nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nis patch from Dan Walsh

Browse Source 
Made a couple style changes.
Removed unnecessary require in nis_use_ypbind interface
This commit is contained in:
Jeremy Solt 2010-04-09 11:52:54 -04:00 committed by Chris PeBenito
parent da5940411c
commit 4b121a5f53
3 changed files with 102 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
policy/modules/services/nis.fc
View File

@ -1,4 +1,7 @@
/etc/rc\.d/init\.d/ypbind -- gen_context(system_u:object_r:ypbind_initrc_exec_t,s0)
/etc/rc\.d/init\.d/yppasswd -- gen_context(system_u:object_r:nis_initrc_exec_t,s0)
/etc/rc\.d/init\.d/ypserv -- gen_context(system_u:object_r:nis_initrc_exec_t,s0)
/etc/rc\.d/init\.d/ypxfrd -- gen_context(system_u:object_r:nis_initrc_exec_t,s0)
/etc/ypserv\.conf -- gen_context(system_u:object_r:ypserv_conf_t,s0)
/sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0)
@ -11,3 +14,8 @@
/usr/sbin/ypserv -- gen_context(system_u:object_r:ypserv_exec_t,s0)
/var/yp(/.*)? gen_context(system_u:object_r:var_yp_t,s0)
/var/run/ypxfrd.* -- gen_context(system_u:object_r:ypxfr_var_run_t,s0)
/var/run/ypbind.* -- gen_context(system_u:object_r:ypbind_var_run_t,s0)
/var/run/ypserv.* -- gen_context(system_u:object_r:ypserv_var_run_t,s0)
/var/run/yppass.* -- gen_context(system_u:object_r:yppasswdd_var_run_t,s0)

79
policy/modules/services/nis.if
View File

@ -28,7 +28,7 @@ interface(`nis_use_ypbind_uncond',`
type var_yp_t;
')
dontaudit $1 self:capability net_bind_service;
allow $1 self:capability net_bind_service;
allow $1 self:tcp_socket create_stream_socket_perms;
allow $1 self:udp_socket create_socket_perms;
@ -131,13 +131,39 @@ interface(`nis_domtrans_ypbind',`
domtrans_pattern($1, ypbind_exec_t, ypbind_t)
')
########################################
## <summary>
## Execute ypbind in the ypbind domain, and
## allow the specified role the ypbind domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to be allowed the ypbind domain.
## </summary>
## </param>
## <rolecap/>
#
interface(`nis_run_ypbind',`
gen_require(`
type ypbind_t;
')
nis_domtrans_ypbind($1)
role $2 types ypbind_t;
')
########################################
## <summary>
## Send generic signals to ypbind.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -155,7 +181,7 @@ interface(`nis_signal_ypbind',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -174,7 +200,7 @@ interface(`nis_list_var_yp',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -272,6 +298,43 @@ interface(`nis_domtrans_ypxfr',`
domtrans_pattern($1, ypxfr_exec_t, ypxfr_t)
')
########################################
## <summary>
## Execute nis server in the nis domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
#
interface(`nis_initrc_domtrans',`
gen_require(`
type nis_initrc_exec_t;
')
init_labeled_script_domtrans($1, nis_initrc_exec_t)
')
########################################
## <summary>
## Execute nis server in the nis domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`nis_ypbind_initrc_domtrans',`
gen_require(`
type ypbind_initrc_exec_t;
')
init_labeled_script_domtrans($1, ypbind_initrc_exec_t)
')
########################################
## <summary>
## All of the rules required to administrate
@ -294,6 +357,7 @@ interface(`nis_admin',`
type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t;
type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t;
type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t;
type ypbind_initrc_exec_t, nis_initrc_exec_t;
')
allow $1 ypbind_t:process { ptrace signal_perms };
@ -308,6 +372,13 @@ interface(`nis_admin',`
allow $1 ypxfr_t:process { ptrace signal_perms };
ps_process_pattern($1, ypxfr_t)
nis_initrc_domtrans($1)
nis_ypbind_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 nis_initrc_exec_t system_r;
role_transition $2 ypbind_initrc_exec_t system_r;
allow $2 system_r;
files_list_tmp($1)
admin_pattern($1, ypbind_tmp_t)

21
policy/modules/services/nis.te
View File

@ -13,6 +13,9 @@ type ypbind_t;
type ypbind_exec_t;
init_daemon_domain(ypbind_t, ypbind_exec_t)
type ypbind_initrc_exec_t;
init_script_file(ypbind_initrc_exec_t)
type ypbind_tmp_t;
files_tmp_file(ypbind_tmp_t)
@ -44,6 +47,12 @@ type ypxfr_t;
type ypxfr_exec_t;
init_daemon_domain(ypxfr_t, ypxfr_exec_t)
type ypxfr_var_run_t;
files_pid_file(ypxfr_var_run_t)
type nis_initrc_exec_t;
init_script_file(nis_initrc_exec_t)
########################################
#
# ypbind local policy
@ -65,9 +74,8 @@ files_pid_filetrans(ypbind_t, ypbind_var_run_t, file)
manage_files_pattern(ypbind_t, var_yp_t, var_yp_t)
kernel_read_system_state(ypbind_t)
kernel_read_kernel_sysctls(ypbind_t)
kernel_list_proc(ypbind_t)
kernel_read_proc_symlinks(ypbind_t)
corenet_all_recvfrom_unlabeled(ypbind_t)
corenet_all_recvfrom_netlabel(ypbind_t)
@ -136,7 +144,7 @@ optional_policy(`
allow yppasswdd_t self:capability dac_override;
dontaudit yppasswdd_t self:capability sys_tty_config;
allow yppasswdd_t self:fifo_file rw_fifo_file_perms;
allow yppasswdd_t self:process { setfscreate signal_perms };
allow yppasswdd_t self:process { getsched setfscreate signal_perms };
allow yppasswdd_t self:unix_dgram_socket create_socket_perms;
allow yppasswdd_t self:unix_stream_socket create_stream_socket_perms;
allow yppasswdd_t self:netlink_route_socket r_netlink_socket_perms;
@ -250,6 +258,8 @@ corenet_tcp_sendrecv_all_ports(ypserv_t)
corenet_udp_sendrecv_all_ports(ypserv_t)
corenet_tcp_bind_generic_node(ypserv_t)
corenet_udp_bind_generic_node(ypserv_t)
corenet_tcp_bind_reserved_port(ypserv_t)
corenet_udp_bind_reserved_port(ypserv_t)
corenet_tcp_bind_all_rpc_ports(ypserv_t)
corenet_udp_bind_all_rpc_ports(ypserv_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t)
@ -305,6 +315,9 @@ allow ypxfr_t ypserv_t:udp_socket { read write };
allow ypxfr_t ypserv_conf_t:file read_file_perms;
manage_files_pattern(ypxfr_t, ypxfr_var_run_t, ypxfr_var_run_t)
files_pid_filetrans(ypxfr_t, ypxfr_var_run_t, file)
corenet_all_recvfrom_unlabeled(ypxfr_t)
corenet_all_recvfrom_netlabel(ypxfr_t)
corenet_tcp_sendrecv_generic_if(ypxfr_t)
@ -315,6 +328,8 @@ corenet_tcp_sendrecv_all_ports(ypxfr_t)
corenet_udp_sendrecv_all_ports(ypxfr_t)
corenet_tcp_bind_generic_node(ypxfr_t)
corenet_udp_bind_generic_node(ypxfr_t)
corenet_tcp_bind_reserved_port(ypxfr_t)
corenet_udp_bind_reserved_port(ypxfr_t)
corenet_tcp_bind_all_rpc_ports(ypxfr_t)
corenet_udp_bind_all_rpc_ports(ypxfr_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)