrc_exec_t;`
			`init_script_file(kerberos_initrc_exec_t)`

			`type kpropd_t;`
			`type kpropd_exec_t;`
			`init_daemon_domain(kpropd_t, kpropd_exec_t)`

initial commit 2005-06-30 21:11:54 +00:00			`type krb5_conf_t;`
			`files_type(krb5_conf_t)`

trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`type krb5_host_rcache_t;`
			`files_tmp_file(krb5_host_rcache_t)`

initial commit 2005-06-30 21:11:54 +00:00			`# types for general configuration files in /etc`
start adding secure_file_type implementation 2005-09-28 19:07:22 +00:00			`type krb5_keytab_t;`
			`files_security_file(krb5_keytab_t)`
initial commit 2005-06-30 21:11:54 +00:00
			`# types for KDC configs and principal file(s)`
			`type krb5kdc_conf_t;`
			`files_type(krb5kdc_conf_t)`

trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`type krb5kdc_lock_t;`
			`files_type(krb5kdc_lock_t)`

initial commit 2005-06-30 21:11:54 +00:00			`# types for KDC principal file(s)`
			`type krb5kdc_principal_t;`
			`files_type(krb5kdc_principal_t)`

			`type krb5kdc_t;`
			`type krb5kdc_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_daemon_domain(krb5kdc_t, krb5kdc_exec_t)`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`domain_obj_id_change_exemption(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00
			`type krb5kdc_log_t;`
			`logging_log_file(krb5kdc_log_t)`

			`type krb5kdc_tmp_t;`
			`files_tmp_file(krb5kdc_tmp_t)`

			`type krb5kdc_var_run_t;`
			`files_pid_file(krb5kdc_var_run_t)`

			`########################################`
			`#`
			`# kadmind local policy`
			`#`

			`# Use capabilities. Surplus capabilities may be allowed.`
			`allow kadmind_t self:capability { setuid setgid chown fowner dac_override sys_nice };`
			`dontaudit kadmind_t self:capability sys_tty_config;`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`allow kadmind_t self:process { setfscreate signal_perms };`
initial commit 2005-06-30 21:11:54 +00:00			`allow kadmind_t self:netlink_route_socket r_netlink_socket_perms;`
			`allow kadmind_t self:unix_dgram_socket { connect create write };`
another pile o fixes 2005-10-26 18:07:20 +00:00			`allow kadmind_t self:tcp_socket connected_stream_socket_perms;`
			`allow kadmind_t self:udp_socket create_socket_perms;`
initial commit 2005-06-30 21:11:54 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow kadmind_t kadmind_log_t:file manage_file_perms;`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`logging_log_filetrans(kadmind_t,kadmind_log_t,file)`
initial commit 2005-06-30 21:11:54 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow kadmind_t krb5_conf_t:file read_file_perms;`
initial commit 2005-06-30 21:11:54 +00:00			`dontaudit kadmind_t krb5_conf_t:file write;`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(kadmind_t, krb5kdc_conf_t, krb5kdc_conf_t)`
from dan: kadmind trys to setattr on krb5kdc file. Just a library checking access. 2007-04-10 17:20:07 +00:00			`dontaudit kadmind_t krb5kdc_conf_t:file { write setattr };`
initial commit 2005-06-30 21:11:54 +00:00
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`allow kadmind_t krb5kdc_lock_t:file { rw_file_perms setattr };`

			`allow kadmind_t krb5kdc_principal_t:file manage_file_perms;`
			`filetrans_pattern(kadmind_t, krb5kdc_conf_t, krb5kdc_principal_t, file)`
initial commit 2005-06-30 21:11:54 +00:00
			`can_exec(kadmind_t, kadmind_exec_t)`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(kadmind_t, kadmind_tmp_t, kadmind_tmp_t)`
			`manage_files_pattern(kadmind_t, kadmind_tmp_t, kadmind_tmp_t)`
another round of renaming 2006-02-21 18:40:44 +00:00			`files_tmp_filetrans(kadmind_t, kadmind_tmp_t, { file dir })`
initial commit 2005-06-30 21:11:54 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(kadmind_t, kadmind_var_run_t, kadmind_var_run_t)`
			`files_pid_filetrans(kadmind_t, kadmind_var_run_t, file)`
initial commit 2005-06-30 21:11:54 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(kadmind_t)`
more cleanup of current TODOs 2005-07-12 20:34:24 +00:00			`kernel_list_proc(kadmind_t)`
			`kernel_read_proc_symlinks(kadmind_t)`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`kernel_read_system_state(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00
trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(kadmind_t)`
			`corenet_all_recvfrom_netlabel(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_sendrecv_all_if(kadmind_t)`
corenet fixes 2005-10-24 17:06:34 +00:00			`corenet_udp_sendrecv_all_if(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_sendrecv_all_nodes(kadmind_t)`
corenet fixes 2005-10-24 17:06:34 +00:00			`corenet_udp_sendrecv_all_nodes(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_sendrecv_all_ports(kadmind_t)`
corenet fixes 2005-10-24 17:06:34 +00:00			`corenet_udp_sendrecv_all_ports(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_bind_all_nodes(kadmind_t)`
corenet fixes 2005-10-24 17:06:34 +00:00			`corenet_udp_bind_all_nodes(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_bind_kerberos_admin_port(kadmind_t)`
			`corenet_udp_bind_kerberos_admin_port(kadmind_t)`
			`corenet_tcp_bind_reserved_port(kadmind_t)`
			`corenet_dontaudit_tcp_bind_all_reserved_ports(kadmind_t)`
packets for services 2006-05-30 19:46:34 +00:00			`corenet_sendrecv_kerberos_admin_server_packets(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00
			`dev_read_sysfs(kadmind_t)`
			`dev_read_rand(kadmind_t)`
			`dev_read_urand(kadmind_t)`

			`fs_getattr_all_fs(kadmind_t)`
			`fs_search_auto_mountpoints(kadmind_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00
			`files_read_etc_files(kadmind_t)`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`files_read_usr_symlinks(kadmind_t)`
			`files_read_usr_files(kadmind_t)`
			`files_read_var_files(kadmind_t)`

			`selinux_validate_context(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00
			`libs_use_ld_so(kadmind_t)`
			`libs_use_shared_libs(kadmind_t)`

			`logging_send_syslog_msg(kadmind_t)`

			`miscfiles_read_localization(kadmind_t)`

trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`seutil_read_file_contexts(kadmind_t)`

initial commit 2005-06-30 21:11:54 +00:00			`sysnet_read_config(kadmind_t)`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`sysnet_use_ldap(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(kadmind_t)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00
			`sysadm_dontaudit_search_home_dirs(kadmind_t)`
initial commit 2005-06-30 21:11:54 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
initial commit 2005-06-30 21:11:54 +00:00			`nis_use_ypbind(kadmind_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
initial commit 2005-06-30 21:11:54 +00:00			`seutil_sigchld_newrole(kadmind_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
initial commit 2005-06-30 21:11:54 +00:00			`udev_read_db(kadmind_t)`
			`')`

			`########################################`
			`#`
			`# Krb5kdc local policy`
			`#`

			`# Use capabilities. Surplus capabilities may be allowed.`
			`allow krb5kdc_t self:capability { setuid setgid net_admin chown fowner dac_override sys_nice };`
			`dontaudit krb5kdc_t self:capability sys_tty_config;`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`allow krb5kdc_t self:process { setfscreate setsched getsched signal_perms };`
initial commit 2005-06-30 21:11:54 +00:00			`allow krb5kdc_t self:netlink_route_socket r_netlink_socket_perms;`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`allow krb5kdc_t self:tcp_socket create_stream_socket_perms;`
pile o fixes 2005-10-26 16:00:13 +00:00			`allow krb5kdc_t self:udp_socket create_socket_perms;`
On Tue, 2007-02-20 at 12:02 -0500, Daniel J Walsh wrote: > Eliminate excess avc messages created when using kerberos libraries > > krb5kdc wans to setsched > > Also uses a fifo_file to communicate. > > Needs to search_network_sysctl 2007-02-26 17:04:56 +00:00			`allow krb5kdc_t self:fifo_file rw_fifo_file_perms;`
initial commit 2005-06-30 21:11:54 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow krb5kdc_t krb5_conf_t:file read_file_perms;`
initial commit 2005-06-30 21:11:54 +00:00			`dontaudit krb5kdc_t krb5_conf_t:file write;`

			`can_exec(krb5kdc_t, krb5kdc_exec_t)`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(krb5kdc_t, krb5kdc_conf_t, krb5kdc_conf_t)`
initial commit 2005-06-30 21:11:54 +00:00			`dontaudit krb5kdc_t krb5kdc_conf_t:file write;`

trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`allow krb5kdc_t krb5kdc_lock_t:file { rw_file_perms setattr };`

merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow krb5kdc_t krb5kdc_log_t:file manage_file_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`logging_log_filetrans(krb5kdc_t, krb5kdc_log_t, file)`
initial commit 2005-06-30 21:11:54 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow krb5kdc_t krb5kdc_principal_t:file read_file_perms;`
initial commit 2005-06-30 21:11:54 +00:00			`dontaudit krb5kdc_t krb5kdc_principal_t:file write;`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t)`
			`manage_files_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t)`
another round of renaming 2006-02-21 18:40:44 +00:00			`files_tmp_filetrans(krb5kdc_t, krb5kdc_tmp_t, { file dir })`
initial commit 2005-06-30 21:11:54 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(krb5kdc_t, krb5kdc_var_run_t, krb5kdc_var_run_t)`
			`files_pid_filetrans(krb5kdc_t, krb5kdc_var_run_t, file)`
initial commit 2005-06-30 21:11:54 +00:00
			`kernel_read_system_state(krb5kdc_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(krb5kdc_t)`
more cleanup of current TODOs 2005-07-12 20:34:24 +00:00			`kernel_list_proc(krb5kdc_t)`
			`kernel_read_proc_symlinks(krb5kdc_t)`
patch from dan Mon, 12 Jun 2006 15:32:00 -0400 2006-06-12 21:36:38 +00:00			`kernel_read_network_state(krb5kdc_t)`
On Tue, 2007-02-20 at 12:02 -0500, Daniel J Walsh wrote: > Eliminate excess avc messages created when using kerberos libraries > > krb5kdc wans to setsched > > Also uses a fifo_file to communicate. > > Needs to search_network_sysctl 2007-02-26 17:04:56 +00:00			`kernel_search_network_sysctl(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`corecmd_exec_bin(krb5kdc_t)`

trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(krb5kdc_t)`
			`corenet_all_recvfrom_netlabel(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_sendrecv_all_if(krb5kdc_t)`
corenet fixes 2005-10-24 17:06:34 +00:00			`corenet_udp_sendrecv_all_if(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_sendrecv_all_nodes(krb5kdc_t)`
corenet fixes 2005-10-24 17:06:34 +00:00			`corenet_udp_sendrecv_all_nodes(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_sendrecv_all_ports(krb5kdc_t)`
corenet fixes 2005-10-24 17:06:34 +00:00			`corenet_udp_sendrecv_all_ports(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_bind_all_nodes(krb5kdc_t)`
corenet fixes 2005-10-24 17:06:34 +00:00			`corenet_udp_bind_all_nodes(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00			`corenet_tcp_bind_kerberos_port(krb5kdc_t)`
			`corenet_udp_bind_kerberos_port(krb5kdc_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`corenet_tcp_connect_ocsp_port(krb5kdc_t)`
packets for services 2006-05-30 19:46:34 +00:00			`corenet_sendrecv_kerberos_server_packets(krb5kdc_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`corenet_sendrecv_ocsp_client_packets(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00
			`dev_read_sysfs(krb5kdc_t)`
			`dev_read_urand(krb5kdc_t)`

			`fs_getattr_all_fs(krb5kdc_t)`
			`fs_search_auto_mountpoints(krb5kdc_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00
			`files_read_etc_files(krb5kdc_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`files_read_usr_symlinks(krb5kdc_t)`
			`files_read_var_files(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`selinux_validate_context(krb5kdc_t)`

initial commit 2005-06-30 21:11:54 +00:00			`libs_use_ld_so(krb5kdc_t)`
			`libs_use_shared_libs(krb5kdc_t)`

			`logging_send_syslog_msg(krb5kdc_t)`

			`miscfiles_read_localization(krb5kdc_t)`

trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`seutil_read_file_contexts(krb5kdc_t)`

initial commit 2005-06-30 21:11:54 +00:00			`sysnet_read_config(krb5kdc_t)`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00			`sysnet_use_ldap(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00
			`sysadm_dontaudit_search_home_dirs(krb5kdc_t)`
initial commit 2005-06-30 21:11:54 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
initial commit 2005-06-30 21:11:54 +00:00			`nis_use_ypbind(krb5kdc_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
initial commit 2005-06-30 21:11:54 +00:00			`seutil_sigchld_newrole(krb5kdc_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
initial commit 2005-06-30 21:11:54 +00:00			`udev_read_db(krb5kdc_t)`
			`')`
trunk: missing bits from dan's previous round of patches. 2008-10-09 14:01:53 +00:00
			`########################################`
			`#`
			`# kpropd local policy`
			`#`

			`allow kpropd_t self:capability net_bind_service;`
			`allow kpropd_t self:fifo_file rw_file_perms;`
			`allow kpropd_t self:unix_stream_socket create_stream_socket_perms;`
			`allow kpropd_t self:tcp_socket create_stream_socket_perms;`

			`allow kpropd_t krb5_host_rcache_t:file rw_file_perms;`

			`allow kpropd_t krb5_keytab_t:file read_file_perms;`

			`manage_files_pattern(kpropd_t, krb5kdc_conf_t, krb5kdc_principal_t)`

			`corecmd_exec_bin(kpropd_t)`

			`corenet_all_recvfrom_unlabeled(kpropd_t)`
			`corenet_tcp_sendrecv_all_if(kpropd_t)`
			`corenet_tcp_sendrecv_all_nodes(kpropd_t)`
			`corenet_tcp_sendrecv_all_ports(kpropd_t)`
			`corenet_tcp_bind_all_nodes(kpropd_t)`

			`dev_read_urand(kpropd_t)`

			`files_read_etc_files(kpropd_t)`
			`files_search_tmp(kpropd_t)`

			`libs_use_ld_so(kpropd_t)`
			`libs_use_shared_libs(kpropd_t)`

			`logging_send_syslog_msg(kpropd_t)`

			`miscfiles_read_localization(kpropd_t)`

			`sysnet_dns_name_resolve(kpropd_t)`

			`kerberos_use(kpropd_t)`