[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     803076cd0dc344f6d04b6509508fcfd9f7de80f5
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct  1 07:27:01 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct  2 18:05:40 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=803076cd

Changes to the fail2ban policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/fail2ban.fc |   11 +++--
 policy/modules/contrib/fail2ban.if |   85 +++++++++++++++++++++++++++++------
 policy/modules/contrib/fail2ban.te |   74 ++++++++++++++++++++++++-------
 3 files changed, 133 insertions(+), 37 deletions(-)

diff --git a/policy/modules/contrib/fail2ban.fc b/policy/modules/contrib/fail2ban.fc
index 0de2b83..4da938f 100644
--- a/policy/modules/contrib/fail2ban.fc
+++ b/policy/modules/contrib/fail2ban.fc
@@ -1,8 +1,9 @@
-/etc/rc\.d/init\.d/fail2ban --	gen_context(system_u:object_r:fail2ban_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/fail2ban	--	gen_context(system_u:object_r:fail2ban_initrc_exec_t,s0)
 
 /usr/bin/fail2ban	--	gen_context(system_u:object_r:fail2ban_exec_t,s0)
-/usr/bin/fail2ban-server --	gen_context(system_u:object_r:fail2ban_exec_t,s0)
+/usr/bin/fail2ban-client	--	gen_context(system_u:object_r:fail2ban_client_exec_t,s0)
+/usr/bin/fail2ban-server	--	gen_context(system_u:object_r:fail2ban_exec_t,s0)
 
-/var/lib/fail2ban(/.*)?		gen_context(system_u:object_r:fail2ban_var_lib_t,s0)
-/var/log/fail2ban\.log	--	gen_context(system_u:object_r:fail2ban_log_t,s0)
-/var/run/fail2ban.*		gen_context(system_u:object_r:fail2ban_var_run_t,s0)
+/var/lib/fail2ban(/.*)?	gen_context(system_u:object_r:fail2ban_var_lib_t,s0)
+/var/log/fail2ban\.log.*	--	gen_context(system_u:object_r:fail2ban_log_t,s0)
+/var/run/fail2ban.*	gen_context(system_u:object_r:fail2ban_var_run_t,s0)

diff --git a/policy/modules/contrib/fail2ban.if b/policy/modules/contrib/fail2ban.if
index f590a1f..a2f8aa2 100644
--- a/policy/modules/contrib/fail2ban.if
+++ b/policy/modules/contrib/fail2ban.if
@@ -15,13 +15,61 @@ interface(`fail2ban_domtrans',`
 		type fail2ban_t, fail2ban_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, fail2ban_exec_t, fail2ban_t)
 ')
 
+########################################
+## <summary>
+##	Execute the fail2ban client in
+##	the fail2ban client domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`fail2ban_domtrans_client',`
+	gen_require(`
+		type fail2ban_client_t, fail2ban_client_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, fail2ban_client_exec_t, fail2ban_client_t)
+')
+
+########################################
+## <summary>
+##	Execute fail2ban client in the
+##	fail2ban client domain, and allow
+##	the specified role the fail2ban
+##	client domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`fail2ban_run_client',`
+	gen_require(`
+		attribute_role fail2ban_client_roles;
+	')
+
+	fail2ban_domtrans_client($1)
+	roleattribute $2 fail2ban_client_roles;
+')
+
 #####################################
 ## <summary>
-##	Connect to fail2ban over a unix domain
-##	stream socket.
+##	Connect to fail2ban over a
+##	unix domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -40,7 +88,8 @@ interface(`fail2ban_stream_connect',`
 
 ########################################
 ## <summary>
-##	Read and write to an fail2ban unix stream socket.
+##	Read and write fail2ban unix
+##	stream sockets.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -77,7 +126,7 @@ interface(`fail2ban_read_lib_files',`
 
 ########################################
 ## <summary>
-##	Allow the specified domain to read fail2ban's log files.
+##	Read fail2ban log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -92,14 +141,12 @@ interface(`fail2ban_read_log',`
 	')
 
 	logging_search_logs($1)
-	allow $1 fail2ban_log_t:dir list_dir_perms;
 	allow $1 fail2ban_log_t:file read_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	Allow the specified domain to append
-##	fail2ban log files.
+##	Append fail2ban log files.
 ## </summary>
 ## <param name="domain">
 ## 	<summary>
@@ -113,13 +160,12 @@ interface(`fail2ban_append_log',`
 	')
 
 	logging_search_logs($1)
-	allow $1 fail2ban_log_t:dir list_dir_perms;
 	allow $1 fail2ban_log_t:file append_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	Read fail2ban PID files.
+##	Read fail2ban pid files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -138,8 +184,8 @@ interface(`fail2ban_read_pid_files',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate 
-##	an fail2ban environment
+##	All of the rules required to
+##	administrate an fail2ban environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -148,19 +194,20 @@ interface(`fail2ban_read_pid_files',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to be allowed to manage the fail2ban domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>
 #
 interface(`fail2ban_admin',`
 	gen_require(`
-		type fail2ban_t, fail2ban_log_t;
+		type fail2ban_t, fail2ban_log_t, fail2ban_tmp_t;
 		type fail2ban_var_run_t, fail2ban_initrc_exec_t;
+		type fail2ban_var_lib_t, fail2ban_client_t;
 	')
 
-	allow $1 fail2ban_t:process { ptrace signal_perms };
-	ps_process_pattern($1, fail2ban_t)
+	allow $1 { fail2ban_t fail2ban_client_t }:process { ptrace signal_perms };
+	ps_process_pattern($1, { fail2ban_t fail2ban_client_t })
 
 	init_labeled_script_domtrans($1, fail2ban_initrc_exec_t)
 	domain_system_change_exemption($1)
@@ -172,4 +219,12 @@ interface(`fail2ban_admin',`
 
 	files_list_pids($1)
 	admin_pattern($1, fail2ban_var_run_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, fail2ban_var_lib_t)
+
+	files_search_tmp($1)
+	admin_pattern($1, fail2ban_tmp_t)
+
+	fail2ban_run_client($1, $2)
 ')

diff --git a/policy/modules/contrib/fail2ban.te b/policy/modules/contrib/fail2ban.te
index 4cdbca5..b498e66 100644
--- a/policy/modules/contrib/fail2ban.te
+++ b/policy/modules/contrib/fail2ban.te
@@ -1,10 +1,12 @@
-policy_module(fail2ban, 1.4.0)
+policy_module(fail2ban, 1.4.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role fail2ban_client_roles;
+
 type fail2ban_t;
 type fail2ban_exec_t;
 init_daemon_domain(fail2ban_t, fail2ban_exec_t)
@@ -12,43 +14,51 @@ init_daemon_domain(fail2ban_t, fail2ban_exec_t)
 type fail2ban_initrc_exec_t;
 init_script_file(fail2ban_initrc_exec_t)
 
-# log files
 type fail2ban_log_t;
 logging_log_file(fail2ban_log_t)
 
 type fail2ban_var_lib_t;
 files_type(fail2ban_var_lib_t)
 
-# pid files
 type fail2ban_var_run_t;
 files_pid_file(fail2ban_var_run_t)
 
+type fail2ban_tmp_t;
+files_tmp_file(fail2ban_tmp_t)
+
+type fail2ban_client_t;
+type fail2ban_client_exec_t;
+init_system_domain(fail2ban_client_t, fail2ban_client_exec_t)
+role fail2ban_client_roles types fail2ban_client_t;
+
 ########################################
 #
-# fail2ban local policy
+# Server Local policy
 #
 
-allow fail2ban_t self:capability { sys_tty_config };
+allow fail2ban_t self:capability { dac_read_search dac_override sys_tty_config };
 allow fail2ban_t self:process signal;
 allow fail2ban_t self:fifo_file rw_fifo_file_perms;
-allow fail2ban_t self:unix_stream_socket { connectto create_stream_socket_perms };
-allow fail2ban_t self:unix_dgram_socket create_socket_perms;
-allow fail2ban_t self:tcp_socket create_stream_socket_perms;
+allow fail2ban_t self:unix_stream_socket { accept connectto listen };
+allow fail2ban_t self:tcp_socket { accept listen };
 
-# log files
-allow fail2ban_t fail2ban_log_t:dir setattr;
-manage_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t)
+append_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t)
+create_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t)
+setattr_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t)
 logging_log_filetrans(fail2ban_t, fail2ban_log_t, file)
 
+manage_dirs_pattern(fail2ban_t, fail2ban_tmp_t, fail2ban_tmp_t)
+manage_files_pattern(fail2ban_t, fail2ban_tmp_t, fail2ban_tmp_t)
+exec_files_pattern(fail2ban_t, fail2ban_tmp_t, fail2ban_tmp_t)
+files_tmp_filetrans(fail2ban_t, fail2ban_tmp_t, { dir file })
+
 manage_dirs_pattern(fail2ban_t, fail2ban_var_lib_t, fail2ban_var_lib_t)
 manage_files_pattern(fail2ban_t, fail2ban_var_lib_t, fail2ban_var_lib_t)
-files_var_lib_filetrans(fail2ban_t, fail2ban_var_lib_t, { dir file })
 
-# pid file
 manage_dirs_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
 manage_sock_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
 manage_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
-files_pid_filetrans(fail2ban_t, fail2ban_var_run_t, { dir file sock_file })
+files_pid_filetrans(fail2ban_t, fail2ban_var_run_t, file)
 
 # FAM support needs this (/proc/self and parent stuff)
 read_files_pattern(fail2ban_t, fail2ban_t, fail2ban_t)
@@ -62,15 +72,16 @@ corenet_all_recvfrom_unlabeled(fail2ban_t)
 corenet_all_recvfrom_netlabel(fail2ban_t)
 corenet_tcp_sendrecv_generic_if(fail2ban_t)
 corenet_tcp_sendrecv_generic_node(fail2ban_t)
-corenet_tcp_sendrecv_all_ports(fail2ban_t)
-corenet_tcp_connect_whois_port(fail2ban_t)
+
 corenet_sendrecv_whois_client_packets(fail2ban_t)
+corenet_tcp_connect_whois_port(fail2ban_t)
+corenet_tcp_sendrecv_whois_port(fail2ban_t)
 
 dev_read_urand(fail2ban_t)
 
 domain_use_interactive_fds(fail2ban_t)
+domain_dontaudit_read_all_domains_state(fail2ban_t)
 
-files_read_etc_files(fail2ban_t)
 files_read_etc_runtime_files(fail2ban_t)
 files_read_usr_files(fail2ban_t)
 files_list_var(fail2ban_t)
@@ -87,6 +98,8 @@ logging_send_syslog_msg(fail2ban_t)
 
 miscfiles_read_localization(fail2ban_t)
 
+sysnet_manage_config(fail2ban_t)
+
 mta_send_mail(fail2ban_t)
 
 optional_policy(`
@@ -100,3 +113,30 @@ optional_policy(`
 optional_policy(`
 	iptables_domtrans(fail2ban_t)
 ')
+
+optional_policy(`
+	libs_exec_ldconfig(fail2ban_t)
+')
+
+optional_policy(`
+	shorewall_domtrans(fail2ban_t)
+')
+
+########################################
+#
+# Client Local policy
+#
+
+domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t)
+
+stream_connect_pattern(fail2ban_client_t, fail2ban_var_run_t, fail2ban_var_run_t, fail2ban_t)
+
+kernel_read_system_state(fail2ban_client_t)
+
+corecmd_exec_bin(fail2ban_client_t)
+
+files_read_etc_files(fail2ban_client_t)
+files_read_usr_files(fail2ban_client_t)
+files_search_pids(fail2ban_client_t)
+
+miscfiles_read_localization(fail2ban_client_t)