From 8630e36c5caca9e58013957c42cd006a6ffddd13 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Thu, 19 May 2011 09:56:59 -0400 Subject: [PATCH] Add mpd from Fedora. --- policy/modules/kernel/corenetwork.te.in | 1 + policy/modules/services/mpd.fc | 8 + policy/modules/services/mpd.if | 267 ++++++++++++++++++++++++ policy/modules/services/mpd.te | 126 +++++++++++ 4 files changed, 402 insertions(+) create mode 100644 policy/modules/services/mpd.fc create mode 100644 policy/modules/services/mpd.if create mode 100644 policy/modules/services/mpd.te diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index ef937d058..e38ce9fca 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -143,6 +143,7 @@ network_port(mail, tcp,2000,s0, tcp,3905,s0) network_port(memcache, tcp,11211,s0, udp,11211,s0) network_port(mmcc, tcp,5050,s0, udp,5050,s0) network_port(monopd, tcp,1234,s0) +network_port(mpd, tcp,6600,s0) network_port(msnp, tcp,1863,s0, udp,1863,s0) network_port(mssql, tcp,1433-1434,s0, udp,1433-1434,s0) network_port(munin, tcp,4949,s0, udp,4949,s0) diff --git a/policy/modules/services/mpd.fc b/policy/modules/services/mpd.fc new file mode 100644 index 000000000..ddc14d6bc --- /dev/null +++ b/policy/modules/services/mpd.fc @@ -0,0 +1,8 @@ +/etc/mpd\.conf -- gen_context(system_u:object_r:mpd_etc_t,s0) +/etc/rc\.d/init\.d/mpd -- gen_context(system_u:object_r:mpd_initrc_exec_t,s0) + +/usr/bin/mpd -- gen_context(system_u:object_r:mpd_exec_t,s0) + +/var/lib/mpd(/.*)? gen_context(system_u:object_r:mpd_var_lib_t,s0) +/var/lib/mpd/music(/.*)? gen_context(system_u:object_r:mpd_data_t,s0) +/var/lib/mpd/playlists(/.*)? gen_context(system_u:object_r:mpd_data_t,s0) diff --git a/policy/modules/services/mpd.if b/policy/modules/services/mpd.if new file mode 100644 index 000000000..d72276ffc --- /dev/null +++ b/policy/modules/services/mpd.if @@ -0,0 +1,267 @@ +## Music Player Daemon + +######################################## +## +## Execute a domain transition to run mpd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`mpd_domtrans',` + gen_require(` + type mpd_t, mpd_exec_t; + ') + + domtrans_pattern($1, mpd_exec_t, mpd_t) +') + +######################################## +## +## Execute mpd server in the mpd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`mpd_initrc_domtrans',` + gen_require(` + type mpd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, mpd_initrc_exec_t) +') + +####################################### +## +## Read mpd data files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mpd_read_data_files',` + gen_require(` + type mpd_data_t; + ') + + mpd_search_lib($1) + read_files_pattern($1, mpd_data_t, mpd_data_t) +') + +###################################### +## +## Manage mpd data files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mpd_manage_data_files',` + gen_require(` + type mpd_data_t; + ') + + mpd_search_lib($1) + manage_files_pattern($1, mpd_data_t, mpd_data_t) +') + +####################################### +## +## Read mpd tmpfs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mpd_read_tmpfs_files',` + gen_require(` + type mpd_tmpfs_t; + ') + + fs_search_tmpfs($1) + read_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t) +') + +################################### +## +## Manage mpd tmpfs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mpd_manage_tmpfs_files',` + gen_require(` + type mpd_tmpfs_t; + ') + + fs_search_tmpfs($1) + manage_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t) + manage_lnk_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t) +') + +######################################## +## +## Search mpd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`mpd_search_lib',` + gen_require(` + type mpd_var_lib_t; + ') + + allow $1 mpd_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read mpd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mpd_read_lib_files',` + gen_require(` + type mpd_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t) +') + +######################################## +## +## Create, read, write, and delete +## mpd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mpd_manage_lib_files',` + gen_require(` + type mpd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t) +') + +####################################### +## +## Create an object in the root directory, with a private +## type using a type transition. +## +## +## +## Domain allowed access. +## +## +## +## +## The type of the object to be created. +## +## +## +## +## The object class of the object being created. +## +## +# +interface(`mpd_var_lib_filetrans',` + gen_require(` + type mpd_var_lib_t; + ') + + files_search_var_lib($1) + filetrans_pattern($1, mpd_var_lib_t, $2, $3) +') + +######################################## +## +## Manage mpd lib dirs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mpd_manage_lib_dirs',` + gen_require(` + type mpd_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, mpd_var_lib_t, mpd_var_lib_t) +') + +######################################## +## +## All of the rules required to administrate +## an mpd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`mpd_admin',` + gen_require(` + type mpd_t, mpd_initrc_exec_t, mpd_etc_t; + type mpd_data_t, mpd_log_t, mpd_var_lib_t; + type mpd_tmpfs_t; + ') + + allow $1 mpd_t:process { ptrace signal_perms }; + ps_process_pattern($1, mpd_t) + + mpd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 mpd_initrc_exec_t system_r; + allow $2 system_r; + + admin_pattern($1, mpd_etc_t) + files_list_etc($1) + + files_list_var_lib($1) + admin_pattern($1, mpd_var_lib_t) + + admin_pattern($1, mpd_data_t) + + admin_pattern($1, mpd_log_t) + + fs_list_tmpfs($1) + admin_pattern($1, mpd_tmpfs_t) +') diff --git a/policy/modules/services/mpd.te b/policy/modules/services/mpd.te new file mode 100644 index 000000000..7f688728e --- /dev/null +++ b/policy/modules/services/mpd.te @@ -0,0 +1,126 @@ +policy_module(mpd, 1.0.0) + +######################################## +# +# Declarations +# + +type mpd_t; +type mpd_exec_t; +init_daemon_domain(mpd_t, mpd_exec_t) + +# type for music content +type mpd_data_t; +files_type(mpd_data_t) + +type mpd_etc_t; +files_config_file(mpd_etc_t) + +type mpd_initrc_exec_t; +init_script_file(mpd_initrc_exec_t) + +type mpd_log_t; +logging_log_file(mpd_log_t) + +type mpd_tmp_t; +files_tmp_file(mpd_tmp_t) + +type mpd_tmpfs_t; +files_tmpfs_file(mpd_tmpfs_t) + +type mpd_var_lib_t; +files_type(mpd_var_lib_t) + +######################################## +# +# mpd local policy +# + +# dac_override bug in mpd relating to mpd.log file +allow mpd_t self:capability { dac_override kill setgid setuid }; +allow mpd_t self:process { getsched setsched setrlimit signal signull }; +allow mpd_t self:fifo_file rw_fifo_file_perms; +allow mpd_t self:unix_stream_socket { connectto create_stream_socket_perms }; +allow mpd_t self:unix_dgram_socket { create_socket_perms sendto }; +allow mpd_t self:tcp_socket create_stream_socket_perms; +allow mpd_t self:netlink_kobject_uevent_socket create_socket_perms; + +manage_dirs_pattern(mpd_t, mpd_data_t, mpd_data_t) +manage_files_pattern(mpd_t, mpd_data_t, mpd_data_t) +manage_lnk_files_pattern(mpd_t, mpd_data_t, mpd_data_t) + +read_files_pattern(mpd_t, mpd_etc_t, mpd_etc_t) + +manage_dirs_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t) +manage_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t) +manage_sock_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t) +files_tmp_filetrans(mpd_t, mpd_tmp_t, { dir file sock_file }) + +manage_files_pattern(mpd_t, mpd_tmpfs_t, mpd_tmpfs_t) +manage_dirs_pattern(mpd_t, mpd_tmpfs_t, mpd_tmpfs_t) +fs_tmpfs_filetrans(mpd_t, mpd_tmpfs_t, file ) + +manage_dirs_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t) +manage_files_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t) +manage_lnk_files_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t) +files_var_lib_filetrans(mpd_t, mpd_var_lib_t, { dir file lnk_file }) + +# needed by pulseaudio +kernel_getattr_proc(mpd_t) +kernel_read_system_state(mpd_t) +kernel_read_kernel_sysctls(mpd_t) + +corecmd_exec_bin(mpd_t) + +corenet_all_recvfrom_unlabeled(mpd_t) +corenet_all_recvfrom_netlabel(mpd_t) +corenet_tcp_sendrecv_generic_if(mpd_t) +corenet_tcp_sendrecv_generic_node(mpd_t) +corenet_tcp_bind_mpd_port(mpd_t) +corenet_tcp_bind_soundd_port(mpd_t) +corenet_tcp_connect_http_port(mpd_t) +corenet_tcp_connect_http_cache_port(mpd_t) +corenet_tcp_connect_pulseaudio_port(mpd_t) +corenet_tcp_connect_soundd_port(mpd_t) +corenet_sendrecv_http_client_packets(mpd_t) +corenet_sendrecv_http_cache_client_packets(mpd_t) +corenet_sendrecv_pulseaudio_client_packets(mpd_t) +corenet_sendrecv_soundd_client_packets(mpd_t) + +dev_read_sound(mpd_t) +dev_write_sound(mpd_t) +dev_read_sysfs(mpd_t) + +files_read_usr_files(mpd_t) + +fs_getattr_tmpfs(mpd_t) +fs_list_inotifyfs(mpd_t) +fs_rw_anon_inodefs_files(mpd_t) + +auth_use_nsswitch(mpd_t) + +logging_send_syslog_msg(mpd_t) + +miscfiles_read_localization(mpd_t) + +optional_policy(` + alsa_read_rw_config(mpd_t) +') + +optional_policy(` + consolekit_dbus_chat(mpd_t) +') + +optional_policy(` + dbus_system_bus_client(mpd_t) +') + +optional_policy(` + pulseaudio_exec(mpd_t) + pulseaudio_stream_connect(mpd_t) + pulseaudio_signull(mpd_t) +') + +optional_policy(` + udev_read_db(mpd_t) +')