add content
This commit is contained in:
2
sec-policy/selinux-doveadm/files/doveadm.fc
Normal file
2
sec-policy/selinux-doveadm/files/doveadm.fc
Normal file
@@ -0,0 +1,2 @@
|
||||
/var/lib/lego(/.*)? gen_context(system_u:object_r:lego_data_t,s0)
|
||||
/usr/bin/lego -- gen_context(system_u:object_r:lego_exec_t,s0)
|
||||
193
sec-policy/selinux-doveadm/files/doveadm.if
Normal file
193
sec-policy/selinux-doveadm/files/doveadm.if
Normal file
@@ -0,0 +1,193 @@
|
||||
|
||||
## <summary>policy for lego</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute lego_exec_t in the lego domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_domtrans',`
|
||||
gen_require(`
|
||||
type lego_t, lego_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, lego_exec_t, lego_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Execute lego in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_exec',`
|
||||
gen_require(`
|
||||
type lego_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, lego_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search lego conf directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_search_data',`
|
||||
gen_require(`
|
||||
type lego_data_t;
|
||||
')
|
||||
|
||||
allow $1 lego_data_t:dir search_dir_perms;
|
||||
files_search_etc($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read lego conf files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_read_data_files',`
|
||||
gen_require(`
|
||||
type lego_data_t;
|
||||
')
|
||||
|
||||
allow $1 lego_data_t:dir list_dir_perms;
|
||||
read_files_pattern($1, lego_data_t, lego_data_t)
|
||||
files_search_etc($1)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage lego conf files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_manage_data_files',`
|
||||
gen_require(`
|
||||
type lego_data_t;
|
||||
')
|
||||
|
||||
manage_files_pattern($1, lego_data_t, lego_data_t)
|
||||
files_search_etc($1)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute lego in the lego domain, and
|
||||
## allow the specified role the lego domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## The role to be allowed the lego domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_run',`
|
||||
gen_require(`
|
||||
type lego_t;
|
||||
attribute_role lego_roles;
|
||||
')
|
||||
|
||||
lego_domtrans($1)
|
||||
roleattribute $2 lego_roles;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Role access for lego
|
||||
## </summary>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## User domain for the role
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_role',`
|
||||
gen_require(`
|
||||
type lego_t;
|
||||
attribute_role lego_roles;
|
||||
')
|
||||
|
||||
roleattribute $1 lego_roles;
|
||||
|
||||
lego_domtrans($2)
|
||||
|
||||
ps_process_pattern($2, lego_t)
|
||||
allow $2 lego_t:process { signull signal sigkill };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an lego environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`lego_admin',`
|
||||
gen_require(`
|
||||
type lego_t;
|
||||
')
|
||||
|
||||
allow $1 lego_t:process { signal_perms };
|
||||
ps_process_pattern($1, lego_t)
|
||||
|
||||
tunable_policy(`deny_ptrace',`',`
|
||||
allow $1 lego_t:process ptrace;
|
||||
')
|
||||
|
||||
files_search_etc($1)
|
||||
admin_pattern($1, lego_data_t)
|
||||
optional_policy(`
|
||||
systemd_passwd_agent_exec($1)
|
||||
systemd_read_fifo_file_passwd_run($1)
|
||||
')
|
||||
')
|
||||
100
sec-policy/selinux-doveadm/files/doveadm.te
Normal file
100
sec-policy/selinux-doveadm/files/doveadm.te
Normal file
@@ -0,0 +1,100 @@
|
||||
policy_module(doveadm, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
attribute_role dovecot_adm_roles;
|
||||
roleattribute system_r lego_roles;
|
||||
|
||||
type dovecot_adm_t, dovecot_domain;
|
||||
type dovecot_adm_exec_t;
|
||||
domain_type(dovecot_adm_t)
|
||||
domain_entry_file(dovecot_adm_t, dovecot_adm_exec_t)
|
||||
role system_r types dovecot_adm_t;
|
||||
|
||||
########################################
|
||||
#
|
||||
# lego local policy
|
||||
#
|
||||
|
||||
allow lego_t self:process getsched;
|
||||
sysnet_read_config(lego_t)
|
||||
files_search_var_lib(lego_t)
|
||||
|
||||
userdom_use_user_ptys(lego_t)
|
||||
domain_use_interactive_fds(lego_t)
|
||||
|
||||
corenet_tcp_connect_http_port(lego_t)
|
||||
allow lego_t self:tcp_socket create_socket_perms;
|
||||
allow lego_t self:udp_socket create_socket_perms;
|
||||
allow lego_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
|
||||
manage_dirs_pattern(lego_t, lego_data_t, lego_data_t)
|
||||
manage_files_pattern(lego_t, lego_data_t, lego_data_t)
|
||||
manage_lnk_files_pattern(lego_t, lego_data_t, lego_data_t)
|
||||
files_etc_filetrans(lego_t, lego_data_t, { dir file lnk_file })
|
||||
|
||||
miscfiles_read_generic_certs(lego_t)
|
||||
miscfiles_read_localization(lego_t)
|
||||
|
||||
tunable_policy(`lego_use_homedirs',`
|
||||
userdom_manage_user_home_content_dirs(lego_t)
|
||||
userdom_manage_user_home_content_files(lego_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type sysadm_t;
|
||||
role sysadm_r;
|
||||
')
|
||||
lego_role(sysadm_r, sysadm_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
role user_r;
|
||||
type user_t;
|
||||
')
|
||||
lego_role(user_r, user_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
role staff_r;
|
||||
type staff_t;
|
||||
')
|
||||
lego_role(staff_r, staff_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type nginx_t;
|
||||
')
|
||||
lego_read_data_files(nginx_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type dovecot_t;
|
||||
')
|
||||
lego_read_data_files(dovecot_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type exim_t;
|
||||
')
|
||||
lego_read_data_files(exim_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type system_cronjob_t, system_cronjob_tmp_t;
|
||||
')
|
||||
cron_system_entry(lego_t, lego_exec_t)
|
||||
allow system_cronjob_t lego_data_t:file setattr;
|
||||
allow lego_t system_cronjob_tmp_t:file write;
|
||||
')
|
||||
|
||||
Reference in New Issue
Block a user