Commit Graph

3197 Commits

Author SHA1 Message Date
Sven Vermeulen
d30069e4dc Allow zabbix server to connect to agent (active monitoring)
The zabbix server also connects to the agents (this is called "active
monitoring" in the zabbix terms). So we create a zabbix_agent_tcp_connect
interface, use it for the zabbix_t domain and, since zabbix can use
hostname-based connections, allow DNS resolving for the zabbix server.

Update: Follow styleguide

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:41:09 -04:00
Sven Vermeulen
80b95df00a Zabbix agent binds on its own port, connects to zabbix server
The zabbix agent has its own dedicated port (10050) on which it needs to
bind/listen.

Also, the agent connects to the server so we add the zabbix_tcp_connect
interface (shamelessly copied from mysql_tcp_connect) and use it for the
zabbix_agent_t domain.

Update: structure interface calls more closely to styleguide

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:41:03 -04:00
Sven Vermeulen
5b85c03633 Support different domain for zabbix agent (start with skeleton)
The zabbix agent should be confined within its own domain. We start with the
definition of a small(er) skeleton to work from. This includes proper file
context definitions, standard interdomain privileges (which are quite
similar to those of the server) and the proper log- and pid access
privileges.

Update: attempt to follow styleguide more closely

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:40:58 -04:00
Sven Vermeulen
5b17d3e7d6 Define zabbix port and allow server to listen/bind on it
The zabbix server uses a dedicated port (10051). We define it and allow the
zabbix server to bind/listen on it.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:40:54 -04:00
Sven Vermeulen
1f1723e008 Support shared memory
On Mon, Jun 13, 2011 at 10:28:15AM +0200, Sven Vermeulen wrote:
> Zabbix servers use shared memory to keep common information and structures.
> This is implemented on tmpfs. We support this by introducing a
> zabbix_tmpfs_t type and allow the server proper access to it.

After a small discussion and a few more tests, drop the "dir" in
fs_tmpfs_filetrans.

For posterity's sake, this is the denial one gets when no tmpfs_t related
privileges are given:

Jun 13 11:24:06 build kernel: [  213.054230] type=1400
audit(1307957046.001:106): avc:  denied  { read write } for  pid=3162
comm="zabbix_agentd" path=2F535953563663303132323534202864656C6574656429
dev=tmpfs ino=32768 scontext=system_u:system_r:zabbix_agent_t
tcontext=system_u:object_r:tmpfs_t tclass=file

With fs_tmpfs_filetrans(..., file) the same denial is given, but as
tcontext=zabbix_tmpfs_t. Hence the rw_files_pattern() enhancement.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:40:49 -04:00
Sven Vermeulen
ae5814904e zabbix server spawns multiple processes
The zabbix server process is a multi-process system.

In order to, for instance, shut it down, signalling within the domain is
necessary. Otherwise, the processes remain running.

Also, since there are multiple processes trying to use the same log file,
the zabbix server uses semaphores to ensure proper access to the log files
(concurrency).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-06-15 13:40:45 -04:00
Chris PeBenito
b598c4421c Merge various apps layer changes from the Fedora policy. 2011-06-08 13:05:34 -04:00
Chris PeBenito
003dbe0c66 Cyrus file context update for Gentoo from Corentin Labbe. 2011-06-08 08:51:55 -04:00
Chris PeBenito
78b1d1182c Merge ncftool from Fedora. 2011-06-07 09:14:53 -04:00
Chris PeBenito
508df21fab Fix incorrect parameter in semanage call in likewise. 2011-05-25 08:30:54 -04:00
Chris PeBenito
8c3e30f913 Module version bump and changelog for Fedora modules. 2011-05-24 09:12:43 -04:00
Chris PeBenito
af82a77675 Add zarafa from Fedora. 2011-05-24 09:11:56 -04:00
Chris PeBenito
ef77678865 Move passenger to admin layer. 2011-05-20 10:29:20 -04:00
Chris PeBenito
f5df601718 Add passenger from Fedora. 2011-05-20 10:27:47 -04:00
Chris PeBenito
0d62ce9373 Move mediawiki to services layer. 2011-05-20 10:20:28 -04:00
Chris PeBenito
ffca31359c Add mediawiki from Fedora. 2011-05-20 10:17:12 -04:00
Chris PeBenito
d2defd81e3 Add telepathy from Fedora. 2011-05-20 10:16:09 -04:00
Chris PeBenito
2e6db061ce Rename qpidd to qpid. 2011-05-20 09:32:13 -04:00
Chris PeBenito
10672e1e2a Add qpidd from Fedora. 2011-05-20 09:31:04 -04:00
Chris PeBenito
0895456538 Add vnstatd from Fedora. 2011-05-20 09:15:25 -04:00
Chris PeBenito
30e4a4eda1 Add bugzilla policy from Fedora. 2011-05-20 09:11:07 -04:00
Chris PeBenito
8630e36c5c Add mpd from Fedora. 2011-05-19 09:56:59 -04:00
Chris PeBenito
f640bb3e0d Add colord from Fedora. 2011-05-19 09:56:44 -04:00
Chris PeBenito
953f031871 Add cmirrord from Fedora. 2011-05-19 09:14:25 -04:00
Chris PeBenito
d90a1aab54 Add aiccu from Fedora. 2011-05-19 09:09:09 -04:00
Chris PeBenito
092db99e8e Module version bump for mozilla tmp type patch from Sven Vermeulen. 2011-05-04 09:17:06 -04:00
Chris PeBenito
4858b1b14d Remove mozilla_tmp_t aliases as it is a new type and requires no compatibility aliases. 2011-05-04 09:16:22 -04:00
Chris PeBenito
72b54e5f98 Rearrange mozilla tmp rules. 2011-05-04 09:15:28 -04:00
Sven Vermeulen
f28f89acb8 Allow mozilla/firefox to manage tempfiles
On Wed, Mar 23, 2011 at 09:10:37AM -0400, Christopher J. PeBenito wrote:
> >  userdom_use_user_ptys(mozilla_t)
> > +userdom_manage_user_tmp_files(mozilla_t)
> > +userdom_manage_user_tmp_sockets(mozilla_t)
>
> Do you have more info on these?  Such as what files and sockets are
> being managed?

Not anymore apparently. Been running now for quite some time without these
privileges and I get no problems with it. Retry:

Mozilla/Firefox creates temporary files for its plugin support (for instance
while viewing flc streams), like /tmp/plugtmp/plugin-crossdomain.xml.

Update policy to allow it to create its own tmp type and perform a file
transition when creating a file or directory in a tmp_t location (like
/tmp).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-05-04 09:14:26 -04:00
Chris PeBenito
8cd36efcd9 Module version bump for courier authdaemon /var/lib/courier/authdaemon dir creation. 2011-05-04 09:13:22 -04:00
Sven Vermeulen
8a58ccee23 Allow socket creation for imapd/pop3d communication
On Tue, Mar 22, 2011 at 08:44:49AM -0400, Christopher J. PeBenito wrote:
> > +manage_dirs_pattern(courier_authdaemon_t, courier_var_lib_t, courier_var_lib_t)
>
> It sounds like this should be create_dirs_pattern instead.

Indeed, create_dirs_pattern is sufficient here. Retry ;-)

During startup, authdaemon creates /var/lib/courier/authdaemon and creates a
socket for communication with courier imapd and pop3d daemons.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-05-04 09:12:30 -04:00
Chris PeBenito
d5048bc791 Module version bump for raid run interface. 2011-05-04 09:09:08 -04:00
Chris PeBenito
c3a60ead61 Move raid_run_mdadm() interface. 2011-05-04 09:07:54 -04:00
Chris PeBenito
ffc0b4f058 Whitespace fixes in raid.if. 2011-05-02 12:55:45 -04:00
Sven Vermeulen
681831da06 system admin needs to use mdadm, but type is not allowed
After a quick discussion with dominique, new attempt due to two issues:

1. No need (or even forbidden) to have "role $1 types foo_exec_t"
2. Suggestion to use the raid_run_mdadm name instead of raid_mdadm_role. The
   idea here is to use raid_mdadm_role for prefixed domains (cfr. screen)
   whereas raid_run_mdadm is to transition and run into a specific domain

Without wanting to (re?)start any discussion on prefixed versus non-prefixed
domains, such a naming convention could help us to keep the reference policy
cleaner (and naming conventions easy).

Also, refpolicy InterfaceNaming document only talks about run, not role.

So, without much further ado... ;-)

  The system administrator (sysadm_r role) needs to use mdadm, but is not
  allowed to use the mdadm_t type.

  Rather than extend raid_domtrans_mdadm to allow this as well, use a
  raid_mdadm_role (a bit more conform other role usages).

  The other users of raid_domtrans_mdadm are all domains that run in system_r
  role, which does have this type allowed (as per the system/raid.te
  definition), so it wouldn't hurt to use raid_domtrans_mdadm for this.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-05-02 12:54:03 -04:00
Chris PeBenito
2983a08467 Module version bump and changelog for Portage updates from Sven Vermeulen. 2011-05-02 12:46:28 -04:00
Sven Vermeulen
f13b563891 setfscreate privilege is needed to be able to install java-config package
During the installation of for instance java-config, Portage wants to set
its default file creation context to root:object_r:portage_tmp_t which isn't
allowed:

creating /var/tmp/portage/dev-java/java-config-2.1.11-r3/temp/images/3.1/etc/revdep-rebuild
copying src/revdep-rebuild/60-java -> /var/tmp/portage/dev-java/java-config-2.1.11-r3/temp/images/3.1/etc/revdep-rebuild/
running install_egg_info
Writing /var/tmp/portage/dev-java/java-config-2.1.11-r3/temp/images/3.1/usr/lib64/python3.1/site-packages/java_config-2.1.11-py3.1.egg-info
cp: failed to set default file creation context to `root:object_r:portage_tmp_t': Permission denied
cp: failed to set default file creation context to `root:object_r:portage_tmp_t': Permission denied
cp: failed to set default file creation context to `root:object_r:portage_tmp_t': Permission denied
cp: failed to set default file creation context to `root:object_r:portage_tmp_t': Permission denied
...
ERROR: dev-java/java-config-2.1.11-r3 failed:
   Merging of intermediate installation image for Python ABI '2.6 into installation image failed

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-05-02 11:41:17 -04:00
Sven Vermeulen
fd9ec1f728 Allow portage_sandbox_t ptrace capabilities
During installation of system packages like python, ustr, ... the
portage_sandbox_t domain requires ptrace capabilities.

If not allowed, the following error is returned:

/sbin/ldconfig -n /var/tmp/portage/dev-libs/ustr-1.0.4-r1/image//usr/lib64
ISE:_do_ptrace ^[[0mptrace(PTRACE_TRACEME, ..., 0x0000000000000000, 0x0000000000000000): Permission denied
/usr/lib/libsandbox.so(+0x3812)[0x7535af0ca812]
/usr/lib/libsandbox.so(+0x38a3)[0x7535af0ca8a3]
/usr/lib/libsandbox.so(+0x5595)[0x7535af0cc595]
/usr/lib/libsandbox.so(+0x5a87)[0x7535af0cca87]
/usr/lib/libsandbox.so(+0x68de)[0x7535af0cd8de]
/usr/lib/libsandbox.so(execvp+0x6c)[0x7535af0ceb3c]
make(+0x1159e)[0x337b918159e]
make(+0x11eec)[0x337b9181eec]
make(+0x12b34)[0x337b9182b34]
make(+0x1e759)[0x337b918e759]
/proc/5977/cmdline: make -j4 install
DESTDIR=/var/tmp/portage/dev-libs/ustr-1.0.4-r1/image/ HIDE=
libdir=/usr/lib64 mandir=/usr/share/man SHRDIR=/usr/share/doc/ustr-1.0.4-r1
DOCSHRDIR=/usr/share/doc/ustr-1.0.4-r1

This seems to be during a standard "make install" of the package but part of
Portage' sandbox usage (above error for ustr, but packages like python exhibit
the same problem.)

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-05-02 11:31:46 -04:00
Sven Vermeulen
4061b06a4a Allow portage to set file capabilities, needed for installations like for wireshark
The installation of the wireshark package (and perhaps others) requires
portage setting file capabilities (through the setcap binary).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-05-02 11:30:36 -04:00
Chris PeBenito
9ec9808df5 Pull in cgroup changes from Fedora policy, in particular to handle systemd usage. 2011-04-29 13:22:47 -04:00
Chris PeBenito
3979c6886f Fix init_system_domain() description, pointed out by Elia Pinto. 2011-04-27 10:42:47 -04:00
Chris PeBenito
cca4b7e619 Fix ring buffer rules capability2 usage. 2011-04-18 13:06:31 -04:00
Chris PeBenito
6835095671 Changelog and module version bump for postgresql selabel_lookup update from KaiGai Kohei. 2011-04-15 10:25:10 -04:00
Kohei Kaigai
90bbc401dc allow postgresql_t to read selabel files
The attached patch allows postgresql_t domain to read selabel definition files
(such as /etc/selinux/targeted/contexts/sepgsql_contexts).

The upcoming version (v9.1) uses selabel_lookup(3) to assign initial security context
of database objects, we need to allow this reference.

Thanks,
--
NEC Europe Ltd, SAP Global Competence Center
KaiGai Kohei <kohei.kaigai@eu.nec.com>
2011-04-15 10:16:30 -04:00
Chris PeBenito
127d617b31 Pull in some changes from Fedora policy system layer. 2011-04-14 11:36:56 -04:00
Chris PeBenito
5e8cdeab27 Rearrange and whitespace fix filesystem.fc. 2011-04-14 10:17:18 -04:00
Chris PeBenito
e541d13ae5 Pull in additional kernel layer Fedora policy changes. 2011-04-14 10:05:56 -04:00
Chris PeBenito
2b5cb1ff64 Dovecot managesieve support from Mika Pfluger.
For using the dovecot managesieve daemon on the standard (RFC 5804) port,
dovecot needs corenet_tcp_bind_sieve_port.
2011-04-04 14:37:29 -04:00
Chris PeBenito
1b93cf8cb6 Changelog for remove unnecessary semicolons after interface/template calls everywhere from Elia Pinto. 2011-04-04 13:43:09 -04:00
Elia Pinto
52ddc47029 trunk: remove unnecessary semicolons after interface/template calls everywhere
Signed-off-by: Elia Pinto <gitter.spiros@gmail.com>
2011-04-04 13:32:02 -04:00