policy_module(hadoop, 1.0.0)

########################################
#
# Declarations.
#

attribute hadoop_domain;

type hadoop_t;
type hadoop_exec_t;
application_domain(hadoop_t, hadoop_exec_t)
ubac_constrained(hadoop_t)

type hadoop_etc_t;
files_config_file(hadoop_etc_t)

type hadoop_log_t;
logging_log_file(hadoop_log_t)

type hadoop_tmp_t;
files_tmp_file(hadoop_tmp_t)
ubac_constrained(hadoop_tmp_t)

type hadoop_var_lib_t;
files_type(hadoop_var_lib_t)

type hadoop_var_run_t;
files_pid_file(hadoop_var_run_t)

type hadoop_hsperfdata_t;
files_tmp_file(hadoop_hsperfdata_t)
ubac_constrained(hadoop_hsperfdata_t)

hadoop_domain_template(datanode)
hadoop_domain_template(jobtracker)
hadoop_domain_template(namenode)
hadoop_domain_template(secondarynamenode)
hadoop_domain_template(tasktracker)

type zookeeper_t;
type zookeeper_exec_t;
application_domain(zookeeper_t, zookeeper_exec_t)
ubac_constrained(zookeeper_t)

type zookeeper_etc_t;
files_config_file(zookeeper_etc_t)

type zookeeper_log_t;
logging_log_file(zookeeper_log_t)

type zookeeper_server_t;
type zookeeper_server_exec_t;
init_daemon_domain(zookeeper_server_t, zookeeper_server_exec_t)

type zookeeper_server_initrc_exec_t;
init_script_file(zookeeper_server_initrc_exec_t)

type zookeeper_server_tmp_t;
files_tmp_file(zookeeper_server_tmp_t)

type zookeeper_server_var_t;
files_type(zookeeper_server_var_t)

# This will need a file context specification.
type zookeeper_server_var_run_t;
files_pid_file(zookeeper_server_var_run_t)

type zookeeper_tmp_t;
files_tmp_file(zookeeper_tmp_t)
ubac_constrained(zookeeper_tmp_t)

########################################
#
# Hadoop policy.
#

allow hadoop_t self:capability sys_resource;
allow hadoop_t self:process { getsched setsched signal signull setrlimit execmem };
allow hadoop_t self:fifo_file rw_fifo_file_perms;
allow hadoop_t self:key write;
allow hadoop_t self:tcp_socket create_stream_socket_perms;
allow hadoop_t self:udp_socket create_socket_perms;
dontaudit hadoop_t self:netlink_route_socket rw_netlink_socket_perms;

allow hadoop_t hadoop_domain:process signull;

read_files_pattern(hadoop_t, hadoop_etc_t, hadoop_etc_t)
read_lnk_files_pattern(hadoop_t, hadoop_etc_t, hadoop_etc_t)
can_exec(hadoop_t, hadoop_etc_t)

allow hadoop_t hadoop_hsperfdata_t:dir manage_dir_perms;
files_tmp_filetrans(hadoop_t, hadoop_hsperfdata_t, dir)

manage_dirs_pattern(hadoop_t, hadoop_log_t, hadoop_log_t)

manage_dirs_pattern(hadoop_t, hadoop_tmp_t, hadoop_tmp_t)
manage_files_pattern(hadoop_t, hadoop_tmp_t, hadoop_tmp_t)
filetrans_pattern(hadoop_t, hadoop_hsperfdata_t, hadoop_tmp_t, { dir file })

manage_dirs_pattern(hadoop_t, hadoop_var_lib_t, hadoop_var_lib_t)
manage_files_pattern(hadoop_t, hadoop_var_lib_t, hadoop_var_lib_t)

getattr_dirs_pattern(hadoop_t, hadoop_var_run_t, hadoop_var_run_t)

kernel_read_network_state(hadoop_t)
kernel_read_system_state(hadoop_t)

corecmd_exec_bin(hadoop_t)
corecmd_exec_shell(hadoop_t)

corenet_all_recvfrom_unlabeled(hadoop_t)
corenet_all_recvfrom_netlabel(hadoop_t)
corenet_tcp_sendrecv_generic_if(hadoop_t)
corenet_udp_sendrecv_generic_if(hadoop_t)
corenet_tcp_sendrecv_generic_node(hadoop_t)
corenet_udp_sendrecv_generic_node(hadoop_t)
corenet_tcp_bind_generic_node(hadoop_t)
corenet_udp_bind_generic_node(hadoop_t)
corenet_tcp_sendrecv_all_ports(hadoop_t)
corenet_udp_sendrecv_all_ports(hadoop_t)
corenet_tcp_connect_hadoop_namenode_port(hadoop_t)
corenet_tcp_connect_hadoop_datanode_port(hadoop_t)
corenet_tcp_connect_portmap_port(hadoop_t)
corenet_tcp_connect_zope_port(hadoop_t)
corenet_sendrecv_hadoop_namenode_client_packets(hadoop_t)
corenet_sendrecv_portmap_client_packets(hadoop_t)
corenet_sendrecv_zope_client_packets(hadoop_t)
# Hadoop uses high ordered random ports for services
# If permanent ports are chosen, remove line below and lock down
corenet_tcp_connect_generic_port(hadoop_t)

dev_read_rand(hadoop_t)
dev_read_sysfs(hadoop_t)
dev_read_urand(hadoop_t)

files_dontaudit_search_spool(hadoop_t)
files_read_usr_files(hadoop_t)

fs_getattr_xattr_fs(hadoop_t)

miscfiles_read_localization(hadoop_t)

userdom_dontaudit_search_user_home_dirs(hadoop_t)
userdom_use_user_terminals(hadoop_t)

java_exec(hadoop_t)

optional_policy(`
	nis_use_ypbind(hadoop_t)
')

optional_policy(`
	nscd_socket_use(hadoop_t)
')

########################################
#
# Hadoop datanode policy.
#

allow hadoop_datanode_t self:process signal;

manage_dirs_pattern(hadoop_datanode_t, hadoop_var_lib_t, hadoop_var_lib_t)

corenet_tcp_bind_hadoop_datanode_port(hadoop_datanode_t)
corenet_tcp_connect_hadoop_datanode_port(hadoop_datanode_t)
corenet_tcp_connect_hadoop_namenode_port(hadoop_datanode_t)

fs_getattr_xattr_fs(hadoop_datanode_t)

########################################
#
# Hadoop jobtracker policy.
#

create_dirs_pattern(hadoop_jobtracker_t, hadoop_jobtracker_log_t, hadoop_jobtracker_log_t)
setattr_dirs_pattern(hadoop_jobtracker_t, hadoop_jobtracker_log_t, hadoop_jobtracker_log_t)

manage_dirs_pattern(hadoop_jobtracker_t, hadoop_var_lib_t, hadoop_var_lib_t)

corenet_tcp_bind_zope_port(hadoop_jobtracker_t)
corenet_tcp_connect_hadoop_datanode_port(hadoop_jobtracker_t)
corenet_tcp_connect_hadoop_namenode_port(hadoop_jobtracker_t)

########################################
#
# Hadoop namenode policy.
#

manage_dirs_pattern(hadoop_namenode_t, hadoop_var_lib_t, hadoop_var_lib_t)
manage_files_pattern(hadoop_namenode_t, hadoop_var_lib_t, hadoop_var_lib_t)

corenet_tcp_bind_hadoop_namenode_port(hadoop_namenode_t)
corenet_tcp_connect_hadoop_namenode_port(hadoop_namenode_t)

########################################
#
# Hadoop secondary namenode policy.
#

manage_dirs_pattern(hadoop_secondarynamenode_t, hadoop_var_lib_t, hadoop_var_lib_t)

corenet_tcp_connect_hadoop_namenode_port(hadoop_secondarynamenode_t)

########################################
#
# Hadoop tasktracker policy.
#

allow hadoop_tasktracker_t self:process signal;

corenet_tcp_connect_hadoop_datanode_port(hadoop_tasktracker_t)
corenet_tcp_connect_hadoop_namenode_port(hadoop_tasktracker_t)
corenet_tcp_connect_zope_port(hadoop_tasktracker_t)

manage_dirs_pattern(hadoop_tasktracker_t, hadoop_tasktracker_log_t, hadoop_tasktracker_log_t);
filetrans_pattern(hadoop_tasktracker_t, hadoop_log_t, hadoop_tasktracker_log_t, dir)

manage_dirs_pattern(hadoop_tasktracker_t, hadoop_var_lib_t, hadoop_var_lib_t)

fs_getattr_xattr_fs(hadoop_tasktracker_t)

########################################
#
# Hadoop zookeeper client policy.
#

allow zookeeper_t self:process { getsched sigkill signal signull execmem };
allow zookeeper_t self:fifo_file rw_fifo_file_perms;
allow zookeeper_t self:tcp_socket create_stream_socket_perms;
allow zookeeper_t self:udp_socket create_socket_perms;
dontaudit zookeeper_t self:netlink_route_socket rw_netlink_socket_perms;

read_files_pattern(zookeeper_t, zookeeper_etc_t, zookeeper_etc_t)
read_lnk_files_pattern(zookeeper_t, zookeeper_etc_t, zookeeper_etc_t)

can_exec(zookeeper_t, zookeeper_exec_t)

allow zookeeper_t hadoop_hsperfdata_t:dir manage_dir_perms;
files_tmp_filetrans(zookeeper_t, hadoop_hsperfdata_t, dir)

allow zookeeper_t zookeeper_log_t:dir { rw_dir_perms setattr_dir_perms };
allow zookeeper_t zookeeper_log_t:file { create_file_perms append_file_perms read_file_perms setattr_file_perms };
append_files_pattern(zookeeper_t, zookeeper_log_t, zookeeper_log_t)
logging_log_filetrans(zookeeper_t, zookeeper_log_t, file)

allow zookeeper_t zookeeper_server_t:process signull;

manage_files_pattern(zookeeper_t, zookeeper_tmp_t, zookeeper_tmp_t)
filetrans_pattern(zookeeper_t, hadoop_hsperfdata_t, zookeeper_tmp_t, file)

kernel_read_network_state(zookeeper_t)
kernel_read_system_state(zookeeper_t)

corecmd_exec_bin(zookeeper_t)
corecmd_exec_shell(zookeeper_t)

corenet_all_recvfrom_unlabeled(zookeeper_t)
corenet_all_recvfrom_netlabel(zookeeper_t)
corenet_tcp_sendrecv_generic_if(zookeeper_t)
corenet_udp_sendrecv_generic_if(zookeeper_t)
corenet_tcp_sendrecv_generic_node(zookeeper_t)
corenet_udp_sendrecv_generic_node(zookeeper_t)
corenet_tcp_sendrecv_all_ports(zookeeper_t)
corenet_udp_sendrecv_all_ports(zookeeper_t)
corenet_tcp_bind_generic_node(zookeeper_t)
corenet_udp_bind_generic_node(zookeeper_t)
corenet_tcp_connect_zookeeper_client_port(zookeeper_t)
corenet_sendrecv_zookeeper_client_client_packets(zookeeper_t)
# Hadoop uses high ordered random ports for services
# If permanent ports are chosen, remove line below and lock down
corenet_tcp_connect_generic_port(zookeeper_t)

dev_read_rand(zookeeper_t)
dev_read_sysfs(zookeeper_t)
dev_read_urand(zookeeper_t)

files_read_etc_files(zookeeper_t)
files_read_usr_files(zookeeper_t)

miscfiles_read_localization(zookeeper_t)

sysnet_read_config(zookeeper_t)

userdom_use_user_terminals(zookeeper_t)
userdom_dontaudit_search_user_home_dirs(zookeeper_t)

java_exec(zookeeper_t)

optional_policy(`
	nscd_socket_use(zookeeper_t)
')

########################################
#
# Hadoop zookeeper server policy.
#

allow zookeeper_server_t self:capability kill;
allow zookeeper_server_t self:process { execmem getsched sigkill signal signull };
allow zookeeper_server_t self:fifo_file rw_fifo_file_perms;
allow zookeeper_server_t self:netlink_route_socket rw_netlink_socket_perms;
allow zookeeper_server_t self:tcp_socket create_stream_socket_perms;
allow zookeeper_server_t self:udp_socket create_socket_perms;

allow zookeeper_server_t hadoop_hsperfdata_t:dir manage_dir_perms;
files_tmp_filetrans(zookeeper_server_t, hadoop_hsperfdata_t, dir)

read_files_pattern(zookeeper_server_t, zookeeper_etc_t, zookeeper_etc_t)
read_lnk_files_pattern(zookeeper_server_t, zookeeper_etc_t, zookeeper_etc_t)

manage_dirs_pattern(zookeeper_server_t, zookeeper_server_var_t, zookeeper_server_var_t)
manage_files_pattern(zookeeper_server_t, zookeeper_server_var_t, zookeeper_server_var_t)
files_var_lib_filetrans(zookeeper_server_t, zookeeper_server_var_t, { dir file })

allow zookeeper_server_t zookeeper_log_t:dir { rw_dir_perms setattr_dir_perms };
allow zookeeper_server_t zookeeper_log_t:file { create_file_perms append_file_perms read_file_perms setattr_file_perms };
logging_log_filetrans(zookeeper_server_t, zookeeper_log_t, file)

manage_files_pattern(zookeeper_server_t, zookeeper_server_tmp_t, zookeeper_server_tmp_t)
filetrans_pattern(zookeeper_server_t, hadoop_hsperfdata_t, zookeeper_server_tmp_t, file)

manage_files_pattern(zookeeper_server_t, zookeeper_server_var_run_t, zookeeper_server_var_run_t)
files_pid_filetrans(zookeeper_server_t, zookeeper_server_var_run_t, file)

can_exec(zookeeper_server_t, zookeeper_server_exec_t)

kernel_read_network_state(zookeeper_server_t)
kernel_read_system_state(zookeeper_server_t)

corecmd_exec_bin(zookeeper_server_t)
corecmd_exec_shell(zookeeper_server_t)

corenet_all_recvfrom_unlabeled(zookeeper_server_t)
corenet_all_recvfrom_netlabel(zookeeper_server_t)
corenet_tcp_sendrecv_generic_if(zookeeper_server_t)
corenet_udp_sendrecv_generic_if(zookeeper_server_t)
corenet_tcp_sendrecv_generic_node(zookeeper_server_t)
corenet_udp_sendrecv_generic_node(zookeeper_server_t)
corenet_tcp_sendrecv_all_ports(zookeeper_server_t)
corenet_udp_sendrecv_all_ports(zookeeper_server_t)
corenet_tcp_bind_generic_node(zookeeper_server_t)
corenet_udp_bind_generic_node(zookeeper_server_t)
corenet_tcp_bind_zookeeper_client_port(zookeeper_server_t)
corenet_tcp_bind_zookeeper_election_port(zookeeper_server_t)
corenet_tcp_bind_zookeeper_leader_port(zookeeper_server_t)
corenet_tcp_connect_zookeeper_election_port(zookeeper_server_t)
corenet_tcp_connect_zookeeper_leader_port(zookeeper_server_t)
corenet_sendrecv_zookeeper_election_client_packets(zookeeper_server_t)
corenet_sendrecv_zookeeper_leader_client_packets(zookeeper_server_t)
corenet_sendrecv_zookeeper_client_server_packets(zookeeper_server_t)
corenet_sendrecv_zookeeper_election_server_packets(zookeeper_server_t)
corenet_sendrecv_zookeeper_leader_server_packets(zookeeper_server_t)
# Hadoop uses high ordered random ports for services
# If permanent ports are chosen, remove line below and lock down
corenet_tcp_connect_generic_port(zookeeper_server_t)

dev_read_rand(zookeeper_server_t)
dev_read_sysfs(zookeeper_server_t)
dev_read_urand(zookeeper_server_t)

files_read_etc_files(zookeeper_server_t)
files_read_usr_files(zookeeper_server_t)

fs_getattr_xattr_fs(zookeeper_server_t)

logging_send_syslog_msg(zookeeper_server_t)

miscfiles_read_localization(zookeeper_server_t)

sysnet_read_config(zookeeper_server_t)

java_exec(zookeeper_server_t)