Update selinux-knot policy
This commit is contained in:
@@ -1,10 +1,11 @@
|
||||
/etc/rc\.d/init\.d/knot -- gen_context(system_u:object_r:knot_initrc_exec_t,s0)
|
||||
|
||||
/etc/knot(/.*)? gen_context(system_u:object_r:knot_conf_t,s0)
|
||||
|
||||
/usr/sbin/knotd -- gen_context(system_u:object_r:knotd_exec_t,s0)
|
||||
|
||||
/usr/sbin/knotc -- gen_context(system_u:object_r:knotc_exec_t,s0)
|
||||
|
||||
/var/run/knot(/.*)? gen_context(system_u:object_r:knot_var_run_t,s0)
|
||||
/usr/sbin/knotc -- gen_context(system_u:object_r:knotc_exec_t,s0)
|
||||
|
||||
/var/lib/knot(/.*)? gen_context(system_u:object_r:knot_var_lib_t,s0)
|
||||
|
||||
/etc/knot(/.*)? gen_context(system_u:object_r:knot_etc_t,s0)
|
||||
|
||||
/run/knot(/.*)? gen_context(system_u:object_r:knot_runtime_t,s0)
|
||||
|
||||
@@ -1,157 +1,8 @@
|
||||
|
||||
## <summary>policy for knotc</summary>
|
||||
## <summary>high-performance authoritative-only DNS server.</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute knotd_exec_t in the knotd domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knotd_domtrans',`
|
||||
gen_require(`
|
||||
type knotd_t, knotd_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, knotd_exec_t, knotd_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Execute knotd in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knotd_exec',`
|
||||
gen_require(`
|
||||
type knotd_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, knotd_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knotd /run files transitions.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_var_run_trans',`
|
||||
gen_require(`
|
||||
type knot_var_run_t;
|
||||
type var_run_t;
|
||||
type tmpfiles_t;
|
||||
')
|
||||
|
||||
manage_dirs_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
manage_files_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
manage_lnk_files_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
manage_sock_files_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
search_dirs_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
files_pid_filetrans($1, knot_var_run_t, { file dir sock_file})
|
||||
filetrans_pattern(tmpfiles_t, var_run_t, knot_var_run_t, dir, "knot")
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knot /var/lib files mamange.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_var_lib_manage',`
|
||||
gen_require(`
|
||||
type knot_var_lib_t;
|
||||
')
|
||||
|
||||
manage_dirs_pattern($1, knot_var_lib_t, knot_var_lib_t)
|
||||
manage_files_pattern($1, knot_var_lib_t, knot_var_lib_t)
|
||||
manage_lnk_files_pattern($1, knot_var_lib_t, knot_var_lib_t)
|
||||
allow $1 knot_var_lib_t:file map;
|
||||
files_var_lib_filetrans($1, knot_var_lib_t, { file dir })
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knotd /var/lib files transitions.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_var_lib_trans',`
|
||||
gen_require(`
|
||||
type knot_var_lib_t;
|
||||
type var_lib_t;
|
||||
type tmpfiles_t;
|
||||
')
|
||||
|
||||
knot_var_lib_manage($1)
|
||||
filetrans_pattern(tmpfiles_t, var_lib_t, knot_var_lib_t, dir, "knot")
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knot /etc/knot files read.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_etc_t_read',`
|
||||
gen_require(`
|
||||
type knot_etc_t;
|
||||
type initrc_t;
|
||||
')
|
||||
|
||||
mmap_read_files_pattern($1, knot_etc_t, knot_etc_t)
|
||||
read_files_pattern(initrc_t, knot_etc_t, knot_etc_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knot /tmp files transitions.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_tmp_trans',`
|
||||
gen_require(`
|
||||
type knot_tmp_t;
|
||||
')
|
||||
|
||||
files_tmp_filetrans($1, knot_tmp_t, { file dir })
|
||||
allow $1 knot_tmp_t:file map;
|
||||
allow $1 knot_tmp_t:file manage_file_perms;
|
||||
allow $1 knot_tmp_t:dir manage_dir_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute knotc_exec_t in the knotc domain.
|
||||
## Execute knotc in the knotc domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -159,40 +10,99 @@ interface(`knot_tmp_trans',`
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knotc_domtrans',`
|
||||
gen_require(`
|
||||
type knotc_t, knotc_exec_t;
|
||||
')
|
||||
interface(`knot_domtrans_client',`
|
||||
gen_require(`
|
||||
type knotc_t, knotc_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, knotc_exec_t, knotc_t)
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, knotc_exec_t, knotc_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Role access for knotc
|
||||
## Execute knotc in the knotc domain, and
|
||||
## allow the specified role the knotc domain.
|
||||
## </summary>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## User domain for the role
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`knot_run_client',`
|
||||
gen_require(`
|
||||
attribute_role knot_roles;
|
||||
')
|
||||
|
||||
knot_domtrans_client($1)
|
||||
roleattribute $2 knot_roles;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read knot config files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knotc_role',`
|
||||
gen_require(`
|
||||
type knotc_t;
|
||||
attribute_role knotc_roles;
|
||||
')
|
||||
interface(`knot_read_config_file',`
|
||||
gen_require(`
|
||||
type knot_conf_t;
|
||||
')
|
||||
|
||||
roleattribute $1 knotc_roles;
|
||||
|
||||
knotc_domtrans($2)
|
||||
|
||||
ps_process_pattern($2, knotc_t)
|
||||
allow $2 knotc_t:process { signull signal sigkill };
|
||||
read_files_pattern($1, knot_conf_t, knot_conf_t)
|
||||
files_search_etc($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to
|
||||
## administrate an knot environment.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`knot_admin',`
|
||||
gen_require(`
|
||||
type knotc_t, knotd_t, knot_conf_t, knot_initrc_exec_t;
|
||||
type knot_runtime_t, knot_tmp_t, knot_var_lib_t;
|
||||
')
|
||||
|
||||
allow $2 knotc_t:process signal_perms;
|
||||
allow $1 knotd_t:process { ptrace signal_perms };
|
||||
ps_process_pattern($2, knotc_t)
|
||||
ps_process_pattern($1, knotd_t)
|
||||
|
||||
init_startstop_service($1, $2, knotd_t, knot_initrc_exec_t)
|
||||
|
||||
files_search_etc($1)
|
||||
admin_pattern($1, knot_conf_t)
|
||||
|
||||
files_search_pids($1)
|
||||
admin_pattern($1, knot_runtime_t)
|
||||
|
||||
files_search_tmp($1)
|
||||
admin_pattern($1, knot_tmp_t)
|
||||
|
||||
files_search_var_lib($1)
|
||||
admin_pattern($1, knot_var_lib_t)
|
||||
')
|
||||
|
||||
@@ -5,6 +5,8 @@ policy_module(knot, 1.0.0)
|
||||
# Declarations
|
||||
#
|
||||
|
||||
attribute_role knot_roles;
|
||||
|
||||
type knotd_t;
|
||||
type knotd_exec_t;
|
||||
init_daemon_domain(knotd_t, knotd_exec_t)
|
||||
@@ -13,16 +15,16 @@ type knotc_t;
|
||||
type knotc_exec_t;
|
||||
application_domain(knotc_t, knotc_exec_t)
|
||||
init_daemon_domain(knotc_t, knotc_exec_t)
|
||||
role knotc_roles types knotc_t;
|
||||
role knot_roles types knotc_t;
|
||||
|
||||
attribute_role knotc_roles;
|
||||
roleattribute system_r knotc_roles;
|
||||
type knot_conf_t;
|
||||
files_config_file(knot_conf_t)
|
||||
|
||||
type knot_etc_t;
|
||||
files_type(knot_etc_t)
|
||||
type knot_initrc_exec_t;
|
||||
init_script_file(knot_initrc_exec_t)
|
||||
|
||||
type knot_var_run_t;
|
||||
files_pid_file(knot_var_run_t)
|
||||
type knot_runtime_t;
|
||||
files_pid_file(knot_runtime_t)
|
||||
|
||||
type knot_var_lib_t;
|
||||
files_type(knot_var_lib_t)
|
||||
@@ -34,28 +36,50 @@ files_tmp_file(knot_tmp_t)
|
||||
#
|
||||
# knotd local policy
|
||||
#
|
||||
allow knotd_t self:capability { setgid setuid dac_read_search };
|
||||
allow knotd_t self:process { fork signal_perms getcap getsched setsched };
|
||||
allow knotd_t self:capability { dac_override dac_read_search setgid setpcap setuid };
|
||||
allow knotd_t self:process { signal_perms getcap getsched setsched };
|
||||
allow knotd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow knotd_t self:udp_socket create_stream_socket_perms;
|
||||
allow knotd_t self:unix_stream_socket { listen accept };
|
||||
allow knotd_t self:udp_socket create_socket_perms;
|
||||
allow knotd_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
corenet_tcp_bind_generic_node(knotd_t)
|
||||
corenet_udp_bind_generic_node(knotd_t)
|
||||
|
||||
corenet_sendrecv_dns_server_packets(knotd_t)
|
||||
corenet_tcp_bind_dns_port(knotd_t)
|
||||
corenet_udp_bind_dns_port(knotd_t)
|
||||
|
||||
knot_etc_t_read(knotd_t)
|
||||
knot_var_run_trans(knotd_t)
|
||||
knot_var_lib_trans(knotd_t)
|
||||
knot_tmp_trans(knotd_t)
|
||||
# Slave replication
|
||||
corenet_tcp_connect_dns_port(knotd_t)
|
||||
|
||||
kernel_read_kernel_sysctls(knotd_t)
|
||||
|
||||
fs_getattr_xattr_fs(knotd_t)
|
||||
fs_dontaudit_getattr_tmpfs(knotd_t)
|
||||
allow knotd_t knot_conf_t:file map;
|
||||
knot_read_config_file(knotd_t)
|
||||
|
||||
files_read_etc_files(knotd_t)
|
||||
manage_dirs_pattern(knotd_t, knot_runtime_t, knot_runtime_t)
|
||||
manage_files_pattern(knotd_t, knot_runtime_t, knot_runtime_t)
|
||||
manage_lnk_files_pattern(knotd_t, knot_runtime_t, knot_runtime_t)
|
||||
manage_sock_files_pattern(knotd_t, knot_runtime_t, knot_runtime_t)
|
||||
files_search_pids(knotd_t) ### Check it
|
||||
files_pid_filetrans(knotd_t, knot_runtime_t, dir)
|
||||
|
||||
allow knotd_t knot_tmp_t:file map;
|
||||
allow knotd_t knot_tmp_t:file manage_file_perms;
|
||||
allow knotd_t knot_tmp_t:dir manage_dir_perms;
|
||||
files_tmp_filetrans(knotd_t, knot_tmp_t, { file dir })
|
||||
|
||||
allow knotd_t knot_var_lib_t:file map;
|
||||
manage_dirs_pattern(knotd_t, knot_var_lib_t, knot_var_lib_t)
|
||||
manage_files_pattern(knotd_t, knot_var_lib_t, knot_var_lib_t)
|
||||
manage_lnk_files_pattern(knotd_t, knot_var_lib_t, knot_var_lib_t)
|
||||
files_search_var_lib(knotd_t)
|
||||
files_var_lib_filetrans(knotd_t, knot_var_lib_t, dir)
|
||||
|
||||
files_map_etc_files(knotd_t)
|
||||
|
||||
fs_getattr_xattr_fs(knotd_t)
|
||||
|
||||
fs_getattr_tmpfs(knotd_t)
|
||||
|
||||
auth_use_nsswitch(knotd_t)
|
||||
|
||||
@@ -67,29 +91,51 @@ miscfiles_read_localization(knotd_t)
|
||||
#
|
||||
# knotc local policy
|
||||
#
|
||||
|
||||
allow knotc_t self:capability { dac_override dac_read_search };
|
||||
allow knotc_t knotd_t:unix_stream_socket connectto;
|
||||
allow knotc_t knot_var_run_t:dir search;
|
||||
allow knotc_t knot_var_run_t:sock_file write_sock_file_perms;
|
||||
allow knotc_t self:process signal;
|
||||
|
||||
knot_etc_t_read(knotc_t)
|
||||
knot_tmp_trans(knotc_t)
|
||||
knot_var_lib_manage(knotc_t)
|
||||
stream_connect_pattern(knotc_t, knot_runtime_t, knot_runtime_t, knotd_t)
|
||||
|
||||
fs_dontaudit_getattr_tmpfs(knotc_t)
|
||||
files_dontaudit_search_var_lib(knotc_t)
|
||||
allow knotc_t knot_conf_t:file map;
|
||||
knot_read_config_file(knotc_t)
|
||||
|
||||
allow knotc_t knot_tmp_t:file map;
|
||||
allow knotc_t knot_tmp_t:file manage_file_perms;
|
||||
allow knotc_t knot_tmp_t:dir manage_dir_perms;
|
||||
files_tmp_filetrans(knotc_t, knot_tmp_t, { file dir })
|
||||
|
||||
allow knotc_t knot_var_lib_t:file map;
|
||||
manage_dirs_pattern(knotc_t, knot_var_lib_t, knot_var_lib_t)
|
||||
manage_files_pattern(knotc_t, knot_var_lib_t, knot_var_lib_t)
|
||||
manage_lnk_files_pattern(knotc_t, knot_var_lib_t, knot_var_lib_t)
|
||||
files_search_var_lib(knotc_t)
|
||||
|
||||
files_read_etc_files(knotc_t)
|
||||
|
||||
fs_getattr_tmpfs(knotc_t)
|
||||
|
||||
domain_use_interactive_fds(knotc_t)
|
||||
userdom_use_user_ptys(knotc_t)
|
||||
|
||||
miscfiles_read_localization(knotc_t)
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type sysadm_t;
|
||||
role sysadm_r;
|
||||
')
|
||||
userdom_use_user_ptys(knotc_t)
|
||||
|
||||
knotc_role(sysadm_r, sysadm_t)
|
||||
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type initrc_t;
|
||||
')
|
||||
|
||||
knot_read_config_file(initrc_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
role sysadm_r
|
||||
type sysadm_t;
|
||||
')
|
||||
|
||||
knot_admin(sysadm_r, sysadm_t)
|
||||
knot_run_client(sysadm_r, sysadm_t)
|
||||
')
|
||||
|
||||
Reference in New Issue
Block a user