add content

sec-policy/selinux-lego/files/lego.fc

@@ -0,0 +1,2 @@
+/var/lib/lego(/.*)?		gen_context(system_u:object_r:lego_data_t,s0)
+/usr/bin/lego	--      gen_context(system_u:object_r:lego_exec_t,s0)

sec-policy/selinux-lego/files/lego.if

@@ -0,0 +1,193 @@
+
+## <summary>policy for lego</summary>
+
+########################################
+## <summary>
+##	Execute lego_exec_t in the lego domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`lego_domtrans',`
+	gen_require(`
+		type lego_t, lego_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, lego_exec_t, lego_t)
+')
+
+######################################
+## <summary>
+##	Execute lego in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`lego_exec',`
+	gen_require(`
+		type lego_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, lego_exec_t)
+')
+
+########################################
+## <summary>
+##	Search lego conf directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`lego_search_data',`
+	gen_require(`
+		type lego_data_t;
+	')
+
+	allow $1 lego_data_t:dir search_dir_perms;
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
+##	Read lego conf files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`lego_read_data_files',`
+	gen_require(`
+		type lego_data_t;
+	')
+
+	allow $1 lego_data_t:dir list_dir_perms;
+	read_files_pattern($1, lego_data_t, lego_data_t)
+	files_search_etc($1)
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Manage lego conf files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`lego_manage_data_files',`
+	gen_require(`
+		type lego_data_t;
+	')
+
+	manage_files_pattern($1, lego_data_t, lego_data_t)
+	files_search_etc($1)
+	files_search_var_lib($1)
+')
+
+
+########################################
+## <summary>
+##	Execute lego in the lego domain, and
+##	allow the specified role the lego domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the lego domain.
+##	</summary>
+## </param>
+#
+interface(`lego_run',`
+	gen_require(`
+		type lego_t;
+		attribute_role lego_roles;
+	')
+
+	lego_domtrans($1)
+	roleattribute $2 lego_roles;
+')
+
+########################################
+## <summary>
+##	Role access for lego
+## </summary>
+## <param name="role">
+##	<summary>
+##	Role allowed access
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	User domain for the role
+##	</summary>
+## </param>
+#
+interface(`lego_role',`
+	gen_require(`
+		type lego_t;
+		attribute_role lego_roles;
+	')
+
+	roleattribute $1 lego_roles;
+
+	lego_domtrans($2)
+
+	ps_process_pattern($2, lego_t)
+	allow $2 lego_t:process { signull signal sigkill };
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an lego environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`lego_admin',`
+	gen_require(`
+		type lego_t;
+	')
+
+	allow $1 lego_t:process { signal_perms };
+	ps_process_pattern($1, lego_t)
+
+    tunable_policy(`deny_ptrace',`',`
+        allow $1 lego_t:process ptrace;
+    ')
+
+	files_search_etc($1)
+	admin_pattern($1, lego_data_t)
+	optional_policy(`
+		systemd_passwd_agent_exec($1)
+		systemd_read_fifo_file_passwd_run($1)
+	')
+')

sec-policy/selinux-lego/files/lego.te

@@ -0,0 +1,112 @@
+policy_module(lego, 1.0.3)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+##      <p>
+##      Determine whether lego can use
+##      user home directories.
+##      </p>
+## </desc>
+gen_tunable(lego_use_homedirs, false)
+
+attribute_role lego_roles;
+roleattribute system_r lego_roles;
+
+type lego_t;
+type lego_exec_t;
+application_domain(lego_t, lego_exec_t)
+role lego_roles types lego_t;
+
+type lego_data_t;
+files_type(lego_data_t)
+ubac_constrained(lego_data_t)
+
+########################################
+#
+# lego local policy
+#
+
+allow lego_t self:capability { dac_override dac_read_search };
+allow lego_t self:process getsched;
+sysnet_read_config(lego_t)
+files_search_var_lib(lego_t)
+
+userdom_use_user_ptys(lego_t)
+domain_use_interactive_fds(lego_t)
+
+corenet_tcp_connect_http_port(lego_t)
+allow lego_t self:tcp_socket create_socket_perms;
+allow lego_t self:udp_socket create_socket_perms;
+allow lego_t self:netlink_route_socket r_netlink_socket_perms;
+
+manage_dirs_pattern(lego_t, lego_data_t, lego_data_t)
+manage_files_pattern(lego_t, lego_data_t, lego_data_t)
+manage_lnk_files_pattern(lego_t, lego_data_t, lego_data_t)
+files_etc_filetrans(lego_t, lego_data_t, { dir file lnk_file })
+
+miscfiles_read_generic_certs(lego_t)
+miscfiles_read_localization(lego_t)
+
+tunable_policy(`lego_use_homedirs',`
+	userdom_manage_user_home_content_dirs(lego_t)
+	userdom_manage_user_home_content_files(lego_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type sysadm_t;
+       role sysadm_r;
+    ')
+    lego_role(sysadm_r, sysadm_t)
+')
+
+optional_policy(`
+    gen_require(`
+       role user_r;
+       type user_t;
+    ')
+    lego_role(user_r, user_t)
+')
+
+optional_policy(`
+    gen_require(`
+       role staff_r;
+       type staff_t;
+    ')
+    lego_role(staff_r, staff_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type nginx_t;
+    ')
+    lego_read_data_files(nginx_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type dovecot_t;
+    ')
+    lego_read_data_files(dovecot_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type exim_t;
+    ')
+    lego_read_data_files(exim_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type system_cronjob_t, system_cronjob_tmp_t;
+    ')
+        cron_system_entry(lego_t, lego_exec_t)
+	allow system_cronjob_t lego_data_t:file setattr;
+	allow lego_t system_cronjob_tmp_t:file write;
+')
+