1 |
commit: 5d6a23fe60fd1230b2559ed8b75538c9d2613769 |
2 |
Author: Jason Zaman <jason <AT> perfinion <DOT> com> |
3 |
AuthorDate: Thu Nov 2 17:31:19 2017 +0000 |
4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Nov 5 06:40:35 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=5d6a23fe |
7 |
|
8 |
gssproxy: add policy |
9 |
|
10 |
borrowed and modified from Fedora |
11 |
|
12 |
policy/modules/contrib/gssproxy.fc | 8 ++ |
13 |
policy/modules/contrib/gssproxy.if | 168 +++++++++++++++++++++++++++++++++++++ |
14 |
policy/modules/contrib/gssproxy.te | 66 +++++++++++++++ |
15 |
3 files changed, 242 insertions(+) |
16 |
|
17 |
diff --git a/policy/modules/contrib/gssproxy.fc b/policy/modules/contrib/gssproxy.fc |
18 |
new file mode 100644 |
19 |
index 00000000..a9970159 |
20 |
--- /dev/null |
21 |
+++ b/policy/modules/contrib/gssproxy.fc |
22 |
@@ -0,0 +1,8 @@ |
23 |
+/usr/lib/systemd/system/gssproxy.service -- gen_context(system_u:object_r:gssproxy_unit_t,s0) |
24 |
+ |
25 |
+/usr/sbin/gssproxy -- gen_context(system_u:object_r:gssproxy_exec_t,s0) |
26 |
+ |
27 |
+/var/lib/gssproxy(/.*)? gen_context(system_u:object_r:gssproxy_var_lib_t,s0) |
28 |
+ |
29 |
+/run/gssproxy\.pid -- gen_context(system_u:object_r:gssproxy_run_t,s0) |
30 |
+/run/gssproxy\.sock -s gen_context(system_u:object_r:gssproxy_run_t,s0) |
31 |
|
32 |
diff --git a/policy/modules/contrib/gssproxy.if b/policy/modules/contrib/gssproxy.if |
33 |
new file mode 100644 |
34 |
index 00000000..1f8a4461 |
35 |
--- /dev/null |
36 |
+++ b/policy/modules/contrib/gssproxy.if |
37 |
@@ -0,0 +1,168 @@ |
38 |
+## <summary>policy for gssproxy - daemon to proxy GSSAPI context establishment and channel handling</summary> |
39 |
+ |
40 |
+######################################## |
41 |
+## <summary> |
42 |
+## Execute gssproxy in the gssproxy domin. |
43 |
+## </summary> |
44 |
+## <param name="domain"> |
45 |
+## <summary> |
46 |
+## Domain allowed to transition. |
47 |
+## </summary> |
48 |
+## </param> |
49 |
+# |
50 |
+interface(`gssproxy_domtrans',` |
51 |
+ gen_require(` |
52 |
+ type gssproxy_t, gssproxy_exec_t; |
53 |
+ ') |
54 |
+ |
55 |
+ corecmd_search_bin($1) |
56 |
+ domtrans_pattern($1, gssproxy_exec_t, gssproxy_t) |
57 |
+') |
58 |
+ |
59 |
+######################################## |
60 |
+## <summary> |
61 |
+## Search gssproxy lib directories. |
62 |
+## </summary> |
63 |
+## <param name="domain"> |
64 |
+## <summary> |
65 |
+## Domain allowed access. |
66 |
+## </summary> |
67 |
+## </param> |
68 |
+# |
69 |
+interface(`gssproxy_search_lib',` |
70 |
+ gen_require(` |
71 |
+ type gssproxy_var_lib_t; |
72 |
+ ') |
73 |
+ |
74 |
+ allow $1 gssproxy_var_lib_t:dir search_dir_perms; |
75 |
+ files_search_var_lib($1) |
76 |
+') |
77 |
+ |
78 |
+######################################## |
79 |
+## <summary> |
80 |
+## Read gssproxy lib files. |
81 |
+## </summary> |
82 |
+## <param name="domain"> |
83 |
+## <summary> |
84 |
+## Domain allowed access. |
85 |
+## </summary> |
86 |
+## </param> |
87 |
+# |
88 |
+interface(`gssproxy_read_lib_files',` |
89 |
+ gen_require(` |
90 |
+ type gssproxy_var_lib_t; |
91 |
+ ') |
92 |
+ |
93 |
+ files_search_var_lib($1) |
94 |
+ read_files_pattern($1, gssproxy_var_lib_t, gssproxy_var_lib_t) |
95 |
+') |
96 |
+ |
97 |
+######################################## |
98 |
+## <summary> |
99 |
+## Manage gssproxy lib files. |
100 |
+## </summary> |
101 |
+## <param name="domain"> |
102 |
+## <summary> |
103 |
+## Domain allowed access. |
104 |
+## </summary> |
105 |
+## </param> |
106 |
+# |
107 |
+interface(`gssproxy_manage_lib_files',` |
108 |
+ gen_require(` |
109 |
+ type gssproxy_var_lib_t; |
110 |
+ ') |
111 |
+ |
112 |
+ files_search_var_lib($1) |
113 |
+ manage_files_pattern($1, gssproxy_var_lib_t, gssproxy_var_lib_t) |
114 |
+') |
115 |
+ |
116 |
+######################################## |
117 |
+## <summary> |
118 |
+## Manage gssproxy lib directories. |
119 |
+## </summary> |
120 |
+## <param name="domain"> |
121 |
+## <summary> |
122 |
+## Domain allowed access. |
123 |
+## </summary> |
124 |
+## </param> |
125 |
+# |
126 |
+interface(`gssproxy_manage_lib_dirs',` |
127 |
+ gen_require(` |
128 |
+ type gssproxy_var_lib_t; |
129 |
+ ') |
130 |
+ |
131 |
+ files_search_var_lib($1) |
132 |
+ manage_dirs_pattern($1, gssproxy_var_lib_t, gssproxy_var_lib_t) |
133 |
+') |
134 |
+ |
135 |
+######################################## |
136 |
+## <summary> |
137 |
+## Read gssproxy PID files. |
138 |
+## </summary> |
139 |
+## <param name="domain"> |
140 |
+## <summary> |
141 |
+## Domain allowed access. |
142 |
+## </summary> |
143 |
+## </param> |
144 |
+# |
145 |
+interface(`gssproxy_read_pid_files',` |
146 |
+ gen_require(` |
147 |
+ type gssproxy_run_t; |
148 |
+ ') |
149 |
+ |
150 |
+ files_search_pids($1) |
151 |
+ read_files_pattern($1, gssproxy_run_t, gssproxy_run_t) |
152 |
+') |
153 |
+ |
154 |
+######################################## |
155 |
+## <summary> |
156 |
+## Connect to gssproxy over an unix |
157 |
+## domain stream socket. |
158 |
+## </summary> |
159 |
+## <param name="domain"> |
160 |
+## <summary> |
161 |
+## Domain allowed access. |
162 |
+## </summary> |
163 |
+## </param> |
164 |
+# |
165 |
+interface(`gssproxy_stream_connect',` |
166 |
+ gen_require(` |
167 |
+ type gssproxy_t, gssproxy_run_t, gssproxy_var_lib_t; |
168 |
+ ') |
169 |
+ |
170 |
+ files_search_pids($1) |
171 |
+ stream_connect_pattern($1, gssproxy_run_t, gssproxy_run_t, gssproxy_t) |
172 |
+ stream_connect_pattern($1, gssproxy_var_lib_t, gssproxy_var_lib_t, gssproxy_t) |
173 |
+') |
174 |
+ |
175 |
+######################################## |
176 |
+## <summary> |
177 |
+## All of the rules required to administrate |
178 |
+## an gssproxy environment |
179 |
+## </summary> |
180 |
+## <param name="domain"> |
181 |
+## <summary> |
182 |
+## Domain allowed access. |
183 |
+## </summary> |
184 |
+## </param> |
185 |
+## <rolecap/> |
186 |
+# |
187 |
+interface(`gssproxy_admin',` |
188 |
+ gen_require(` |
189 |
+ type gssproxy_t; |
190 |
+ type gssproxy_var_lib_t; |
191 |
+ type gssproxy_run_t; |
192 |
+ type gssproxy_unit_t; |
193 |
+ ') |
194 |
+ |
195 |
+ allow $1 gssproxy_t:process { ptrace signal_perms }; |
196 |
+ ps_process_pattern($1, gssproxy_t) |
197 |
+ |
198 |
+ files_search_var_lib($1) |
199 |
+ admin_pattern($1, gssproxy_var_lib_t) |
200 |
+ |
201 |
+ files_search_pids($1) |
202 |
+ admin_pattern($1, gssproxy_run_t) |
203 |
+ |
204 |
+ admin_pattern($1, gssproxy_unit_t) |
205 |
+') |
206 |
|
207 |
diff --git a/policy/modules/contrib/gssproxy.te b/policy/modules/contrib/gssproxy.te |
208 |
new file mode 100644 |
209 |
index 00000000..c1dcc556 |
210 |
--- /dev/null |
211 |
+++ b/policy/modules/contrib/gssproxy.te |
212 |
@@ -0,0 +1,66 @@ |
213 |
+policy_module(gssproxy, 1.0.0) |
214 |
+ |
215 |
+######################################## |
216 |
+# |
217 |
+# Declarations |
218 |
+# |
219 |
+ |
220 |
+type gssproxy_t; |
221 |
+type gssproxy_exec_t; |
222 |
+init_daemon_domain(gssproxy_t, gssproxy_exec_t) |
223 |
+ |
224 |
+type gssproxy_var_lib_t; |
225 |
+files_type(gssproxy_var_lib_t) |
226 |
+ |
227 |
+type gssproxy_run_t; |
228 |
+files_pid_file(gssproxy_run_t) |
229 |
+ |
230 |
+type gssproxy_unit_t; |
231 |
+init_unit_file(gssproxy_unit_t) |
232 |
+ |
233 |
+######################################## |
234 |
+# |
235 |
+# gssproxy local policy |
236 |
+# |
237 |
+allow gssproxy_t self:capability { setuid setgid }; |
238 |
+allow gssproxy_t self:capability2 block_suspend; |
239 |
+allow gssproxy_t self:fifo_file rw_fifo_file_perms; |
240 |
+allow gssproxy_t self:unix_stream_socket create_stream_socket_perms; |
241 |
+ |
242 |
+manage_dirs_pattern(gssproxy_t, gssproxy_var_lib_t, gssproxy_var_lib_t) |
243 |
+manage_files_pattern(gssproxy_t, gssproxy_var_lib_t, gssproxy_var_lib_t) |
244 |
+manage_sock_files_pattern(gssproxy_t, gssproxy_var_lib_t, gssproxy_var_lib_t) |
245 |
+manage_lnk_files_pattern(gssproxy_t, gssproxy_var_lib_t, gssproxy_var_lib_t) |
246 |
+files_var_lib_filetrans(gssproxy_t, gssproxy_var_lib_t, { dir file lnk_file }) |
247 |
+ |
248 |
+manage_dirs_pattern(gssproxy_t, gssproxy_run_t, gssproxy_run_t) |
249 |
+manage_files_pattern(gssproxy_t, gssproxy_run_t, gssproxy_run_t) |
250 |
+manage_sock_files_pattern(gssproxy_t, gssproxy_run_t, gssproxy_run_t) |
251 |
+manage_lnk_files_pattern(gssproxy_t, gssproxy_run_t, gssproxy_run_t) |
252 |
+files_pid_filetrans(gssproxy_t, gssproxy_run_t, { dir file lnk_file sock_file }) |
253 |
+ |
254 |
+kernel_rw_rpc_sysctls(gssproxy_t) |
255 |
+ |
256 |
+domain_use_interactive_fds(gssproxy_t) |
257 |
+ |
258 |
+files_read_etc_files(gssproxy_t) |
259 |
+ |
260 |
+fs_getattr_all_fs(gssproxy_t) |
261 |
+ |
262 |
+auth_use_nsswitch(gssproxy_t) |
263 |
+ |
264 |
+dev_read_urand(gssproxy_t) |
265 |
+ |
266 |
+logging_send_syslog_msg(gssproxy_t) |
267 |
+ |
268 |
+miscfiles_read_localization(gssproxy_t) |
269 |
+ |
270 |
+userdom_read_all_users_keys(gssproxy_t) |
271 |
+userdom_manage_user_tmp_dirs(gssproxy_t) |
272 |
+userdom_manage_user_tmp_files(gssproxy_t) |
273 |
+ |
274 |
+optional_policy(` |
275 |
+ kerberos_manage_host_rcache(gssproxy_t) |
276 |
+ kerberos_read_keytab(gssproxy_t) |
277 |
+ kerberos_use(gssproxy_t) |
278 |
+') |