From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id E18F5139694 for ; Fri, 17 Feb 2017 08:44:33 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id EDFE121C073; Fri, 17 Feb 2017 08:44:27 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id BB2EA21C073 for ; Fri, 17 Feb 2017 08:44:27 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 0C97C340EE8 for ; Fri, 17 Feb 2017 08:44:16 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id ED6314ACF for ; Fri, 17 Feb 2017 08:44:12 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1487320729.f5d92d4af9bd6a2688884494681381e08644e698.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/gpm.if policy/modules/contrib/gpm.te policy/modules/contrib/mon.fc policy/modules/contrib/mon.if policy/modules/contrib/mon.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: f5d92d4af9bd6a2688884494681381e08644e698 X-VCS-Branch: master Date: Fri, 17 Feb 2017 08:44:12 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: fe797e13-e57a-4044-a67d-8fa7684a458b X-Archives-Hash: 789dc6039ce9c3376e02bd68b981d050 Message-ID: <20170217084412.X8PNyL2nq6KkZe2ZhJTGIMo2LJcrDzcrkVsskOdpCDk@z> commit: f5d92d4af9bd6a2688884494681381e08644e698 Author: Chris PeBenito ieee org> AuthorDate: Wed Feb 8 22:06:44 2017 +0000 Commit: Jason Zaman gentoo org> CommitDate: Fri Feb 17 08:38:49 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=f5d92d4a mon policy from Russell Coker. policy/modules/contrib/gpm.if | 1 + policy/modules/contrib/gpm.te | 2 +- policy/modules/contrib/mon.fc | 11 +++ policy/modules/contrib/mon.if | 1 + policy/modules/contrib/mon.te | 223 ++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 237 insertions(+), 1 deletion(-) diff --git a/policy/modules/contrib/gpm.if b/policy/modules/contrib/gpm.if index b9a47431..356fb6d1 100644 --- a/policy/modules/contrib/gpm.if +++ b/policy/modules/contrib/gpm.if @@ -38,6 +38,7 @@ interface(`gpm_getattr_gpmctl',` dev_list_all_dev_nodes($1) allow $1 gpmctl_t:sock_file getattr_sock_file_perms; + allow $1 gpmctl_t:fifo_file getattr_fifo_file_perms; ') ######################################## diff --git a/policy/modules/contrib/gpm.te b/policy/modules/contrib/gpm.te index 087ddcef..5cbfa3a6 100644 --- a/policy/modules/contrib/gpm.te +++ b/policy/modules/contrib/gpm.te @@ -1,4 +1,4 @@ -policy_module(gpm, 1.11.0) +policy_module(gpm, 1.11.1) ######################################## # diff --git a/policy/modules/contrib/mon.fc b/policy/modules/contrib/mon.fc new file mode 100644 index 00000000..fa179dd8 --- /dev/null +++ b/policy/modules/contrib/mon.fc @@ -0,0 +1,11 @@ +/usr/lib/mon/mon.d/.* -- gen_context(system_u:object_r:mon_net_test_exec_t,s0) +/usr/lib/mon/mon-local.d/.* -- gen_context(system_u:object_r:mon_local_test_exec_t,s0) +/usr/lib/mon-contrib/mon.d/.* -- gen_context(system_u:object_r:mon_net_test_exec_t,s0) +/usr/lib/mon-contrib/mon-local.d/.* -- gen_context(system_u:object_r:mon_local_test_exec_t,s0) + +/usr/sbin/mon -- gen_context(system_u:object_r:mon_exec_t,s0) + +/var/run/mon(/.*)? gen_context(system_u:object_r:mon_var_run_t,s0) + +/var/lib/mon(/.*)? gen_context(system_u:object_r:mon_var_lib_t,s0) +/var/log/mon(/.*)? gen_context(system_u:object_r:mon_var_log_t,s0) diff --git a/policy/modules/contrib/mon.if b/policy/modules/contrib/mon.if new file mode 100644 index 00000000..d9aee2be --- /dev/null +++ b/policy/modules/contrib/mon.if @@ -0,0 +1 @@ +## mon network monitoring daemon. diff --git a/policy/modules/contrib/mon.te b/policy/modules/contrib/mon.te new file mode 100644 index 00000000..c685ac26 --- /dev/null +++ b/policy/modules/contrib/mon.te @@ -0,0 +1,223 @@ +policy_module(mon, 1.0.0) + +######################################## +# +# Declarations +# + +type mon_t; +type mon_exec_t; +init_daemon_domain(mon_t, mon_exec_t) + +type mon_net_test_t; +typealias mon_net_test_t alias mon_test_t; +type mon_net_test_exec_t; +typealias mon_net_test_exec_t alias mon_test_exec_t; + +domain_type(mon_net_test_t) +domain_entry_file(mon_net_test_t, mon_net_test_exec_t) +role system_r types mon_net_test_t; +domtrans_pattern(mon_t, mon_net_test_exec_t, mon_net_test_t) + +type mon_local_test_t; +type mon_local_test_exec_t; +domain_type(mon_local_test_t) +domain_entry_file(mon_local_test_t, mon_local_test_exec_t) +role system_r types mon_local_test_t; + +type mon_var_run_t; +files_pid_file(mon_var_run_t) + +type mon_var_lib_t; +files_type(mon_var_lib_t) + +type mon_var_log_t; +logging_log_file(mon_var_log_t) + +type mon_tmp_t; +files_tmp_file(mon_tmp_t) + +######################################## +# +# Local policy +# mon_t is for the main mon process and for sending alerts +# + +allow mon_t self:fifo_file rw_fifo_file_perms; +allow mon_t self:tcp_socket create_stream_socket_perms; + +domtrans_pattern(mon_t, mon_local_test_exec_t, mon_local_test_t) + +manage_dirs_pattern(mon_t, mon_tmp_t, mon_tmp_t) +manage_files_pattern(mon_t, mon_tmp_t, mon_tmp_t) +files_tmp_filetrans(mon_t, mon_tmp_t, { file dir }) + +manage_files_pattern(mon_t, mon_var_lib_t, mon_var_lib_t) + +manage_files_pattern(mon_t, mon_var_log_t, mon_var_log_t) + +manage_files_pattern(mon_t, mon_var_run_t, mon_var_run_t) +files_pid_filetrans(mon_t, mon_var_run_t, file) + +kernel_read_kernel_sysctls(mon_t) +kernel_read_network_state(mon_t) +kernel_read_system_state(mon_t) + +corecmd_exec_bin(mon_t) +corecmd_exec_shell(mon_t) + +corenet_tcp_bind_mon_port(mon_t) +corenet_udp_bind_mon_port(mon_t) +corenet_tcp_bind_generic_node(mon_t) +corenet_udp_bind_generic_node(mon_t) +corenet_tcp_connect_jabber_client_port(mon_t) + +dev_read_urand(mon_t) +dev_read_sysfs(mon_t) + +domain_use_interactive_fds(mon_t) + +files_read_etc_files(mon_t) +files_read_etc_runtime_files(mon_t) +files_read_usr_files(mon_t) + +fs_getattr_all_fs(mon_t) +fs_search_auto_mountpoints(mon_t) + +term_dontaudit_search_ptys(mon_t) + +application_signull(mon_t) + +init_read_utmp(mon_t) + +logging_send_syslog_msg(mon_t) +logging_search_logs(mon_t) + +miscfiles_read_localization(mon_t) + +sysnet_dns_name_resolve(mon_t) + +userdom_dontaudit_use_unpriv_user_fds(mon_t) +userdom_dontaudit_search_user_home_dirs(mon_t) + +optional_policy(` + mta_send_mail(mon_t) +') + +######################################## +# +# Local policy +# mon_net_test_t is for running tests that need network access +# + +allow mon_net_test_t self:fifo_file rw_file_perms; + +can_exec(mon_net_test_t, mon_net_test_exec_t) +manage_files_pattern(mon_net_test_t, mon_var_lib_t, mon_var_lib_t) + +kernel_dontaudit_getattr_core_if(mon_net_test_t) +kernel_getattr_proc(mon_net_test_t) +kernel_read_system_state(mon_net_test_t) + +corecmd_exec_bin(mon_net_test_t) +corecmd_exec_shell(mon_net_test_t) + +corenet_tcp_connect_all_ports(mon_net_test_t) +corenet_udp_bind_generic_node(mon_net_test_t) + +dev_dontaudit_getattr_all_chr_files(mon_net_test_t) +dev_getattr_sysfs(mon_net_test_t) +dev_read_sysfs(mon_net_test_t) +dev_read_urand(mon_net_test_t) + +files_read_usr_files(mon_net_test_t) + +fs_getattr_xattr_fs(mon_net_test_t) + +auth_use_nsswitch(mon_net_test_t) + +miscfiles_read_certs(mon_net_test_t) +miscfiles_read_localization(mon_net_test_t) + +netutils_domtrans_ping(mon_net_test_t) + +sysnet_read_config(mon_net_test_t) + +optional_policy(` + bind_read_zone(mon_net_test_t) +') + +######################################## +# +# Local policy +# mon_local_test_t is for running tests that don't need network access +# this domain has much more access to the local system! +# +# try not to use dontaudit rules for this +# + +allow mon_local_test_t self:capability sys_admin; +allow mon_local_test_t self:fifo_file rw_file_perms; + +can_exec(mon_local_test_t, mon_local_test_exec_t) + +manage_files_pattern(mon_local_test_t, mon_var_lib_t, mon_var_lib_t) + +kernel_dontaudit_getattr_core_if(mon_local_test_t) +kernel_getattr_proc(mon_local_test_t) +kernel_read_software_raid_state(mon_local_test_t) +kernel_read_system_state(mon_local_test_t) + +corecmd_exec_bin(mon_local_test_t) +corecmd_exec_shell(mon_local_test_t) + +dev_dontaudit_getattr_all_chr_files(mon_local_test_t) +dev_getattr_sysfs(mon_local_test_t) +dev_read_urand(mon_local_test_t) +dev_read_sysfs(mon_local_test_t) + +domain_read_all_domains_state(mon_local_test_t) + +files_read_usr_files(mon_local_test_t) +files_search_mnt(mon_local_test_t) +files_search_spool(mon_local_test_t) +files_list_boot(mon_local_test_t) + +fs_search_auto_mountpoints(mon_local_test_t) +fs_getattr_nfs(mon_local_test_t) +fs_getattr_xattr_fs(mon_local_test_t) +fs_list_hugetlbfs(mon_local_test_t) +fs_list_tmpfs(mon_local_test_t) +fs_search_nfs(mon_local_test_t) + +storage_getattr_fixed_disk_dev(mon_local_test_t) +storage_getattr_removable_dev(mon_local_test_t) + +term_getattr_generic_ptys(mon_local_test_t) +term_list_ptys(mon_local_test_t) + +application_exec_all(mon_local_test_t) + +auth_use_nsswitch(mon_local_test_t) + +init_getattr_initctl(mon_local_test_t) + +logging_send_syslog_msg(mon_local_test_t) + +miscfiles_read_localization(mon_local_test_t) + +rpc_read_nfs_content(mon_local_test_t) + +sysnet_read_config(mon_local_test_t) + +optional_policy(` + gpm_getattr_gpmctl(mon_local_test_t) +') + +optional_policy(` + postfix_search_spool(mon_local_test_t) +') + +optional_policy(` + xserver_rw_console(mon_local_test_t) +')