From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id A08FC138200 for ; Sat, 27 Oct 2012 11:09:04 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 5C5FE21C0B1; Sat, 27 Oct 2012 11:06:27 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id A459A21C0AF for ; Sat, 27 Oct 2012 11:06:26 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id CB09C33D8F5 for ; Sat, 27 Oct 2012 11:06:25 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 6AA8DE5453 for ; Sat, 27 Oct 2012 11:06:23 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1351335789.d3260d69479bb5aa5fdb4ac442a47f7eb6ce5c74.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/ctdb.if policy/modules/contrib/ctdb.te policy/modules/contrib/samba.fc policy/modules/contrib/samba.if policy/modules/contrib/samba.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: d3260d69479bb5aa5fdb4ac442a47f7eb6ce5c74 X-VCS-Branch: master Date: Sat, 27 Oct 2012 11:06:23 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: ca24b385-9fd6-405e-95ff-dee92ca09b55 X-Archives-Hash: 01027b94bced6ddcf7094e99921ca922 commit: d3260d69479bb5aa5fdb4ac442a47f7eb6ce5c74 Author: Dominick Grift gmail com> AuthorDate: Fri Oct 26 09:08:46 2012 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Sat Oct 27 11:03:09 2012 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=d3260d69 Changes to the samba policy module and relevant dependencies Ported from Fedora with changes Signed-off-by: Dominick Grift gmail.com> --- policy/modules/contrib/ctdb.if | 40 +++ policy/modules/contrib/ctdb.te | 2 +- policy/modules/contrib/samba.fc | 16 +- policy/modules/contrib/samba.if | 215 ++++++---------- policy/modules/contrib/samba.te | 543 +++++++++++++++++++++------------------ 5 files changed, 431 insertions(+), 385 deletions(-) diff --git a/policy/modules/contrib/ctdb.if b/policy/modules/contrib/ctdb.if index 53779fb..b25b01d 100644 --- a/policy/modules/contrib/ctdb.if +++ b/policy/modules/contrib/ctdb.if @@ -2,6 +2,46 @@ ######################################## ## +## Create, read, write, and delete +## ctdbd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_manage_lib_files',` + gen_require(` + type ctdbd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t) +') + +####################################### +## +## Connect to ctdbd with a unix +## domain stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_stream_connect',` + gen_require(` + type ctdbd_t, ctdbd_var_run_t, ctdbd_tmp_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, { ctdbd_tmp_t ctdbd_var_run_t }, { ctdbd_tmp_t ctdbd_var_run_t }, ctdbd_t) +') + +######################################## +## ## All of the rules required to ## administrate an ctdb environment. ## diff --git a/policy/modules/contrib/ctdb.te b/policy/modules/contrib/ctdb.te index 3c2d77d..c911905 100644 --- a/policy/modules/contrib/ctdb.te +++ b/policy/modules/contrib/ctdb.te @@ -1,4 +1,4 @@ -policy_module(ctdb, 1.0.1) +policy_module(ctdb, 1.0.2) ######################################## # diff --git a/policy/modules/contrib/samba.fc b/policy/modules/contrib/samba.fc index 08b2a49..fb22e30 100644 --- a/policy/modules/contrib/samba.fc +++ b/policy/modules/contrib/samba.fc @@ -1,19 +1,13 @@ - -# -# /etc -# /etc/rc\.d/init\.d/nmb -- gen_context(system_u:object_r:samba_initrc_exec_t,s0) /etc/rc\.d/init\.d/smb -- gen_context(system_u:object_r:samba_initrc_exec_t,s0) /etc/rc\.d/init\.d/winbind -- gen_context(system_u:object_r:samba_initrc_exec_t,s0) + /etc/samba/MACHINE\.SID -- gen_context(system_u:object_r:samba_secrets_t,s0) /etc/samba/passdb\.tdb -- gen_context(system_u:object_r:samba_secrets_t,s0) /etc/samba/secrets\.tdb -- gen_context(system_u:object_r:samba_secrets_t,s0) /etc/samba/smbpasswd -- gen_context(system_u:object_r:samba_secrets_t,s0) /etc/samba(/.*)? gen_context(system_u:object_r:samba_etc_t,s0) -# -# /usr -# /usr/bin/net -- gen_context(system_u:object_r:samba_net_exec_t,s0) /usr/bin/ntlm_auth -- gen_context(system_u:object_r:winbind_helper_exec_t,s0) /usr/bin/smbcontrol -- gen_context(system_u:object_r:smbcontrol_exec_t,s0) @@ -25,9 +19,6 @@ /usr/sbin/smbd -- gen_context(system_u:object_r:smbd_exec_t,s0) /usr/sbin/winbindd -- gen_context(system_u:object_r:winbind_exec_t,s0) -# -# /var -# /var/cache/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0) /var/cache/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) @@ -36,6 +27,10 @@ /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) +/var/run/nmbd(/.*)? gen_context(system_u:object_r:nmbd_var_run_t,s0) +/var/run/samba/nmbd(/.*)? gen_context(system_u:object_r:nmbd_var_run_t,s0) + +/var/run/samba(/.*)? gen_context(system_u:object_r:smbd_var_run_t,s0) /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) /var/run/samba/connections\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) /var/run/samba/gencache\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) @@ -49,5 +44,6 @@ /var/run/samba/unexpected\.tdb -- gen_context(system_u:object_r:nmbd_var_run_t,s0) /var/run/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) +/var/run/samba/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) /var/spool/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0) diff --git a/policy/modules/contrib/samba.if b/policy/modules/contrib/samba.if index 3a4df9f..aee75af 100644 --- a/policy/modules/contrib/samba.if +++ b/policy/modules/contrib/samba.if @@ -1,12 +1,8 @@ -## -## SMB and CIFS client/server programs for UNIX and -## name Service Switch daemon for resolving names -## from Windows NT servers. -## +## SMB and CIFS client/server programs. ######################################## ## -## Execute nmbd net in the nmbd_t domain. +## Execute nmbd in the nmbd domain. ## ## ## @@ -25,7 +21,7 @@ interface(`samba_domtrans_nmbd',` ####################################### ## -## Allow domain to signal samba +## Send generic signals to nmbd. ## ## ## @@ -53,17 +49,17 @@ interface(`samba_signal_nmbd',` # interface(`samba_stream_connect_nmbd',` gen_require(` - type samba_var_t, nmbd_t, nmbd_var_run_t; + type samba_var_t, nmbd_t, nmbd_var_run_t, smbd_var_run_t; ') files_search_pids($1) - allow $1 samba_var_t:dir search_dir_perms; - stream_connect_pattern($1, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) + stream_connect_pattern($1, { smbd_var_run_t samba_var_t nmbd_var_run_t }, nmbd_var_run_t, nmbd_t) ') ######################################## ## -## Execute samba server in the samba domain. +## Execute samba init scripts in +## the init script domain. ## ## ## @@ -81,7 +77,7 @@ interface(`samba_initrc_domtrans',` ######################################## ## -## Execute samba net in the samba_net domain. +## Execute samba net in the samba net domain. ## ## ## @@ -100,8 +96,9 @@ interface(`samba_domtrans_net',` ######################################## ## -## Execute samba net in the samba_net domain, and -## allow the specified role the samba_net domain. +## Execute samba net in the samba net +## domain, and allow the specified +## role the samba net domain. ## ## ## @@ -117,11 +114,11 @@ interface(`samba_domtrans_net',` # interface(`samba_run_net',` gen_require(` - type samba_net_t; + attribute_role samba_net_roles; ') samba_domtrans_net($1) - role $2 types samba_net_t; + roleattribute $2 samba_net_roles; ') ######################################## @@ -145,8 +142,9 @@ interface(`samba_domtrans_smbmount',` ######################################## ## -## Execute smbmount interactively and do -## a domain transition to the smbmount domain. +## Execute smbmount in the smbmount +## domain, and allow the specified +## role the smbmount domain. ## ## ## @@ -162,17 +160,16 @@ interface(`samba_domtrans_smbmount',` # interface(`samba_run_smbmount',` gen_require(` - type smbmount_t; + attribute_role smbmount_roles; ') samba_domtrans_smbmount($1) - role $2 types smbmount_t; + roleattribute $2 smbmount_roles; ') ######################################## ## -## Allow the specified domain to read -## samba configuration files. +## Read samba configuration files. ## ## ## @@ -192,8 +189,7 @@ interface(`samba_read_config',` ######################################## ## -## Allow the specified domain to read -## and write samba configuration files. +## Read and write samba configuration files. ## ## ## @@ -213,8 +209,8 @@ interface(`samba_rw_config',` ######################################## ## -## Allow the specified domain to read -## and write samba configuration files. +## Create, read, write, and delete +## samba configuration files. ## ## ## @@ -235,7 +231,7 @@ interface(`samba_manage_config',` ######################################## ## -## Allow the specified domain to read samba's log files. +## Read samba log files. ## ## ## @@ -256,7 +252,7 @@ interface(`samba_read_log',` ######################################## ## -## Allow the specified domain to append to samba's log files. +## Append to samba log files. ## ## ## @@ -277,7 +273,7 @@ interface(`samba_append_log',` ######################################## ## -## Execute samba log in the caller domain. +## Execute samba log files in the caller domain. ## ## ## @@ -296,7 +292,7 @@ interface(`samba_exec_log',` ######################################## ## -## Allow the specified domain to read samba's secrets. +## Read samba secret files. ## ## ## @@ -315,7 +311,7 @@ interface(`samba_read_secrets',` ######################################## ## -## Allow the specified domain to read samba's shares +## Read samba share files. ## ## ## @@ -334,8 +330,7 @@ interface(`samba_read_share_files',` ######################################## ## -## Allow the specified domain to search -## samba /var directories. +## Search samba var directories. ## ## ## @@ -348,15 +343,13 @@ interface(`samba_search_var',` type samba_var_t; ') - files_search_var($1) files_search_var_lib($1) allow $1 samba_var_t:dir search_dir_perms; ') ######################################## ## -## Allow the specified domain to -## read samba /var files. +## Read samba var files. ## ## ## @@ -369,15 +362,14 @@ interface(`samba_read_var_files',` type samba_var_t; ') - files_search_var($1) files_search_var_lib($1) read_files_pattern($1, samba_var_t, samba_var_t) ') ######################################## ## -## Do not audit attempts to write samba -## /var files. +## Do not audit attempts to write +## samba var files. ## ## ## @@ -395,8 +387,7 @@ interface(`samba_dontaudit_write_var_files',` ######################################## ## -## Allow the specified domain to -## read and write samba /var files. +## Read and write samba var files. ## ## ## @@ -409,15 +400,14 @@ interface(`samba_rw_var_files',` type samba_var_t; ') - files_search_var($1) files_search_var_lib($1) rw_files_pattern($1, samba_var_t, samba_var_t) ') ######################################## ## -## Allow the specified domain to -## read and write samba /var files. +## Create, read, write, and delete +## samba var files. ## ## ## @@ -430,34 +420,34 @@ interface(`samba_manage_var_files',` type samba_var_t; ') - files_search_var($1) files_search_var_lib($1) manage_files_pattern($1, samba_var_t, samba_var_t) ') ######################################## ## -## Execute a domain transition to run smbcontrol. +## Execute smbcontrol in the smbcontrol domain. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`samba_domtrans_smbcontrol',` gen_require(` - type smbcontrol_t; - type smbcontrol_exec_t; + type smbcontrol_t, smbcontrol_exec_t; ') + corecmd_search_bin($1) domtrans_pattern($1, smbcontrol_exec_t, smbcontrol_t) ') ######################################## ## -## Execute smbcontrol in the smbcontrol domain, and -## allow the specified role the smbcontrol domain. +## Execute smbcontrol in the smbcontrol +## domain, and allow the specified +## role the smbcontrol domain. ## ## ## @@ -472,16 +462,16 @@ interface(`samba_domtrans_smbcontrol',` # interface(`samba_run_smbcontrol',` gen_require(` - type smbcontrol_t; + attribute_role smbcontrol_roles; ') samba_domtrans_smbcontrol($1) - role $2 types smbcontrol_t; + roleattribute $2 smbcontrol_roles; ') ######################################## ## -## Execute smbd in the smbd_t domain. +## Execute smbd in the smbd domain. ## ## ## @@ -500,7 +490,7 @@ interface(`samba_domtrans_smbd',` ###################################### ## -## Allow domain to signal samba +## Send generic signals to smbd. ## ## ## @@ -517,7 +507,8 @@ interface(`samba_signal_smbd',` ######################################## ## -## Do not audit attempts to use file descriptors from samba. +## Do not audit attempts to inherit +## and use smbd file descriptors. ## ## ## @@ -535,7 +526,7 @@ interface(`samba_dontaudit_use_fds',` ######################################## ## -## Allow the specified domain to write to smbmount tcp sockets. +## Write smbmount tcp sockets. ## ## ## @@ -553,7 +544,7 @@ interface(`samba_write_smbmount_tcp_sockets',` ######################################## ## -## Allow the specified domain to read and write to smbmount tcp sockets. +## Read and write smbmount tcp sockets. ## ## ## @@ -571,7 +562,8 @@ interface(`samba_rw_smbmount_tcp_sockets',` ######################################## ## -## Execute winbind_helper in the winbind_helper domain. +## Execute winbind helper in the +## winbind helper domain. ## ## ## @@ -584,6 +576,7 @@ interface(`samba_domtrans_winbind_helper',` type winbind_helper_t, winbind_helper_exec_t; ') + corecmd_search_bin($1) domtrans_pattern($1, winbind_helper_exec_t, winbind_helper_t) ') @@ -607,8 +600,9 @@ interface(`samba_getattr_winbind_exec',` ######################################## ## -## Execute winbind_helper in the winbind_helper domain, and -## allow the specified role the winbind_helper domain. +## Execute winbind helper in the winbind +## helper domain, and allow the specified +## role the winbind helper domain. ## ## ## @@ -624,16 +618,16 @@ interface(`samba_getattr_winbind_exec',` # interface(`samba_run_winbind_helper',` gen_require(` - type winbind_helper_t; + attribute_role winbind_helper_roles; ') samba_domtrans_winbind_helper($1) - role $2 types winbind_helper_t; + roleattribute $2 winbind_helper_roles; ') ######################################## ## -## Allow the specified domain to read the winbind pid files. +## Read winbind pid files. ## ## ## @@ -643,16 +637,17 @@ interface(`samba_run_winbind_helper',` # interface(`samba_read_winbind_pid',` gen_require(` - type winbind_var_run_t; + type winbind_var_run_t, smbd_var_run_t; ') files_search_pids($1) - allow $1 winbind_var_run_t:file read_file_perms; + read_files_pattern($1, { smbd_var_run_t winbind_var_run_t }, winbind_var_run_t) ') ######################################## ## -## Connect to winbind. +## Connect to winbind with a unix +## domain stream socket. ## ## ## @@ -662,29 +657,17 @@ interface(`samba_read_winbind_pid',` # interface(`samba_stream_connect_winbind',` gen_require(` - type samba_var_t, winbind_t, winbind_var_run_t; + type samba_var_t, winbind_t, winbind_var_run_t, smbd_var_run_t; ') files_search_pids($1) - allow $1 samba_var_t:dir search_dir_perms; - stream_connect_pattern($1, winbind_var_run_t, winbind_var_run_t, winbind_t) - - ifndef(`distro_redhat',` - gen_require(` - type winbind_tmp_t; - ') - - # the default for the socket is (poorly named): - # /tmp/.winbindd/pipe - files_search_tmp($1) - stream_connect_pattern($1, winbind_tmp_t, winbind_tmp_t, winbind_t) - ') + stream_connect_pattern($1, { smbd_var_run_t samba_var_t winbind_var_run_t }, winbind_var_run_t, winbind_t) ') ######################################## ## -## All of the rules required to administrate -## an samba environment +## All of the rules required to +## administrate an samba environment. ## ## ## @@ -693,77 +676,49 @@ interface(`samba_stream_connect_winbind',` ## ## ## -## The role to be allowed to manage the samba domain. +## Role allowed access. ## ## ## # interface(`samba_admin',` gen_require(` - type nmbd_t, nmbd_var_run_t; - type smbd_t, smbd_tmp_t; - type smbd_var_run_t; - type smbd_spool_t; - - type samba_log_t, samba_var_t; - type samba_etc_t, samba_share_t; - type samba_secrets_t; - - type swat_var_run_t, swat_tmp_t; - + type nmbd_t, nmbd_var_run_t, smbd_var_run_t; + type smbd_t, smbd_tmp_t, smbd_spool_t; + type samba_log_t, samba_var_t, samba_secrets_t; + type samba_etc_t, samba_share_t, samba_initrc_exec_t; + type swat_var_run_t, swat_tmp_t, winbind_log_t; type winbind_var_run_t, winbind_tmp_t; - type winbind_log_t; - - type samba_initrc_exec_t; ') - allow $1 smbd_t:process { ptrace signal_perms }; - ps_process_pattern($1, smbd_t) - - allow $1 nmbd_t:process { ptrace signal_perms }; - ps_process_pattern($1, nmbd_t) - - samba_run_smbcontrol($1, $2, $3) - samba_run_winbind_helper($1, $2, $3) - samba_run_smbmount($1, $2, $3) - samba_run_net($1, $2, $3) + allow $1 { nmbd_t smbd_t }:process { ptrace signal_perms }; + ps_process_pattern($1, { nmbd_t smbd_t }) init_labeled_script_domtrans($1, samba_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 samba_initrc_exec_t system_r; allow $2 system_r; - admin_pattern($1, nmbd_var_run_t) - - admin_pattern($1, samba_etc_t) files_list_etc($1) + admin_pattern($1, samba_etc_t) - admin_pattern($1, samba_log_t) logging_list_logs($1) + admin_pattern($1, { samba_log_t winbind_log_t }) - admin_pattern($1, samba_secrets_t) - - admin_pattern($1, samba_share_t) - - admin_pattern($1, samba_var_t) files_list_var($1) + admin_pattern($1, { samba_share_t samba_var_t samba_secrets_t }) - admin_pattern($1, smbd_spool_t) files_list_spool($1) + admin_pattern($1, smbd_spool_t) - admin_pattern($1, smbd_var_run_t) files_list_pids($1) + admin_pattern($1, { winbind_var_run_t smbd_var_run_t swat_var_run_t nmbd_var_run_t }) - admin_pattern($1, smbd_tmp_t) files_list_tmp($1) + admin_pattern($1, { swat_tmp_t smbd_tmp_t winbind_tmp_t }) - admin_pattern($1, swat_var_run_t) - - admin_pattern($1, swat_tmp_t) - - admin_pattern($1, winbind_log_t) - - admin_pattern($1, winbind_tmp_t) - - admin_pattern($1, winbind_var_run_t) + samba_run_smbcontrol($1, $2) + samba_run_winbind_helper($1, $2) + samba_run_smbmount($1, $2) + samba_run_net($1, $2) ') diff --git a/policy/modules/contrib/samba.te b/policy/modules/contrib/samba.te index 60934cd..f7a747a 100644 --- a/policy/modules/contrib/samba.te +++ b/policy/modules/contrib/samba.te @@ -1,4 +1,4 @@ -policy_module(samba, 1.15.3) +policy_module(samba, 1.15.4) ################################# # @@ -6,72 +6,100 @@ policy_module(samba, 1.15.3) # ## -##

-## Allow samba to modify public files used for public file -## transfer services. Files/Directories must be labeled -## public_content_rw_t. -##

+##

+## Determine whether samba can modify +## public files used for public file +## transfer services. Directories/Files must +## be labeled public_content_rw_t. +##

## gen_tunable(allow_smbd_anon_write, false) ## -##

-## Allow samba to create new home directories (e.g. via PAM) -##

+##

+## Determine whether samba can +## create home directories via pam. +##

## gen_tunable(samba_create_home_dirs, false) ## -##

-## Allow samba to act as the domain controller, add users, -## groups and change passwords. -## -##

+##

+## Determine whether samba can act as the +## domain controller, add users, groups +## and change passwords. +##

## gen_tunable(samba_domain_controller, false) ## -##

-## Allow samba to share users home directories. -##

+##

+## Determine whether samba can +## act as a portmapper. +##

+## +gen_tunable(samba_portmapper, false) + +## +##

+## Determine whether samba can share +## users home directories. +##

## gen_tunable(samba_enable_home_dirs, false) ## -##

-## Allow samba to share any file/directory read only. -##

+##

+## Determine whether samba can share +## any content read only. +##

## gen_tunable(samba_export_all_ro, false) ## -##

-## Allow samba to share any file/directory read/write. -##

+##

+## Determine whether samba can share any +## content readable and writable. +##

## gen_tunable(samba_export_all_rw, false) ## -##

-## Allow samba to run unconfined scripts -##

+##

+## Determine whether samba can +## run unconfined scripts. +##

## gen_tunable(samba_run_unconfined, false) ## -##

-## Allow samba to export NFS volumes. -##

+##

+## Determine whether samba can +## use nfs file systems. +##

## gen_tunable(samba_share_nfs, false) ## -##

-## Allow samba to export ntfs/fusefs volumes. -##

+##

+## Determine whether samba can +## use fuse file systems. +##

## gen_tunable(samba_share_fusefs, false) +attribute_role samba_net_roles; +roleattribute system_r samba_net_roles; + +attribute_role smbcontrol_roles; +roleattribute system_r smbcontrol_roles; + +attribute_role smbmount_roles; +roleattribute system_r smbmount_roles; + +attribute_role winbind_helper_roles; +roleattribute system_r winbind_helper_roles; + type nmbd_t; type nmbd_exec_t; init_daemon_domain(nmbd_t, nmbd_exec_t) @@ -91,7 +119,7 @@ logging_log_file(samba_log_t) type samba_net_t; type samba_net_exec_t; application_domain(samba_net_t, samba_net_exec_t) -role system_r types samba_net_t; +role samba_net_roles types samba_net_t; type samba_net_tmp_t; files_tmp_file(samba_net_tmp_t) @@ -108,7 +136,7 @@ files_type(samba_var_t) type smbcontrol_t; type smbcontrol_exec_t; application_domain(smbcontrol_t, smbcontrol_exec_t) -role system_r types smbcontrol_t; +role smbcontrol_roles types smbcontrol_t; type smbd_t; type smbd_exec_t; @@ -121,10 +149,9 @@ type smbd_var_run_t; files_pid_file(smbd_var_run_t) type smbmount_t; -domain_type(smbmount_t) - type smbmount_exec_t; -domain_entry_file(smbmount_t, smbmount_exec_t) +application_domain(smbmount_t, smbmount_exec_t) +role smbmount_roles types smbmount_t; type swat_t; type swat_exec_t; @@ -143,11 +170,9 @@ type winbind_exec_t; init_daemon_domain(winbind_t, winbind_exec_t) type winbind_helper_t; -domain_type(winbind_helper_t) -role system_r types winbind_helper_t; - type winbind_helper_exec_t; -domain_entry_file(winbind_helper_t, winbind_helper_exec_t) +application_domain(winbind_helper_t, winbind_helper_exec_t) +role winbind_helper_roles types winbind_helper_t; type winbind_log_t; logging_log_file(winbind_log_t) @@ -160,14 +185,12 @@ files_pid_file(winbind_var_run_t) ######################################## # -# Samba net local policy +# Net local policy # + allow samba_net_t self:capability { sys_chroot sys_nice dac_read_search dac_override }; allow samba_net_t self:process { getsched setsched }; -allow samba_net_t self:unix_dgram_socket create_socket_perms; -allow samba_net_t self:unix_stream_socket create_stream_socket_perms; -allow samba_net_t self:udp_socket create_socket_perms; -allow samba_net_t self:tcp_socket create_socket_perms; +allow samba_net_t self:unix_stream_socket { accept listen }; allow samba_net_t samba_etc_t:file read_file_perms; @@ -182,28 +205,22 @@ manage_dirs_pattern(samba_net_t, samba_var_t, samba_var_t) manage_files_pattern(samba_net_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t) -kernel_read_proc_symlinks(samba_net_t) kernel_read_system_state(samba_net_t) +kernel_read_network_state(samba_net_t) corenet_all_recvfrom_unlabeled(samba_net_t) corenet_all_recvfrom_netlabel(samba_net_t) -corenet_tcp_sendrecv_generic_if(samba_net_t) corenet_udp_sendrecv_generic_if(samba_net_t) -corenet_raw_sendrecv_generic_if(samba_net_t) corenet_tcp_sendrecv_generic_node(samba_net_t) -corenet_udp_sendrecv_generic_node(samba_net_t) -corenet_raw_sendrecv_generic_node(samba_net_t) -corenet_tcp_sendrecv_all_ports(samba_net_t) -corenet_udp_sendrecv_all_ports(samba_net_t) -corenet_tcp_bind_generic_node(samba_net_t) -corenet_udp_bind_generic_node(samba_net_t) + +corenet_sendrecv_smbd_client_packets(samba_net_t) corenet_tcp_connect_smbd_port(samba_net_t) +corenet_tcp_sendrecv_smbd_port(samba_net_t) dev_read_urand(samba_net_t) domain_use_interactive_fds(samba_net_t) -files_read_etc_files(samba_net_t) files_read_usr_symlinks(samba_net_t) auth_use_nsswitch(samba_net_t) @@ -228,38 +245,37 @@ optional_policy(` optional_policy(` kerberos_use(samba_net_t) + kerberos_etc_filetrans_keytab(samba_net_t, file) ') ######################################## # -# smbd Local policy +# Smbd Local policy # -allow smbd_t self:capability { chown fowner setgid setuid sys_nice sys_resource lease dac_override dac_read_search }; + +allow smbd_t self:capability { chown fowner kill fsetid setgid setuid sys_chroot sys_nice sys_admin sys_resource lease dac_override dac_read_search }; dontaudit smbd_t self:capability sys_tty_config; -allow smbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; -allow smbd_t self:process setrlimit; +allow smbd_t self:process ~{ ptrace setcurrent setexec setfscreate execmem execstack execheap }; allow smbd_t self:fd use; allow smbd_t self:fifo_file rw_fifo_file_perms; allow smbd_t self:msg { send receive }; allow smbd_t self:msgq create_msgq_perms; allow smbd_t self:sem create_sem_perms; allow smbd_t self:shm create_shm_perms; -allow smbd_t self:sock_file read_sock_file_perms; -allow smbd_t self:tcp_socket create_stream_socket_perms; -allow smbd_t self:udp_socket create_socket_perms; -allow smbd_t self:unix_dgram_socket { create_socket_perms sendto }; -allow smbd_t self:unix_stream_socket { create_stream_socket_perms connectto }; - -allow smbd_t nmbd_t:process { signal signull }; +allow smbd_t self:tcp_socket { accept listen }; +allow smbd_t self:unix_dgram_socket sendto; +allow smbd_t self:unix_stream_socket { accept connectto listen }; -allow smbd_t nmbd_var_run_t:file rw_file_perms; +allow smbd_t { swat_t winbind_t smbcontrol_t nmbd_t }:process { signal signull }; -allow smbd_t samba_etc_t:file { rw_file_perms setattr }; +allow smbd_t samba_etc_t:file { rw_file_perms setattr_file_perms }; manage_dirs_pattern(smbd_t, samba_log_t, samba_log_t) -manage_files_pattern(smbd_t, samba_log_t, samba_log_t) +append_files_pattern(smbd_t, samba_log_t, samba_log_t) +create_files_pattern(smbd_t, samba_log_t, samba_log_t) +setattr_files_pattern(smbd_t, samba_log_t, samba_log_t) -allow smbd_t samba_net_tmp_t:file getattr; +allow smbd_t samba_net_tmp_t:file getattr_file_perms; manage_files_pattern(smbd_t, samba_secrets_t, samba_secrets_t) filetrans_pattern(smbd_t, samba_etc_t, samba_secrets_t, file) @@ -267,14 +283,13 @@ filetrans_pattern(smbd_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(smbd_t, samba_share_t, samba_share_t) manage_files_pattern(smbd_t, samba_share_t, samba_share_t) manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t) -allow smbd_t samba_share_t:filesystem getattr; +allow smbd_t samba_share_t:filesystem { getattr quotaget }; manage_dirs_pattern(smbd_t, samba_var_t, samba_var_t) manage_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) - -allow smbd_t smbcontrol_t:process { signal signull }; +files_var_filetrans(smbd_t, samba_var_t, dir) manage_dirs_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t) manage_files_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t) @@ -283,13 +298,13 @@ files_tmp_filetrans(smbd_t, smbd_tmp_t, { file dir }) manage_dirs_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) manage_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) manage_sock_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) -files_pid_filetrans(smbd_t, smbd_var_run_t, file) - -allow smbd_t swat_t:process signal; +files_pid_filetrans(smbd_t, smbd_var_run_t, { dir file }) -allow smbd_t winbind_var_run_t:sock_file rw_sock_file_perms; +allow smbd_t winbind_var_run_t:sock_file read_sock_file_perms; +stream_connect_pattern(smbd_t, winbind_var_run_t, winbind_var_run_t, winbind_t) -allow smbd_t winbind_t:process { signal signull }; +allow smbd_t nmbd_var_run_t:file read_file_perms; +stream_connect_pattern(smbd_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) kernel_getattr_core_if(smbd_t) kernel_getattr_message_if(smbd_t) @@ -299,56 +314,58 @@ kernel_read_kernel_sysctls(smbd_t) kernel_read_software_raid_state(smbd_t) kernel_read_system_state(smbd_t) -corecmd_exec_shell(smbd_t) corecmd_exec_bin(smbd_t) +corecmd_exec_shell(smbd_t) corenet_all_recvfrom_unlabeled(smbd_t) corenet_all_recvfrom_netlabel(smbd_t) corenet_tcp_sendrecv_generic_if(smbd_t) -corenet_udp_sendrecv_generic_if(smbd_t) -corenet_raw_sendrecv_generic_if(smbd_t) corenet_tcp_sendrecv_generic_node(smbd_t) -corenet_udp_sendrecv_generic_node(smbd_t) -corenet_raw_sendrecv_generic_node(smbd_t) -corenet_tcp_sendrecv_all_ports(smbd_t) -corenet_udp_sendrecv_all_ports(smbd_t) corenet_tcp_bind_generic_node(smbd_t) -corenet_udp_bind_generic_node(smbd_t) + +corenet_sendrecv_smbd_client_packets(smbd_t) +corenet_tcp_connect_smbd_port(smbd_t) +corenet_sendrecv_smbd_server_packets(smbd_t) corenet_tcp_bind_smbd_port(smbd_t) +corenet_tcp_sendrecv_smbd_port(smbd_t) + +corenet_sendrecv_ipp_client_packets(smbd_t) corenet_tcp_connect_ipp_port(smbd_t) -corenet_tcp_connect_smbd_port(smbd_t) +corenet_tcp_sendrecv_ipp_port(smbd_t) dev_read_sysfs(smbd_t) dev_read_urand(smbd_t) dev_getattr_mtrr_dev(smbd_t) dev_dontaudit_getattr_usbfs_dirs(smbd_t) -# For redhat bug 566984 dev_getattr_all_blk_files(smbd_t) dev_getattr_all_chr_files(smbd_t) +domain_use_interactive_fds(smbd_t) +domain_dontaudit_list_all_domains_state(smbd_t) + +files_list_var_lib(smbd_t) +files_read_etc_runtime_files(smbd_t) +files_read_usr_files(smbd_t) +files_search_spool(smbd_t) +files_dontaudit_getattr_all_dirs(smbd_t) +files_dontaudit_list_all_mountpoints(smbd_t) +files_list_mnt(smbd_t) + fs_getattr_all_fs(smbd_t) +fs_getattr_all_dirs(smbd_t) fs_get_xattr_fs_quotas(smbd_t) fs_search_auto_mountpoints(smbd_t) fs_getattr_rpc_dirs(smbd_t) fs_list_inotifyfs(smbd_t) +fs_get_all_fs_quotas(smbd_t) + +term_use_ptmx(smbd_t) auth_use_nsswitch(smbd_t) auth_domtrans_chk_passwd(smbd_t) auth_domtrans_upd_passwd(smbd_t) auth_manage_cache(smbd_t) - -domain_use_interactive_fds(smbd_t) -domain_dontaudit_list_all_domains_state(smbd_t) - -files_list_var_lib(smbd_t) -files_read_etc_files(smbd_t) -files_read_etc_runtime_files(smbd_t) -files_read_usr_files(smbd_t) -files_search_spool(smbd_t) -# smbd seems to getattr all mountpoints -files_dontaudit_getattr_all_dirs(smbd_t) -# Allow samba to list mnt_t for potential mounted dirs -files_list_mnt(smbd_t) +auth_write_login_records(smbd_t) init_rw_utmp(smbd_t) @@ -358,15 +375,16 @@ logging_send_syslog_msg(smbd_t) miscfiles_read_localization(smbd_t) miscfiles_read_public_files(smbd_t) +sysnet_use_ldap(smbd_t) + userdom_use_unpriv_users_fds(smbd_t) -userdom_search_user_home_content(smbd_t) userdom_signal_all_users(smbd_t) +userdom_home_filetrans_user_home_dir(smbd_t) +userdom_user_home_dir_filetrans_user_home_content(smbd_t, { dir file lnk_file sock_file fifo_file }) usermanage_read_crack_db(smbd_t) -term_use_ptmx(smbd_t) - -ifdef(`hide_broken_symptoms', ` +ifdef(`hide_broken_symptoms',` files_dontaudit_getattr_default_dirs(smbd_t) files_dontaudit_getattr_boot_dirs(smbd_t) fs_dontaudit_getattr_tmpfs_dirs(smbd_t) @@ -376,6 +394,11 @@ tunable_policy(`allow_smbd_anon_write',` miscfiles_manage_public_files(smbd_t) ') +tunable_policy(`samba_create_home_dirs',` + allow smbd_t self:capability chown; + userdom_create_user_home_dirs(smbd_t) +') + tunable_policy(`samba_domain_controller',` gen_require(` class passwd passwd; @@ -394,10 +417,15 @@ tunable_policy(`samba_enable_home_dirs',` userdom_manage_user_home_content_symlinks(smbd_t) userdom_manage_user_home_content_sockets(smbd_t) userdom_manage_user_home_content_pipes(smbd_t) - userdom_user_home_dir_filetrans_user_home_content(smbd_t, { dir file lnk_file sock_file fifo_file }) ') -# Support Samba sharing of NFS mount points +tunable_policy(`samba_portmapper',` + corenet_sendrecv_all_server_packets(smbd_t) + corenet_tcp_bind_epmap_port(smbd_t) + corenet_tcp_bind_all_unreserved_ports(smbd_t) + corenet_tcp_sendrecv_all_ports(smbd_t) +') + tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) @@ -406,7 +434,6 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_named_sockets(smbd_t) ') -# Support Samba sharing of ntfs/fusefs mount points tunable_policy(`samba_share_fusefs',` fs_manage_fusefs_dirs(smbd_t) fs_manage_fusefs_files(smbd_t) @@ -414,6 +441,26 @@ tunable_policy(`samba_share_fusefs',` fs_search_fusefs(smbd_t) ') +tunable_policy(`samba_export_all_ro',` + fs_read_noxattr_fs_files(smbd_t) + files_list_non_auth_dirs(smbd_t) + files_read_non_auth_files(smbd_t) +') + +tunable_policy(`samba_export_all_rw',` + fs_read_noxattr_fs_files(smbd_t) + files_manage_non_auth_files(smbd_t) +') + +optional_policy(` + ccs_read_config(smbd_t) +') + +optional_policy(` + ctdbd_stream_connect(smbd_t) + ctdbd_manage_lib_files(smbd_t) +') + optional_policy(` cups_read_rw_config(smbd_t) cups_stream_connect(smbd_t) @@ -425,10 +472,6 @@ optional_policy(` ') optional_policy(` - ldap_stream_connect(smbd_t) -') - -optional_policy(` lpd_exec_lpr(smbd_t) ') @@ -449,32 +492,9 @@ optional_policy(` udev_read_db(smbd_t) ') -tunable_policy(`samba_create_home_dirs',` - allow smbd_t self:capability chown; - userdom_create_user_home_dirs(smbd_t) - userdom_home_filetrans_user_home_dir(smbd_t) -') - -tunable_policy(`samba_export_all_ro',` - fs_read_noxattr_fs_files(smbd_t) - files_list_non_auth_dirs(smbd_t) - files_read_non_auth_files(smbd_t) - fs_read_noxattr_fs_files(nmbd_t) - files_list_non_auth_dirs(nmbd_t) - files_read_non_auth_files(nmbd_t) -') - -tunable_policy(`samba_export_all_rw',` - fs_read_noxattr_fs_files(smbd_t) - files_manage_non_auth_files(smbd_t) - fs_read_noxattr_fs_files(nmbd_t) - files_manage_non_auth_files(nmbd_t) - userdom_user_home_dir_filetrans_user_home_content(nmbd_t, { file dir }) -') - ######################################## # -# nmbd Local policy +# Nmbd Local policy # dontaudit nmbd_t self:capability sys_tty_config; @@ -485,24 +505,31 @@ allow nmbd_t self:msg { send receive }; allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; -allow nmbd_t self:sock_file read_sock_file_perms; -allow nmbd_t self:tcp_socket create_stream_socket_perms; -allow nmbd_t self:udp_socket create_socket_perms; -allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto }; -allow nmbd_t self:unix_stream_socket { create_stream_socket_perms connectto }; +allow nmbd_t self:tcp_socket { accept listen }; +allow nmbd_t self:unix_dgram_socket sendto; +allow nmbd_t self:unix_stream_socket { accept connectto listen }; +manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -files_pid_filetrans(nmbd_t, nmbd_var_run_t, file) +manage_sock_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) +files_pid_filetrans(nmbd_t, nmbd_var_run_t, { dir file sock_file }) +filetrans_pattern(nmbd_t, smbd_var_run_t, nmbd_var_run_t, dir) read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) -manage_files_pattern(nmbd_t, samba_log_t, samba_log_t) +append_files_pattern(nmbd_t, samba_log_t, samba_log_t) +create_files_pattern(nmbd_t, samba_log_t, samba_log_t) +setattr_files_pattern(nmbd_t, samba_log_t, samba_log_t) manage_files_pattern(nmbd_t, samba_var_t, samba_var_t) +manage_files_pattern(nmbd_t, samba_var_t, samba_var_t) +manage_lnk_files_pattern(nmbd_t, samba_var_t, samba_var_t) +manage_sock_files_pattern(nmbd_t, samba_var_t, samba_var_t) +files_var_filetrans(nmbd_t, samba_var_t, dir) -allow nmbd_t smbcontrol_t:process signal; +allow nmbd_t { swat_t smbcontrol_t }:process signal; allow nmbd_t smbd_var_run_t:dir rw_dir_perms; @@ -519,26 +546,27 @@ corenet_tcp_sendrecv_generic_if(nmbd_t) corenet_udp_sendrecv_generic_if(nmbd_t) corenet_tcp_sendrecv_generic_node(nmbd_t) corenet_udp_sendrecv_generic_node(nmbd_t) -corenet_tcp_sendrecv_all_ports(nmbd_t) -corenet_udp_sendrecv_all_ports(nmbd_t) corenet_udp_bind_generic_node(nmbd_t) -corenet_udp_bind_nmbd_port(nmbd_t) + corenet_sendrecv_nmbd_server_packets(nmbd_t) -corenet_sendrecv_nmbd_client_packets(nmbd_t) +corenet_udp_bind_nmbd_port(nmbd_t) +corenet_udp_sendrecv_nmbd_port(nmbd_t) + +corenet_sendrecv_smbd_client_packets(nmbd_t) corenet_tcp_connect_smbd_port(nmbd_t) +corenet_tcp_sendrecv_smbd_port(nmbd_t) dev_read_sysfs(nmbd_t) dev_getattr_mtrr_dev(nmbd_t) -fs_getattr_all_fs(nmbd_t) -fs_search_auto_mountpoints(nmbd_t) - domain_use_interactive_fds(nmbd_t) files_read_usr_files(nmbd_t) -files_read_etc_files(nmbd_t) files_list_var_lib(nmbd_t) +fs_getattr_all_fs(nmbd_t) +fs_search_auto_mountpoints(nmbd_t) + auth_use_nsswitch(nmbd_t) logging_search_logs(nmbd_t) @@ -547,7 +575,18 @@ logging_send_syslog_msg(nmbd_t) miscfiles_read_localization(nmbd_t) userdom_use_unpriv_users_fds(nmbd_t) -userdom_dontaudit_search_user_home_dirs(nmbd_t) +userdom_user_home_dir_filetrans_user_home_content(nmbd_t, { file dir }) + +tunable_policy(`samba_export_all_ro',` + fs_read_noxattr_fs_files(nmbd_t) + files_list_non_auth_dirs(nmbd_t) + files_read_non_auth_files(nmbd_t) +') + +tunable_policy(`samba_export_all_rw',` + fs_read_noxattr_fs_files(nmbd_t) + files_manage_non_auth_files(nmbd_t) +') optional_policy(` seutil_sigchld_newrole(nmbd_t) @@ -559,20 +598,16 @@ optional_policy(` ######################################## # -# smbcontrol local policy +# Smbcontrol local policy # -# internal communication is often done using fifo and unix sockets. -allow smbcontrol_t self:fifo_file rw_file_perms; +allow smbcontrol_t self:process signal; +allow smbcontrol_t self:fifo_file rw_fifo_file_perms; allow smbcontrol_t self:unix_stream_socket create_stream_socket_perms; +allow smbcontrol_t self:process { signal signull }; -allow smbcontrol_t nmbd_t:process { signal signull }; - -allow smbcontrol_t nmbd_var_run_t:file { read lock }; - -allow smbcontrol_t smbd_t:process signal; - -allow smbcontrol_t winbind_t:process { signal signull }; +allow smbcontrol_t { winbind_t nmbd_t smbd_t }:process { signal signull }; +read_files_pattern(smbcontrol_t, { nmbd_var_run_t smbd_var_run_t }, { nmbd_var_run_t smbd_var_run_t }) samba_read_config(smbcontrol_t) samba_rw_var_files(smbcontrol_t) @@ -581,53 +616,67 @@ samba_read_winbind_pid(smbcontrol_t) domain_use_interactive_fds(smbcontrol_t) +dev_read_urand(smbcontrol_t) + files_read_etc_files(smbcontrol_t) +files_search_var_lib(smbcontrol_t) + +term_use_console(smbcontrol_t) miscfiles_read_localization(smbcontrol_t) +sysnet_use_ldap(smbcontrol_t) + userdom_use_user_terminals(smbcontrol_t) +optional_policy(` + ctdbd_stream_connect(smbcontrol_t) +') + ######################################## # -# smbmount Local policy +# Smbmount Local policy # -allow smbmount_t self:capability { sys_rawio sys_admin dac_override chown }; # FIXME: is all of this really necessary? -allow smbmount_t self:process { fork signal_perms }; -allow smbmount_t self:tcp_socket create_stream_socket_perms; -allow smbmount_t self:udp_socket connect; +allow smbmount_t self:capability { sys_rawio sys_admin dac_override chown }; +allow smbmount_t self:process signal_perms; +allow smbmount_t self:tcp_socket { accept listen }; allow smbmount_t self:unix_dgram_socket create_socket_perms; allow smbmount_t self:unix_stream_socket create_socket_perms; allow smbmount_t samba_etc_t:dir list_dir_perms; allow smbmount_t samba_etc_t:file read_file_perms; -can_exec(smbmount_t, smbmount_exec_t) - allow smbmount_t samba_log_t:dir list_dir_perms; -allow smbmount_t samba_log_t:file manage_file_perms; +append_files_pattern(smbmount_t, samba_log_t, samba_log_t) +create_files_pattern(smbmount_t, samba_log_t, samba_log_t) +setattr_files_pattern(smbmount_t, samba_log_t, samba_log_t) allow smbmount_t samba_secrets_t:file manage_file_perms; manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) -files_list_var_lib(smbmount_t) + +can_exec(smbmount_t, smbmount_exec_t) kernel_read_system_state(smbmount_t) corenet_all_recvfrom_unlabeled(smbmount_t) corenet_all_recvfrom_netlabel(smbmount_t) corenet_tcp_sendrecv_generic_if(smbmount_t) -corenet_raw_sendrecv_generic_if(smbmount_t) -corenet_udp_sendrecv_generic_if(smbmount_t) corenet_tcp_sendrecv_generic_node(smbmount_t) -corenet_raw_sendrecv_generic_node(smbmount_t) -corenet_udp_sendrecv_generic_node(smbmount_t) -corenet_tcp_sendrecv_all_ports(smbmount_t) -corenet_udp_sendrecv_all_ports(smbmount_t) -corenet_tcp_bind_generic_node(smbmount_t) -corenet_udp_bind_generic_node(smbmount_t) + +corenet_sendrecv_all_client_packets(smbmount_t) corenet_tcp_connect_all_ports(smbmount_t) +corenet_tcp_sendrecv_all_ports(smbmount_t) + +corecmd_list_bin(smbmount_t) + +files_list_mnt(smbmount_t) +files_list_var_lib(smbmount_t) +files_mounton_mnt(smbmount_t) +files_manage_etc_runtime_files(smbmount_t) +files_etc_filetrans_etc_runtime(smbmount_t, file) fs_getattr_cifs(smbmount_t) fs_mount_cifs(smbmount_t) @@ -639,14 +688,6 @@ fs_read_cifs_files(smbmount_t) storage_raw_read_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t) -corecmd_list_bin(smbmount_t) - -files_list_mnt(smbmount_t) -files_mounton_mnt(smbmount_t) -files_manage_etc_runtime_files(smbmount_t) -files_etc_filetrans_etc_runtime(smbmount_t, file) -files_read_etc_files(smbmount_t) - auth_use_nsswitch(smbmount_t) miscfiles_read_localization(smbmount_t) @@ -666,35 +707,28 @@ optional_policy(` ######################################## # -# SWAT Local policy +# Swat Local policy # allow swat_t self:capability { dac_override setuid setgid sys_resource }; allow swat_t self:process { setrlimit signal_perms }; allow swat_t self:fifo_file rw_fifo_file_perms; allow swat_t self:netlink_tcpdiag_socket r_netlink_socket_perms; -allow swat_t self:tcp_socket create_stream_socket_perms; -allow swat_t self:udp_socket create_socket_perms; +allow swat_t self:tcp_socket { accept listen }; allow swat_t self:unix_stream_socket connectto; -samba_domtrans_smbd(swat_t) -allow swat_t smbd_t:process { signal signull }; - -samba_domtrans_nmbd(swat_t) -allow swat_t nmbd_t:process { signal signull }; -allow nmbd_t swat_t:process signal; - -allow swat_t smbd_var_run_t:file { lock unlink }; +allow swat_t { nmbd_t smbd_t }:process { signal signull }; -allow swat_t smbd_port_t:tcp_socket name_bind; - -allow swat_t nmbd_port_t:udp_socket name_bind; +allow swat_t smbd_var_run_t:file read_file_perms; +allow swat_t smbd_var_run_t:file { lock delete_file_perms }; rw_files_pattern(swat_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(swat_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(swat_t, samba_log_t, samba_log_t) -manage_files_pattern(swat_t, samba_log_t, samba_log_t) +append_files_pattern(swat_t, samba_log_t, samba_log_t) +create_files_pattern(swat_t, samba_log_t, samba_log_t) +setattr_files_pattern(swat_t, samba_log_t, samba_log_t) manage_files_pattern(swat_t, samba_etc_t, samba_secrets_t) @@ -702,9 +736,7 @@ manage_files_pattern(swat_t, samba_var_t, samba_var_t) allow swat_t smbd_exec_t:file mmap_file_perms ; -allow swat_t smbd_t:process signull; - -allow swat_t smbd_var_run_t:file read_file_perms; +allow swat_t { winbind_t smbd_t }:process { signal signull }; manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) @@ -713,13 +745,18 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) files_pid_filetrans(swat_t, swat_var_run_t, file) -allow swat_t winbind_exec_t:file mmap_file_perms; -domtrans_pattern(swat_t, winbind_exec_t, winbind_t) -allow swat_t winbind_t:process { signal signull }; - +read_files_pattern(swat_t, winbind_var_run_t, winbind_var_run_t) allow swat_t winbind_var_run_t:dir { write add_name remove_name }; allow swat_t winbind_var_run_t:sock_file { create unlink }; +read_files_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t) +stream_connect_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) + +samba_domtrans_smbd(swat_t) +samba_domtrans_nmbd(swat_t) + +domtrans_pattern(swat_t, winbind_exec_t, winbind_t) + kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) kernel_read_network_state(swat_t) @@ -730,24 +767,32 @@ corenet_all_recvfrom_unlabeled(swat_t) corenet_all_recvfrom_netlabel(swat_t) corenet_tcp_sendrecv_generic_if(swat_t) corenet_udp_sendrecv_generic_if(swat_t) -corenet_raw_sendrecv_generic_if(swat_t) corenet_tcp_sendrecv_generic_node(swat_t) corenet_udp_sendrecv_generic_node(swat_t) -corenet_raw_sendrecv_generic_node(swat_t) -corenet_tcp_sendrecv_all_ports(swat_t) -corenet_udp_sendrecv_all_ports(swat_t) -corenet_tcp_connect_smbd_port(swat_t) -corenet_tcp_connect_ipp_port(swat_t) +corenet_tcp_bind_generic_node(swat_t) +corenet_udp_bind_generic_node(swat_t) + +corenet_sendrecv_nmbd_server_packets(swat_t) +corenet_udp_bind_nmbd_port(swat_t) +corenet_udp_sendrecv_nmbd_port(swat_t) + corenet_sendrecv_smbd_client_packets(swat_t) +corenet_tcp_connect_smbd_port(swat_t) +corenet_sendrecv_smbd_server_packets(swat_t) +corenet_tcp_bind_smbd_port(swat_t) +corenet_tcp_sendrecv_smbd_port(swat_t) + corenet_sendrecv_ipp_client_packets(swat_t) +corenet_tcp_connect_ipp_port(swat_t) +corenet_tcp_sendrecv_ipp_port(swat_t) dev_read_urand(swat_t) files_list_var_lib(swat_t) -files_read_etc_files(swat_t) files_search_home(swat_t) files_read_usr_files(swat_t) fs_getattr_xattr_fs(swat_t) +files_list_var_lib(swat_t) auth_domtrans_chk_passwd(swat_t) auth_use_nsswitch(swat_t) @@ -761,6 +806,8 @@ logging_search_logs(swat_t) miscfiles_read_localization(swat_t) +sysnet_use_ldap(swat_t) + optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) @@ -783,14 +830,13 @@ allow winbind_t self:capability { dac_override ipc_lock setuid sys_nice }; dontaudit winbind_t self:capability sys_tty_config; allow winbind_t self:process { signal_perms getsched setsched }; allow winbind_t self:fifo_file rw_fifo_file_perms; -allow winbind_t self:unix_dgram_socket create_socket_perms; -allow winbind_t self:unix_stream_socket create_stream_socket_perms; -allow winbind_t self:tcp_socket create_stream_socket_perms; -allow winbind_t self:udp_socket create_socket_perms; +allow winbind_t self:unix_stream_socket { accept listen }; +allow winbind_t self:tcp_socket { accept listen }; allow winbind_t nmbd_t:process { signal signull }; allow winbind_t nmbd_var_run_t:file read_file_perms; +stream_connect_pattern(winbind_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) @@ -800,17 +846,19 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) -manage_files_pattern(winbind_t, samba_log_t, samba_log_t) +append_files_pattern(winbind_t, samba_log_t, samba_log_t) +create_files_pattern(winbind_t, samba_log_t, samba_log_t) +setattr_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) manage_files_pattern(winbind_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t) -files_list_var_lib(winbind_t) rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t) -allow winbind_t winbind_log_t:file manage_file_perms; +# This needs a file context specification +allow winbind_t winbind_log_t:file { append_file_perms create_file_perms setattr_file_perms }; logging_log_filetrans(winbind_t, winbind_log_t, file) manage_dirs_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t) @@ -818,10 +866,14 @@ manage_files_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t) manage_sock_files_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t) files_tmp_filetrans(winbind_t, winbind_tmp_t, { file dir }) +manage_dirs_pattern(winbind_t, { smbd_var_run_t winbind_var_run_t }, winbind_var_run_t) manage_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t) manage_sock_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t) -files_pid_filetrans(winbind_t, winbind_var_run_t, file) +files_pid_filetrans(winbind_t, winbind_var_run_t, { sock_file file dir }) +filetrans_pattern(winbind_t, smbd_var_run_t, winbind_var_run_t, dir) +manage_files_pattern(winbind_t, smbd_var_run_t, smbd_var_run_t) +kernel_read_network_state(winbind_t) kernel_read_kernel_sysctls(winbind_t) kernel_read_system_state(winbind_t) @@ -830,15 +882,10 @@ corecmd_exec_bin(winbind_t) corenet_all_recvfrom_unlabeled(winbind_t) corenet_all_recvfrom_netlabel(winbind_t) corenet_tcp_sendrecv_generic_if(winbind_t) -corenet_udp_sendrecv_generic_if(winbind_t) -corenet_raw_sendrecv_generic_if(winbind_t) corenet_tcp_sendrecv_generic_node(winbind_t) -corenet_udp_sendrecv_generic_node(winbind_t) -corenet_raw_sendrecv_generic_node(winbind_t) corenet_tcp_sendrecv_all_ports(winbind_t) -corenet_udp_sendrecv_all_ports(winbind_t) -corenet_tcp_bind_generic_node(winbind_t) -corenet_udp_bind_generic_node(winbind_t) + +corenet_sendrecv_all_client_packets(winbind_t) corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) @@ -846,6 +893,11 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) dev_read_sysfs(winbind_t) dev_read_urand(winbind_t) +domain_use_interactive_fds(winbind_t) + +files_read_usr_symlinks(winbind_t) +files_list_var_lib(winbind_t) + fs_getattr_all_fs(winbind_t) fs_search_auto_mountpoints(winbind_t) @@ -853,14 +905,10 @@ auth_domtrans_chk_passwd(winbind_t) auth_use_nsswitch(winbind_t) auth_manage_cache(winbind_t) -domain_use_interactive_fds(winbind_t) - -files_read_etc_files(winbind_t) -files_read_usr_symlinks(winbind_t) - logging_send_syslog_msg(winbind_t) miscfiles_read_localization(winbind_t) +miscfiles_read_generic_certs(winbind_t) userdom_dontaudit_use_unpriv_user_fds(winbind_t) userdom_manage_user_home_content_dirs(winbind_t) @@ -871,6 +919,11 @@ userdom_manage_user_home_content_sockets(winbind_t) userdom_user_home_dir_filetrans_user_home_content(winbind_t, { dir file lnk_file fifo_file sock_file }) optional_policy(` + ctdbd_stream_connect(winbind_t) + ctdbd_manage_lib_files(winbind_t) +') + +optional_policy(` kerberos_use(winbind_t) ') @@ -887,24 +940,24 @@ optional_policy(` # Winbind helper local policy # -allow winbind_helper_t self:unix_dgram_socket create_socket_perms; -allow winbind_helper_t self:unix_stream_socket create_stream_socket_perms; +allow winbind_helper_t self:unix_stream_socket { accept listen }; allow winbind_helper_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_helper_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(winbind_helper_t, samba_etc_t, samba_etc_t) allow winbind_helper_t samba_var_t:dir search_dir_perms; -files_list_var_lib(winbind_helper_t) allow winbind_t smbcontrol_t:process signal; stream_connect_pattern(winbind_helper_t, winbind_var_run_t, winbind_var_run_t, winbind_t) -term_list_ptys(winbind_helper_t) - domain_use_interactive_fds(winbind_helper_t) +files_list_var_lib(winbind_helper_t) + +term_list_ptys(winbind_helper_t) + auth_use_nsswitch(winbind_helper_t) logging_send_syslog_msg(winbind_helper_t) @@ -925,7 +978,7 @@ optional_policy(` ######################################## # -# samba_unconfined_script_t local policy +# Unconfined script local policy # optional_policy(` @@ -943,5 +996,7 @@ optional_policy(` tunable_policy(`samba_run_unconfined',` domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t) + ',` + can_exec(smbd_t, samba_unconfined_script_exec_t) ') ')