[gentoo-commits] proj/hardened-refpolicy:master commit in: /

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     b4dc7016234346091028205292a1055eb4314e84
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 22 09:47:23 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 22 18:11:58 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=b4dc7016

Initial rabbitmq policy module

RabbitMQ is a complete and highly reliable enterprise messaging system
based on the emerging AMQP standard.

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 rabbitmq.fc |   10 +++++
 rabbitmq.if |   61 ++++++++++++++++++++++++++++++++++
 rabbitmq.te |  106 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 177 insertions(+), 0 deletions(-)

diff --git a/rabbitmq.fc b/rabbitmq.fc
new file mode 100644
index 0000000..c5ad6de
--- /dev/null
+++ b/rabbitmq.fc
@@ -0,0 +1,10 @@
+/etc/rc\.d/init\.d/rabbitmq-server	--	gen_context(system_u:object_r:rabbitmq_initrc_exec_t,s0)
+
+/usr/lib/erlang/erts.*/bin/beam.*	--	gen_context(system_u:object_r:rabbitmq_beam_exec_t,s0)
+/usr/lib/erlang/erts.*/bin/epmd	--	gen_context(system_u:object_r:rabbitmq_epmd_exec_t,s0)
+
+/var/lib/rabbitmq(/.*)?	gen_context(system_u:object_r:rabbitmq_var_lib_t,s0)
+
+/var/log/rabbitmq(/.*)?	gen_context(system_u:object_r:rabbitmq_var_log_t,s0)
+
+/var/run/rabbitmq(/.*)?	gen_context(system_u:object_r:rabbitmq_var_run_t,s0)

diff --git a/rabbitmq.if b/rabbitmq.if
new file mode 100644
index 0000000..2c3d338
--- /dev/null
+++ b/rabbitmq.if
@@ -0,0 +1,61 @@
+## <summary>AMQP server written in Erlang.</summary>
+
+########################################
+## <summary>
+##	Execute rabbitmq in the rabbitmq domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`rabbitmq_domtrans',`
+	gen_require(`
+		type rabbitmq_t, rabbitmq_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, rabbitmq_exec_t, rabbitmq_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an rabbitmq environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`rabbitmq_admin',`
+	gen_require(`
+		type rabbitmq_epmd_t, rabbitmq_beam_t, rabbitmq_initrc_exec_t;
+		type rabbitmq_var_lib_t, rabbitmq_var_log_t, rabbitmq_var_run_t;
+	')
+
+	allow $1 { rabbitmq_epmd_t rabbitmq_beam_t }:process { ptrace signal_perms };
+	ps_process_pattern($1, { rabbitmq_epmd_t rabbitmq_beam_t })
+
+	init_labeled_script_domtrans($1, rabbitmq_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 rabbitmq_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	logging_search_logs($1)
+	admin_pattern($1, rabbitmq_var_log_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, rabbitmq_var_lib_t)
+
+	files_search_pids($1)
+	admin_pattern($1, rabbitmq_var_run_t)
+')

diff --git a/rabbitmq.te b/rabbitmq.te
new file mode 100644
index 0000000..3698b51
--- /dev/null
+++ b/rabbitmq.te
@@ -0,0 +1,106 @@
+policy_module(rabbitmq, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type rabbitmq_epmd_t;
+type rabbitmq_epmd_exec_t;
+init_daemon_domain(rabbitmq_epmd_t, rabbitmq_epmd_exec_t)
+
+type rabbitmq_beam_t;
+type rabbitmq_beam_exec_t;
+init_daemon_domain(rabbitmq_beam_t, rabbitmq_beam_exec_t)
+
+type rabbitmq_initrc_exec_t;
+init_script_file(rabbitmq_initrc_exec_t)
+
+type rabbitmq_var_lib_t;
+files_type(rabbitmq_var_lib_t)
+
+type rabbitmq_var_log_t;
+logging_log_file(rabbitmq_var_log_t)
+
+type rabbitmq_var_run_t;
+files_pid_file(rabbitmq_var_run_t)
+
+######################################
+#
+# Beam local policy
+#
+
+allow rabbitmq_beam_t self:process { setsched signal signull };
+allow rabbitmq_beam_t self:fifo_file rw_fifo_file_perms;
+allow rabbitmq_beam_t self:tcp_socket { accept listen };
+
+manage_dirs_pattern(rabbitmq_beam_t, rabbitmq_var_lib_t, rabbitmq_var_lib_t)
+manage_files_pattern(rabbitmq_beam_t, rabbitmq_var_lib_t, rabbitmq_var_lib_t)
+
+manage_dirs_pattern(rabbitmq_beam_t, rabbitmq_var_log_t, rabbitmq_var_log_t)
+append_files_pattern(rabbitmq_beam_t, rabbitmq_var_log_t, rabbitmq_var_log_t)
+create_files_pattern(rabbitmq_beam_t, rabbitmq_var_log_t, rabbitmq_var_log_t)
+setattr_files_pattern(rabbitmq_beam_t, rabbitmq_var_log_t, rabbitmq_var_log_t)
+
+manage_dirs_pattern(rabbitmq_beam_t, rabbitmq_var_run_t, rabbitmq_var_run_t)
+manage_files_pattern(rabbitmq_beam_t, rabbitmq_var_run_t, rabbitmq_var_run_t)
+
+can_exec(rabbitmq_beam_t, rabbitmq_beam_exec_t)
+
+domtrans_pattern(rabbitmq_beam_t, rabbitmq_epmd_exec_t, rabbitmq_epmd_t)
+
+kernel_read_system_state(rabbitmq_beam_t)
+
+corecmd_exec_bin(rabbitmq_beam_t)
+corecmd_exec_shell(rabbitmq_beam_t)
+
+corenet_all_recvfrom_unlabeled(rabbitmq_beam_t)
+corenet_all_recvfrom_netlabel(rabbitmq_beam_t)
+corenet_tcp_sendrecv_generic_if(rabbitmq_beam_t)
+corenet_tcp_sendrecv_generic_node(rabbitmq_beam_t)
+corenet_tcp_bind_generic_node(rabbitmq_beam_t)
+
+corenet_sendrecv_amqp_server_packets(rabbitmq_beam_t)
+corenet_tcp_bind_amqp_port(rabbitmq_beam_t)
+corenet_tcp_sendrecv_amqp_port(rabbitmq_beam_t)
+
+corenet_sendrecv_epmd_client_packets(rabbitmq_beam_t)
+corenet_tcp_connect_epmd_port(rabbitmq_beam_t)
+corenet_tcp_sendrecv_epmd_port(rabbitmq_beam_t)
+
+dev_read_sysfs(rabbitmq_beam_t)
+
+files_read_etc_files(rabbitmq_beam_t)
+
+miscfiles_read_localization(rabbitmq_beam_t)
+
+sysnet_dns_name_resolve(rabbitmq_beam_t)
+
+########################################
+#
+# Epmd local policy
+#
+
+
+allow rabbitmq_epmd_t self:process signal;
+allow rabbitmq_epmd_t self:fifo_file rw_fifo_file_perms;
+allow rabbitmq_epmd_t self:tcp_socket create_stream_socket_perms;
+allow rabbitmq_epmd_t self:unix_stream_socket { accept listen };
+
+allow rabbitmq_epmd_t rabbitmq_var_log_t:file append_file_perms;
+
+corenet_all_recvfrom_unlabeled(rabbitmq_epmd_t)
+corenet_all_recvfrom_netlabel(rabbitmq_epmd_t)
+corenet_tcp_sendrecv_generic_if(rabbitmq_epmd_t)
+corenet_tcp_sendrecv_generic_node(rabbitmq_epmd_t)
+corenet_tcp_bind_generic_node(rabbitmq_epmd_t)
+
+corenet_sendrecv_epmd_server_packets(rabbitmq_epmd_t)
+corenet_tcp_bind_epmd_port(rabbitmq_epmd_t)
+corenet_tcp_sendrecv_epmd_port(rabbitmq_epmd_t)
+
+files_read_etc_files(rabbitmq_epmd_t)
+
+logging_send_syslog_msg(rabbitmq_epmd_t)
+
+miscfiles_read_localization(rabbitmq_epmd_t)