[gentoo-commits] proj/hardened-refpolicy:master commit in: /

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     cc29211b9a8299a1793c2158c66fc5058c50d98f
Author:     Lukas Vrabec <lvrabec <AT> redhat <DOT> com>
AuthorDate: Tue Aug  6 12:14:52 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Sep 23 06:28:05 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=cc29211b

Add policy for redis-server

---
 redis.fc |  11 +++
 redis.if | 271 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 redis.te |  62 +++++++++++++++
 3 files changed, 344 insertions(+)

diff --git a/redis.fc b/redis.fc
new file mode 100644
index 0000000..638d6b4
--- /dev/null
+++ b/redis.fc
@@ -0,0 +1,11 @@
+/etc/rc\.d/init\.d/redis	--	gen_context(system_u:object_r:redis_initrc_exec_t,s0)
+
+/usr/lib/systemd/system/redis.*		--	gen_context(system_u:object_r:redis_unit_file_t,s0)
+
+/usr/sbin/redis-server		--	gen_context(system_u:object_r:redis_exec_t,s0)
+
+/var/lib/redis(/.*)?		gen_context(system_u:object_r:redis_var_lib_t,s0)
+
+/var/log/redis(/.*)?		gen_context(system_u:object_r:redis_log_t,s0)
+
+/var/run/redis(/.*)?		gen_context(system_u:object_r:redis_var_run_t,s0)

diff --git a/redis.if b/redis.if
new file mode 100644
index 0000000..e3efff0
--- /dev/null
+++ b/redis.if
@@ -0,0 +1,271 @@
+
+## <summary>policy for redis</summary>
+
+########################################
+## <summary>
+##	Execute TEMPLATE in the redis domin.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`redis_domtrans',`
+	gen_require(`
+		type redis_t, redis_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, redis_exec_t, redis_t)
+')
+
+########################################
+## <summary>
+##	Execute redis server in the redis domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`redis_initrc_domtrans',`
+	gen_require(`
+		type redis_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, redis_initrc_exec_t)
+')
+########################################
+## <summary>
+##	Read redis's log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`redis_read_log',`
+	gen_require(`
+		type redis_log_t;
+	')
+
+	logging_search_logs($1)
+	read_files_pattern($1, redis_log_t, redis_log_t)
+')
+
+########################################
+## <summary>
+##	Append to redis log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`redis_append_log',`
+	gen_require(`
+		type redis_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, redis_log_t, redis_log_t)
+')
+
+########################################
+## <summary>
+##	Manage redis log files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`redis_manage_log',`
+	gen_require(`
+		type redis_log_t;
+	')
+
+	logging_search_logs($1)
+	manage_dirs_pattern($1, redis_log_t, redis_log_t)
+	manage_files_pattern($1, redis_log_t, redis_log_t)
+	manage_lnk_files_pattern($1, redis_log_t, redis_log_t)
+')
+
+########################################
+## <summary>
+##	Search redis lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`redis_search_lib',`
+	gen_require(`
+		type redis_var_lib_t;
+	')
+
+	allow $1 redis_var_lib_t:dir search_dir_perms;
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Read redis lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`redis_read_lib_files',`
+	gen_require(`
+		type redis_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	read_files_pattern($1, redis_var_lib_t, redis_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage redis lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`redis_manage_lib_files',`
+	gen_require(`
+		type redis_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_files_pattern($1, redis_var_lib_t, redis_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage redis lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`redis_manage_lib_dirs',`
+	gen_require(`
+		type redis_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, redis_var_lib_t, redis_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Read redis PID files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`redis_read_pid_files',`
+	gen_require(`
+		type redis_var_run_t;
+	')
+
+	files_search_pids($1)
+	read_files_pattern($1, redis_var_run_t, redis_var_run_t)
+')
+
+########################################
+## <summary>
+##	Execute redis server in the redis domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`redis_systemctl',`
+	gen_require(`
+		type redis_t;
+		type redis_unit_file_t;
+	')
+
+	systemd_exec_systemctl($1)
+        systemd_read_fifo_file_password_run($1)
+	allow $1 redis_unit_file_t:file read_file_perms;
+	allow $1 redis_unit_file_t:service manage_service_perms;
+
+	ps_process_pattern($1, redis_t)
+')
+
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an redis environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`redis_admin',`
+	gen_require(`
+		type redis_t;
+		type redis_initrc_exec_t;
+		type redis_log_t;
+		type redis_var_lib_t;
+		type redis_var_run_t;
+	type redis_unit_file_t;
+	')
+
+	allow $1 redis_t:process { ptrace signal_perms };
+	ps_process_pattern($1, redis_t)
+
+	redis_initrc_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 redis_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	logging_search_logs($1)
+	admin_pattern($1, redis_log_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, redis_var_lib_t)
+
+	files_search_pids($1)
+	admin_pattern($1, redis_var_run_t)
+
+	redis_systemctl($1)
+	admin_pattern($1, redis_unit_file_t)
+	allow $1 redis_unit_file_t:service all_service_perms;
+	optional_policy(`
+		systemd_passwd_agent_exec($1)
+		systemd_read_fifo_file_passwd_run($1)
+	')
+')

diff --git a/redis.te b/redis.te
new file mode 100644
index 0000000..e5e9cf7
--- /dev/null
+++ b/redis.te
@@ -0,0 +1,62 @@
+policy_module(redis, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type redis_t;
+type redis_exec_t;
+init_daemon_domain(redis_t, redis_exec_t)
+
+type redis_initrc_exec_t;
+init_script_file(redis_initrc_exec_t)
+
+type redis_log_t;
+logging_log_file(redis_log_t)
+
+type redis_var_lib_t;
+files_type(redis_var_lib_t)
+
+type redis_var_run_t;
+files_pid_file(redis_var_run_t)
+
+type redis_unit_file_t;
+systemd_unit_file(redis_unit_file_t)
+
+########################################
+#
+# redis local policy
+#
+
+allow redis_t self:process { setrlimit signal_perms };
+allow redis_t self:fifo_file rw_fifo_file_perms;
+allow redis_t self:unix_stream_socket create_stream_socket_perms;
+allow redis_t self:tcp_socket create_stream_socket_perms;
+
+manage_dirs_pattern(redis_t, redis_log_t, redis_log_t)
+manage_files_pattern(redis_t, redis_log_t, redis_log_t)
+manage_lnk_files_pattern(redis_t, redis_log_t, redis_log_t)
+
+manage_dirs_pattern(redis_t, redis_var_lib_t, redis_var_lib_t)
+manage_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t)
+manage_lnk_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t)
+
+manage_dirs_pattern(redis_t, redis_var_run_t, redis_var_run_t)
+manage_files_pattern(redis_t, redis_var_run_t, redis_var_run_t)
+manage_lnk_files_pattern(redis_t, redis_var_run_t, redis_var_run_t)
+
+kernel_read_system_state(redis_t)
+
+corenet_tcp_bind_generic_node(redis_t)
+corenet_tcp_bind_redis_port(redis_t)
+
+dev_read_sysfs(redis_t)
+dev_read_urand(redis_t)
+
+logging_send_syslog_msg(redis_t)
+
+miscfiles_read_localization(redis_t)
+
+sysnet_dns_name_resolve(redis_t)
+