From 8fa17a93d70ef103db3d8f6a128dd41bbc9bccca Mon Sep 17 00:00:00 2001 From: "Chris St. Pierre" Date: Fri, 14 Sep 2012 15:52:52 -0400 Subject: initial selinux configs --- redhat/selinux/bcfg2.fc | 14 +++ redhat/selinux/bcfg2.if | 220 ++++++++++++++++++++++++++++++++++++++++++++++++ redhat/selinux/bcfg2.te | 189 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 423 insertions(+) create mode 100644 redhat/selinux/bcfg2.fc create mode 100644 redhat/selinux/bcfg2.if create mode 100644 redhat/selinux/bcfg2.te (limited to 'redhat') diff --git a/redhat/selinux/bcfg2.fc b/redhat/selinux/bcfg2.fc new file mode 100644 index 000000000..3b551b4a3 --- /dev/null +++ b/redhat/selinux/bcfg2.fc @@ -0,0 +1,14 @@ +/etc/rc\.d/init\.d/bcfg2-server -- gen_context(system_u:object_r:bcfg2_server_initrc_exec_t,s0) +/etc/rc\.d/init\.d/bcfg2 -- gen_context(system_u:object_r:bcfg2_initrc_exec_t,s0) + +/usr/sbin/bcfg2-server -- gen_context(system_u:object_r:bcfg2_server_exec_t,s0) +/usr/sbin/bcfg2 -- gen_context(system_u:object_r:bcfg2_exec_t,s0) +/usr/lib/bcfg2/bcfg2-cron -- gen_context(system_u:object_r:bcfg2_exec_t,s0) + +/var/lib/bcfg2(/.*)? gen_context(system_u:object_r:bcfg2_var_lib_t,s0) + +/var/run/bcfg2-server\.pid -- gen_context(system_u:object_r:bcfg2_var_run_t,s0) + +/var/lock/bcfg2\.run -- gen_context(system_u:object_r:bcfg2_lock_t,s0) + +/etc/bcfg2.*\.conf -- gen_context(system_u:object_r:bcfg2_conf_t,s0) diff --git a/redhat/selinux/bcfg2.if b/redhat/selinux/bcfg2.if new file mode 100644 index 000000000..9ee23dd4b --- /dev/null +++ b/redhat/selinux/bcfg2.if @@ -0,0 +1,220 @@ +## bcfg2-server daemon which serves configurations to clients based on the data in its repository + +######################################## +## +## Execute bcfg2-server in the bcfg2 server domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`bcfg2_server_domtrans',` + gen_require(` + type bcfg2_server_t, bcfg2_server_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, bcfg2_server_exec_t, bcfg2_server_t) +') + +######################################## +## +## Execute bcfg2-server server in the bcfg2-server domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`bcfg2_server_initrc_domtrans',` + gen_require(` + type bcfg2_server_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, bcfg2_server_initrc_exec_t) +') + +######################################## +## +## Search bcfg2 lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`bcfg2_search_lib',` + gen_require(` + type bcfg2_var_lib_t; + ') + + allow $1 bcfg2_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read bcfg2 lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`bcfg2_read_lib_files',` + gen_require(` + type bcfg2_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, bcfg2_var_lib_t, bcfg2_var_lib_t) +') + +######################################## +## +## Manage bcfg2 lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`bcfg2_manage_lib_files',` + gen_require(` + type bcfg2_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, bcfg2_var_lib_t, bcfg2_var_lib_t) +') + +######################################## +## +## Manage bcfg2 lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`bcfg2_manage_lib_dirs',` + gen_require(` + type bcfg2_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, bcfg2_var_lib_t, bcfg2_var_lib_t) +') + +######################################## +## +## All of the rules required to administer +## a bcfg2-server environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`bcfg2_server_admin',` + gen_require(` + type bcfg2_server_t; + type bcfg2_server_initrc_exec_t; + type bcfg2_server_var_lib_t; + ') + + allow $1 bcfg2_server_t:process { ptrace signal_perms }; + ps_process_pattern($1, bcfg2_server_t) + + bcfg2_server_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 bcfg2_server_initrc_exec_t system_r; + allow $2 system_r; + + files_search_var_lib($1) + admin_pattern($1, bcfg2_server_var_lib_t) +') + +######################################## +## +## Execute bcfg2 in the bcfg2 domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`bcfg2_domtrans',` + gen_require(` + type bcfg2_t, bcfg2_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, bcfg2_exec_t, bcfg2_t) +') + +######################################## +## +## Execute bcfg2 in the bcfg2 domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`bcfg2_initrc_domtrans',` + gen_require(` + type bcfg2_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, bcfg2_initrc_exec_t) +') + +######################################## +## +## All of the rules required to administer +## a bcfg2 client +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`bcfg2_client_admin',` + gen_require(` + type bcfg2_t; + type bcfg2_initrc_exec_t; + type bcfg2_var_lib_t; + ') + + allow $1 bcfg2_t:process { ptrace signal_perms }; + ps_process_pattern($1, bcfg2_t) + + bcfg2_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 bcfg2_initrc_exec_t system_r; + allow $2 system_r; +') diff --git a/redhat/selinux/bcfg2.te b/redhat/selinux/bcfg2.te new file mode 100644 index 000000000..3b4fb4e2d --- /dev/null +++ b/redhat/selinux/bcfg2.te @@ -0,0 +1,189 @@ +policy_module(bcfg2, 1.1.0) + +######################################## +# +# Declarations +# + +type bcfg2_t; +type bcfg2_exec_t; +init_daemon_domain(bcfg2_t, bcfg2_exec_t) + +type bcfg2_server_t; +type bcfg2_server_exec_t; +init_daemon_domain(bcfg2_server_t, bcfg2_server_exec_t) + +type bcfg2_initrc_exec_t; +init_script_file(bcfg2_initrc_exec_t) + +type bcfg2_server_initrc_exec_t; +init_script_file(bcfg2_server_initrc_exec_t) + +type bcfg2_var_lib_t; +files_type(bcfg2_var_lib_t) + +type bcfg2_var_run_t; +files_pid_file(bcfg2_var_run_t) + +type bcfg2_lock_t; +files_lock_file(bcfg2_lock_t) + +type bcfg2_conf_t; +files_config_file(bcfg2_conf_t) + +######################################## +# +# bcfg2-server local policy +# + +allow bcfg2_server_t self:fifo_file rw_fifo_file_perms; +allow bcfg2_server_t self:tcp_socket create_stream_socket_perms; +allow bcfg2_server_t self:unix_stream_socket { connectto create_stream_socket_perms }; +allow bcfg2_server_t self:process setrlimit; +allow bcfg2_server_t self:capability { setgid setuid }; + +manage_dirs_pattern(bcfg2_server_t, bcfg2_var_lib_t, bcfg2_var_lib_t) +manage_files_pattern(bcfg2_server_t, bcfg2_var_lib_t, bcfg2_var_lib_t) +files_var_lib_filetrans(bcfg2_server_t, bcfg2_var_lib_t, dir ) + +manage_files_pattern(bcfg2_server_t, bcfg2_var_run_t, bcfg2_var_run_t) +files_pid_filetrans(bcfg2_server_t, bcfg2_var_run_t, file ) + +files_search_etc(bcfg2_server_t) +read_files_pattern(bcfg2_server_t, bcfg2_conf_t, bcfg2_conf_t) +read_lnk_files_pattern(bcfg2_server_t, bcfg2_conf_t, bcfg2_conf_t) + +files_manage_generic_tmp_files(bcfg2_server_t) + +kernel_read_system_state(bcfg2_server_t) + +corecmd_exec_bin(bcfg2_server_t) +corecmd_exec_shell(bcfg2_server_t) + +dev_read_urand(bcfg2_server_t) + +fs_list_inotifyfs(bcfg2_server_t) + +domain_use_interactive_fds(bcfg2_server_t) + +files_read_usr_files(bcfg2_server_t) + +logging_send_syslog_msg(bcfg2_server_t) + +miscfiles_read_localization(bcfg2_server_t) +miscfiles_read_certs(bcfg2_server_t) + +auth_use_nsswitch(bcfg2_server_t) + +libs_exec_ldconfig(bcfg2_server_t) + +# port 6789 was somehow already claimed by cyphesis, whatever that is +corenet_tcp_bind_cyphesis_port(bcfg2_server_t) + +######################################## +# +# bcfg2 (client) local policy +# + +allow bcfg2_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_ptrace sys_tty_config }; +allow bcfg2_t self:process { signal signull getsched setsched }; +allow bcfg2_t self:fifo_file rw_fifo_file_perms; +allow bcfg2_t self:netlink_route_socket create_netlink_socket_perms; +allow bcfg2_t self:tcp_socket create_stream_socket_perms; +allow bcfg2_t self:udp_socket create_socket_perms; + +files_search_etc(bcfg2_t) +read_files_pattern(bcfg2_t, bcfg2_conf_t, bcfg2_conf_t) +read_lnk_files_pattern(bcfg2_t, bcfg2_conf_t, bcfg2_conf_t) + +allow bcfg2_t bcfg2_lock_t:file manage_file_perms; +files_lock_filetrans(bcfg2_t, bcfg2_lock_t, file) + +kernel_dontaudit_search_sysctl(bcfg2_t) +kernel_dontaudit_search_kernel_sysctl(bcfg2_t) +kernel_read_system_state(bcfg2_t) +kernel_read_crypto_sysctls(bcfg2_t) + +cron_system_entry(bcfg2_t, bcfg2_exec_t) + +corecmd_exec_bin(bcfg2_t) +corecmd_exec_shell(bcfg2_t) + +corenet_all_recvfrom_netlabel(bcfg2_t) +corenet_all_recvfrom_unlabeled(bcfg2_t) +corenet_tcp_sendrecv_generic_if(bcfg2_t) +corenet_tcp_sendrecv_generic_node(bcfg2_t) +corenet_tcp_bind_generic_node(bcfg2_t) +corenet_tcp_connect_cyphesis_port(bcfg2_t) +corenet_sendrecv_cyphesis_client_packets(bcfg2_t) + +dev_read_rand(bcfg2_t) +dev_read_sysfs(bcfg2_t) +dev_read_urand(bcfg2_t) + +domain_read_all_domains_state(bcfg2_t) +domain_interactive_fd(bcfg2_t) + +files_manage_config_files(bcfg2_t) +files_manage_config_dirs(bcfg2_t) +files_manage_etc_dirs(bcfg2_t) +files_manage_etc_files(bcfg2_t) +files_read_usr_symlinks(bcfg2_t) +files_relabel_config_dirs(bcfg2_t) +files_relabel_config_files(bcfg2_t) +files_manage_generic_tmp_files(bcfg2_t) + +selinux_search_fs(bcfg2_t) +selinux_set_all_booleans(bcfg2_t) +selinux_set_generic_booleans(bcfg2_t) +selinux_validate_context(bcfg2_t) + +term_dontaudit_getattr_unallocated_ttys(bcfg2_t) +term_dontaudit_getattr_all_ttys(bcfg2_t) + +init_all_labeled_script_domtrans(bcfg2_t) +init_domtrans_script(bcfg2_t) +init_read_utmp(bcfg2_t) +init_signull_script(bcfg2_t) + +logging_send_syslog_msg(bcfg2_t) + +miscfiles_read_hwdata(bcfg2_t) +miscfiles_read_localization(bcfg2_t) + +mount_domtrans(bcfg2_t) + +auth_use_nsswitch(bcfg2_t) + +seutil_domtrans_setfiles(bcfg2_t) +seutil_domtrans_semanage(bcfg2_t) +seutil_run_semanage(bcfg2_t) + +sysnet_dns_name_resolve(bcfg2_t) +sysnet_run_ifconfig(bcfg2_t, system_r) + +optional_policy(` + consoletype_domtrans(bcfg2_t) +') + +optional_policy(` + hostname_exec(bcfg2_t) +') + +optional_policy(` + files_rw_var_files(bcfg2_t) + + rpm_domtrans(bcfg2_t) + rpm_domtrans_script(bcfg2_t) + rpm_manage_db(bcfg2_t) + rpm_manage_log(bcfg2_t) +') + +optional_policy(` + unconfined_domain(bcfg2_t) +') + +optional_policy(` + usermanage_domtrans_groupadd(bcfg2_t) + usermanage_domtrans_useradd(bcfg2_t) +') -- cgit v1.2.3-1-g7c22