add content
This commit is contained in:
6
sec-policy/selinux-lego/Manifest
Normal file
6
sec-policy/selinux-lego/Manifest
Normal file
@@ -0,0 +1,6 @@
|
||||
AUX lego.fc 135 BLAKE2B f5518e53fe8d8aed6d19f06b53a9117f72c8773387b0a15f6970fa4e1b3ae985a60a37b8520750a7f16c8efff692c60a560fcaa66fd950675fa7a0627c0c8b97 SHA512 5e457469dc4685fa57175f1825bde5c3323fe7dd83ede73a5987086e90e8cf49c541f142ab5b83f63609323f35d2f3016123365f5dd06d7d55b796b95eba5b18
|
||||
AUX lego.if 3516 BLAKE2B 2209fb75dce7c5a79423be81c0b66e3295f6ffd9113d60e58cfe90e6b41b8563f019d4aff3f2ce285a25fe2ee199eb4d4a42180c7b785d22d1180d49e4a6bc71 SHA512 c68cfdcedcf858a717c59353c2709a9687703a873048b61de634f5e05b87bcc1682380616a51a2e687dec99a6c6c385a13074668336a9cc0d37be8a2bc9f763d
|
||||
AUX lego.te 2329 BLAKE2B bd04b323a09926b8262b6e1232904f22a5cf5cfc1ad7a54a1812ea5faddc07c974039619baccf657437178f27ef0bb4aba5eec9141c6aa670957ddc47a582a88 SHA512 485cd6449edce49b6e6368c21e9d388bf443c2a19ec782354c6dff16b8c4b8ce7ecd9c89cd45effd2df19edc6ed318851f387a10cd109aaf72698271f3b8da0c
|
||||
DIST patchbundle-selinux-base-policy-2.20180701-r1.tar.bz2 315378 BLAKE2B eeeb0b04c023c40289b6d964aefd1773d2b5d6912f1dffebf9509e6dcdbb39b17e722ee4483fb2b11193d4b987a85f90c7dc7e61cef3cf982fc2ba368d4900ef SHA512 a8b049120f1c420f9bfb55aba9ed0157ff7896ace402cd1b77b01d1ea52b67e49d915f1c00de83ff4d59b1cf8b8aa1f39b50ba312d842ed4850e75fcc7f5be42
|
||||
DIST refpolicy-2.20180701.tar.bz2 753050 BLAKE2B 7069a1b9b9bef25950e62bb50ac09f4a9d5ef6fd0acc667d321da396c3935939348534458df129f7bc81687dca240b4c4fc120d1f46d452665d335c9f023da8c SHA512 9dd5a1e10da5d25fea96cc25efb682f8ac866e835a1d940b161c1ce944cac9a90a5836b03c14311acad6bf9acd9a78003f36e050d35d8edb43606575523857b5
|
||||
EBUILD selinux-lego-2.20180701-r1.ebuild 377 BLAKE2B 81194e9e7d540735c490a35a783b780bb7ad68d1f8e208c1f54d3c1f8eb688b9fed8c73ebe8abb5f0acb7e62abb77101a12e059809a53437695ca212edcad558 SHA512 5ae9193ce0aae16b0f35a5fdb904c81777eddd6347e776d990c2f562252e7f52018c9b23b470365ae880267069de4e7f5ce6b466fb406c2b86bb7ed83191ce3f
|
||||
2
sec-policy/selinux-lego/files/lego.fc
Normal file
2
sec-policy/selinux-lego/files/lego.fc
Normal file
@@ -0,0 +1,2 @@
|
||||
/var/lib/lego(/.*)? gen_context(system_u:object_r:lego_data_t,s0)
|
||||
/usr/bin/lego -- gen_context(system_u:object_r:lego_exec_t,s0)
|
||||
193
sec-policy/selinux-lego/files/lego.if
Normal file
193
sec-policy/selinux-lego/files/lego.if
Normal file
@@ -0,0 +1,193 @@
|
||||
|
||||
## <summary>policy for lego</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute lego_exec_t in the lego domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_domtrans',`
|
||||
gen_require(`
|
||||
type lego_t, lego_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, lego_exec_t, lego_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Execute lego in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_exec',`
|
||||
gen_require(`
|
||||
type lego_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, lego_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search lego conf directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_search_data',`
|
||||
gen_require(`
|
||||
type lego_data_t;
|
||||
')
|
||||
|
||||
allow $1 lego_data_t:dir search_dir_perms;
|
||||
files_search_etc($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read lego conf files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_read_data_files',`
|
||||
gen_require(`
|
||||
type lego_data_t;
|
||||
')
|
||||
|
||||
allow $1 lego_data_t:dir list_dir_perms;
|
||||
read_files_pattern($1, lego_data_t, lego_data_t)
|
||||
files_search_etc($1)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage lego conf files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_manage_data_files',`
|
||||
gen_require(`
|
||||
type lego_data_t;
|
||||
')
|
||||
|
||||
manage_files_pattern($1, lego_data_t, lego_data_t)
|
||||
files_search_etc($1)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute lego in the lego domain, and
|
||||
## allow the specified role the lego domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## The role to be allowed the lego domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_run',`
|
||||
gen_require(`
|
||||
type lego_t;
|
||||
attribute_role lego_roles;
|
||||
')
|
||||
|
||||
lego_domtrans($1)
|
||||
roleattribute $2 lego_roles;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Role access for lego
|
||||
## </summary>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## User domain for the role
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`lego_role',`
|
||||
gen_require(`
|
||||
type lego_t;
|
||||
attribute_role lego_roles;
|
||||
')
|
||||
|
||||
roleattribute $1 lego_roles;
|
||||
|
||||
lego_domtrans($2)
|
||||
|
||||
ps_process_pattern($2, lego_t)
|
||||
allow $2 lego_t:process { signull signal sigkill };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an lego environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`lego_admin',`
|
||||
gen_require(`
|
||||
type lego_t;
|
||||
')
|
||||
|
||||
allow $1 lego_t:process { signal_perms };
|
||||
ps_process_pattern($1, lego_t)
|
||||
|
||||
tunable_policy(`deny_ptrace',`',`
|
||||
allow $1 lego_t:process ptrace;
|
||||
')
|
||||
|
||||
files_search_etc($1)
|
||||
admin_pattern($1, lego_data_t)
|
||||
optional_policy(`
|
||||
systemd_passwd_agent_exec($1)
|
||||
systemd_read_fifo_file_passwd_run($1)
|
||||
')
|
||||
')
|
||||
112
sec-policy/selinux-lego/files/lego.te
Normal file
112
sec-policy/selinux-lego/files/lego.te
Normal file
@@ -0,0 +1,112 @@
|
||||
policy_module(lego, 1.0.3)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Determine whether lego can use
|
||||
## user home directories.
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(lego_use_homedirs, false)
|
||||
|
||||
attribute_role lego_roles;
|
||||
roleattribute system_r lego_roles;
|
||||
|
||||
type lego_t;
|
||||
type lego_exec_t;
|
||||
application_domain(lego_t, lego_exec_t)
|
||||
role lego_roles types lego_t;
|
||||
|
||||
type lego_data_t;
|
||||
files_type(lego_data_t)
|
||||
ubac_constrained(lego_data_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# lego local policy
|
||||
#
|
||||
|
||||
allow lego_t self:capability { dac_override dac_read_search };
|
||||
allow lego_t self:process getsched;
|
||||
sysnet_read_config(lego_t)
|
||||
files_search_var_lib(lego_t)
|
||||
|
||||
userdom_use_user_ptys(lego_t)
|
||||
domain_use_interactive_fds(lego_t)
|
||||
|
||||
corenet_tcp_connect_http_port(lego_t)
|
||||
allow lego_t self:tcp_socket create_socket_perms;
|
||||
allow lego_t self:udp_socket create_socket_perms;
|
||||
allow lego_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
|
||||
manage_dirs_pattern(lego_t, lego_data_t, lego_data_t)
|
||||
manage_files_pattern(lego_t, lego_data_t, lego_data_t)
|
||||
manage_lnk_files_pattern(lego_t, lego_data_t, lego_data_t)
|
||||
files_etc_filetrans(lego_t, lego_data_t, { dir file lnk_file })
|
||||
|
||||
miscfiles_read_generic_certs(lego_t)
|
||||
miscfiles_read_localization(lego_t)
|
||||
|
||||
tunable_policy(`lego_use_homedirs',`
|
||||
userdom_manage_user_home_content_dirs(lego_t)
|
||||
userdom_manage_user_home_content_files(lego_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type sysadm_t;
|
||||
role sysadm_r;
|
||||
')
|
||||
lego_role(sysadm_r, sysadm_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
role user_r;
|
||||
type user_t;
|
||||
')
|
||||
lego_role(user_r, user_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
role staff_r;
|
||||
type staff_t;
|
||||
')
|
||||
lego_role(staff_r, staff_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type nginx_t;
|
||||
')
|
||||
lego_read_data_files(nginx_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type dovecot_t;
|
||||
')
|
||||
lego_read_data_files(dovecot_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type exim_t;
|
||||
')
|
||||
lego_read_data_files(exim_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type system_cronjob_t, system_cronjob_tmp_t;
|
||||
')
|
||||
cron_system_entry(lego_t, lego_exec_t)
|
||||
allow system_cronjob_t lego_data_t:file setattr;
|
||||
allow lego_t system_cronjob_tmp_t:file write;
|
||||
')
|
||||
|
||||
20
sec-policy/selinux-lego/selinux-lego-2.20180701-r1.ebuild
Normal file
20
sec-policy/selinux-lego/selinux-lego-2.20180701-r1.ebuild
Normal file
@@ -0,0 +1,20 @@
|
||||
# Copyright 1999-2015 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
# $Id$
|
||||
EAPI="5"
|
||||
|
||||
IUSE=""
|
||||
MODS="lego"
|
||||
POLICY_FILES="lego.te lego.fc lego.if"
|
||||
|
||||
inherit selinux-policy-2
|
||||
|
||||
DESCRIPTION="SELinux policy for lego"
|
||||
|
||||
RDEPEND="sec-policy/selinux-base-policy"
|
||||
|
||||
if [[ $PV == 9999* ]] ; then
|
||||
KEYWORDS=""
|
||||
else
|
||||
KEYWORDS="amd64 x86"
|
||||
fi
|
||||
Reference in New Issue
Block a user