add content
This commit is contained in:
6
sec-policy/selinux-knot/Manifest
Normal file
6
sec-policy/selinux-knot/Manifest
Normal file
@@ -0,0 +1,6 @@
|
||||
AUX knot.fc 351 BLAKE2B c405546b5b619948a3dffccad17c4ae12dcbfbc9b538e4bb7325fc5d8560e3a1b87ab0ccac4fd3dcc14be02d9112f139fe71b9bcd40e06efd8893ddf88a5c0c8 SHA512 214002c8c118e2320c3839a7e9cfccd4bd71e6fa0140351ff2c398f27609ea8ea0c5988ee30072db2729469bfc56cbc4f16de6ddcba792e1baf428215a4661a6
|
||||
AUX knot.if 4627 BLAKE2B f383b3fc55dc7c99d583a0b5d61949e5b2d328586e02db7d2e8e6b3d88d3b4a1ed67c812db38d49f71efd8b89c92d37ac9722b0bfc8f11de952f1e02725d716a SHA512 a967b731a993ecec3a9ff7189bb5866049331209f643daadd951053d29e44d133140f3fecad756dc6a6e3f1b87f880c40cae81c5c685c834d7f268bf990fab2b
|
||||
AUX knot.te 2142 BLAKE2B 15de1876243e55ba3ed68ecd5bbbcb8f637e23431b5ac15958096be29dd14a248d029a27134b72d43f93bb3215b5b1f9fab7c6d9464fbdcd2ab21fb030104816 SHA512 41ad8d429d680351186b6b337fd8b122a61eea73b302bb893fe7243531ba375678239fade0496474e4ece45df667669854d3f5d3e858fe9f8b733e4b52070611
|
||||
DIST patchbundle-selinux-base-policy-2.20180701-r1.tar.bz2 315378 BLAKE2B eeeb0b04c023c40289b6d964aefd1773d2b5d6912f1dffebf9509e6dcdbb39b17e722ee4483fb2b11193d4b987a85f90c7dc7e61cef3cf982fc2ba368d4900ef SHA512 a8b049120f1c420f9bfb55aba9ed0157ff7896ace402cd1b77b01d1ea52b67e49d915f1c00de83ff4d59b1cf8b8aa1f39b50ba312d842ed4850e75fcc7f5be42
|
||||
DIST refpolicy-2.20180701.tar.bz2 753050 BLAKE2B 7069a1b9b9bef25950e62bb50ac09f4a9d5ef6fd0acc667d321da396c3935939348534458df129f7bc81687dca240b4c4fc120d1f46d452665d335c9f023da8c SHA512 9dd5a1e10da5d25fea96cc25efb682f8ac866e835a1d940b161c1ce944cac9a90a5836b03c14311acad6bf9acd9a78003f36e050d35d8edb43606575523857b5
|
||||
EBUILD selinux-knot-2.20180701-r1.ebuild 377 BLAKE2B 3e0e81a404c1810ddeedad0ab2af2d6db2270f85492ea39d60992cf0b0015f500b8e70dda185af2341684115adcb580e79fba76665fbe80ba0d1db3305103082 SHA512 18f8f1a16161f4f648cbd346b467bc4bb3c810d156e6ffbdc34d12d7686f08c0911484e8c5304045ae2aef49c71d9586b574f041c1fe337fbacf1d405579c5f4
|
||||
10
sec-policy/selinux-knot/files/knot.fc
Normal file
10
sec-policy/selinux-knot/files/knot.fc
Normal file
@@ -0,0 +1,10 @@
|
||||
/usr/sbin/knotd -- gen_context(system_u:object_r:knotd_exec_t,s0)
|
||||
|
||||
/usr/sbin/knotc -- gen_context(system_u:object_r:knotc_exec_t,s0)
|
||||
|
||||
/var/run/knot(/.*)? gen_context(system_u:object_r:knot_var_run_t,s0)
|
||||
|
||||
/var/lib/knot(/.*)? gen_context(system_u:object_r:knot_var_lib_t,s0)
|
||||
|
||||
/etc/knot(/.*)? gen_context(system_u:object_r:knot_etc_t,s0)
|
||||
|
||||
198
sec-policy/selinux-knot/files/knot.if
Normal file
198
sec-policy/selinux-knot/files/knot.if
Normal file
@@ -0,0 +1,198 @@
|
||||
|
||||
## <summary>policy for knotc</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute knotd_exec_t in the knotd domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knotd_domtrans',`
|
||||
gen_require(`
|
||||
type knotd_t, knotd_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, knotd_exec_t, knotd_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Execute knotd in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knotd_exec',`
|
||||
gen_require(`
|
||||
type knotd_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, knotd_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knotd /run files transitions.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_var_run_trans',`
|
||||
gen_require(`
|
||||
type knot_var_run_t;
|
||||
type var_run_t;
|
||||
type tmpfiles_t;
|
||||
')
|
||||
|
||||
manage_dirs_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
manage_files_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
manage_lnk_files_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
manage_sock_files_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
search_dirs_pattern($1, knot_var_run_t, knot_var_run_t)
|
||||
files_pid_filetrans($1, knot_var_run_t, { file dir sock_file})
|
||||
filetrans_pattern(tmpfiles_t, var_run_t, knot_var_run_t, dir, "knot")
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knot /var/lib files mamange.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_var_lib_manage',`
|
||||
gen_require(`
|
||||
type knot_var_lib_t;
|
||||
')
|
||||
|
||||
manage_dirs_pattern($1, knot_var_lib_t, knot_var_lib_t)
|
||||
manage_files_pattern($1, knot_var_lib_t, knot_var_lib_t)
|
||||
manage_lnk_files_pattern($1, knot_var_lib_t, knot_var_lib_t)
|
||||
allow $1 knot_var_lib_t:file map;
|
||||
files_var_lib_filetrans($1, knot_var_lib_t, { file dir })
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knotd /var/lib files transitions.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_var_lib_trans',`
|
||||
gen_require(`
|
||||
type knot_var_lib_t;
|
||||
type var_lib_t;
|
||||
type tmpfiles_t;
|
||||
')
|
||||
|
||||
knot_var_lib_manage($1)
|
||||
filetrans_pattern(tmpfiles_t, var_lib_t, knot_var_lib_t, dir, "knot")
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knot /etc/knot files read.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_etc_t_read',`
|
||||
gen_require(`
|
||||
type knot_etc_t;
|
||||
type initrc_t;
|
||||
')
|
||||
|
||||
mmap_read_files_pattern($1, knot_etc_t, knot_etc_t)
|
||||
read_files_pattern(initrc_t, knot_etc_t, knot_etc_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Knot /tmp files transitions.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knot_tmp_trans',`
|
||||
gen_require(`
|
||||
type knot_tmp_t;
|
||||
')
|
||||
|
||||
files_tmp_filetrans($1, knot_tmp_t, { file dir })
|
||||
allow $1 knot_tmp_t:file map;
|
||||
allow $1 knot_tmp_t:file manage_file_perms;
|
||||
allow $1 knot_tmp_t:dir manage_dir_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute knotc_exec_t in the knotc domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knotc_domtrans',`
|
||||
gen_require(`
|
||||
type knotc_t, knotc_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, knotc_exec_t, knotc_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Role access for knotc
|
||||
## </summary>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## User domain for the role
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`knotc_role',`
|
||||
gen_require(`
|
||||
type knotc_t;
|
||||
attribute_role knotc_roles;
|
||||
')
|
||||
|
||||
roleattribute $1 knotc_roles;
|
||||
|
||||
knotc_domtrans($2)
|
||||
|
||||
ps_process_pattern($2, knotc_t)
|
||||
allow $2 knotc_t:process { signull signal sigkill };
|
||||
')
|
||||
95
sec-policy/selinux-knot/files/knot.te
Normal file
95
sec-policy/selinux-knot/files/knot.te
Normal file
@@ -0,0 +1,95 @@
|
||||
policy_module(knot, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type knotd_t;
|
||||
type knotd_exec_t;
|
||||
init_daemon_domain(knotd_t, knotd_exec_t)
|
||||
|
||||
type knotc_t;
|
||||
type knotc_exec_t;
|
||||
application_domain(knotc_t, knotc_exec_t)
|
||||
init_daemon_domain(knotc_t, knotc_exec_t)
|
||||
role knotc_roles types knotc_t;
|
||||
|
||||
attribute_role knotc_roles;
|
||||
roleattribute system_r knotc_roles;
|
||||
|
||||
type knot_etc_t;
|
||||
files_type(knot_etc_t)
|
||||
|
||||
type knot_var_run_t;
|
||||
files_pid_file(knot_var_run_t)
|
||||
|
||||
type knot_var_lib_t;
|
||||
files_type(knot_var_lib_t)
|
||||
|
||||
type knot_tmp_t;
|
||||
files_tmp_file(knot_tmp_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# knotd local policy
|
||||
#
|
||||
allow knotd_t self:capability { setgid setuid dac_read_search };
|
||||
allow knotd_t self:process { fork signal_perms getcap getsched setsched };
|
||||
allow knotd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow knotd_t self:udp_socket create_stream_socket_perms;
|
||||
allow knotd_t self:unix_stream_socket { listen accept };
|
||||
|
||||
corenet_tcp_bind_generic_node(knotd_t)
|
||||
corenet_udp_bind_generic_node(knotd_t)
|
||||
corenet_tcp_bind_dns_port(knotd_t)
|
||||
corenet_udp_bind_dns_port(knotd_t)
|
||||
|
||||
knot_etc_t_read(knotd_t)
|
||||
knot_var_run_trans(knotd_t)
|
||||
knot_var_lib_trans(knotd_t)
|
||||
knot_tmp_trans(knotd_t)
|
||||
|
||||
kernel_read_kernel_sysctls(knotd_t)
|
||||
|
||||
fs_getattr_xattr_fs(knotd_t)
|
||||
fs_dontaudit_getattr_tmpfs(knotd_t)
|
||||
|
||||
files_read_etc_files(knotd_t)
|
||||
|
||||
auth_use_nsswitch(knotd_t)
|
||||
|
||||
logging_send_syslog_msg(knotd_t)
|
||||
|
||||
miscfiles_read_localization(knotd_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# knotc local policy
|
||||
#
|
||||
|
||||
allow knotc_t self:capability { dac_override dac_read_search };
|
||||
allow knotc_t knotd_t:unix_stream_socket connectto;
|
||||
allow knotc_t knot_var_run_t:dir search;
|
||||
allow knotc_t knot_var_run_t:sock_file write_sock_file_perms;
|
||||
|
||||
knot_etc_t_read(knotc_t)
|
||||
knot_tmp_trans(knotc_t)
|
||||
knot_var_lib_manage(knotc_t)
|
||||
|
||||
fs_dontaudit_getattr_tmpfs(knotc_t)
|
||||
files_dontaudit_search_var_lib(knotc_t)
|
||||
|
||||
domain_use_interactive_fds(knotc_t)
|
||||
userdom_use_user_ptys(knotc_t)
|
||||
|
||||
miscfiles_read_localization(knotc_t)
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type sysadm_t;
|
||||
role sysadm_r;
|
||||
')
|
||||
|
||||
knotc_role(sysadm_r, sysadm_t)
|
||||
')
|
||||
20
sec-policy/selinux-knot/selinux-knot-2.20180701-r1.ebuild
Normal file
20
sec-policy/selinux-knot/selinux-knot-2.20180701-r1.ebuild
Normal file
@@ -0,0 +1,20 @@
|
||||
# Copyright 1999-2015 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
# $Id$
|
||||
EAPI="5"
|
||||
|
||||
IUSE=""
|
||||
MODS="knot"
|
||||
POLICY_FILES="knot.te knot.fc knot.if"
|
||||
|
||||
inherit selinux-policy-2
|
||||
|
||||
DESCRIPTION="SELinux policy for knot"
|
||||
|
||||
RDEPEND="sec-policy/selinux-base-policy"
|
||||
|
||||
if [[ $PV == 9999* ]] ; then
|
||||
KEYWORDS=""
|
||||
else
|
||||
KEYWORDS="amd64 x86"
|
||||
fi
|
||||
Reference in New Issue
Block a user