[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     89638269fa556ca96e63141e6fe6eda88b0e74a1
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Sep 24 09:51:20 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Sep 27 17:15:33 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=89638269

Changes to the cobbler policy module

Ported from Fedora with changes

Left out some unsatisfied dependencies

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/cobbler.fc |   34 +++++++++--
 policy/modules/contrib/cobbler.if |   29 +++++----
 policy/modules/contrib/cobbler.te |  125 +++++++++++++++++++++++++++++++------
 policy/modules/contrib/rsync.if   |   49 ++++++++++++++
 policy/modules/contrib/rsync.te   |    2 +-
 policy/modules/contrib/tftp.if    |   83 ++++++++++++++++++++++++
 policy/modules/contrib/tftp.te    |    2 +-
 7 files changed, 286 insertions(+), 38 deletions(-)

diff --git a/policy/modules/contrib/cobbler.fc b/policy/modules/contrib/cobbler.fc
index 1cf6c4e..cbeda66 100644
--- a/policy/modules/contrib/cobbler.fc
+++ b/policy/modules/contrib/cobbler.fc
@@ -1,7 +1,31 @@
-/etc/cobbler(/.*)?		gen_context(system_u:object_r:cobbler_etc_t, s0)
-/etc/rc\.d/init\.d/cobblerd --	gen_context(system_u:object_r:cobblerd_initrc_exec_t, s0)
+/etc/cobbler(/.*)?	gen_context(system_u:object_r:cobbler_etc_t,s0)
 
-/usr/bin/cobblerd	--	gen_context(system_u:object_r:cobblerd_exec_t, s0)
+/etc/rc\.d/init\.d/cobblerd	--	gen_context(system_u:object_r:cobblerd_initrc_exec_t,s0)
 
-/var/lib/cobbler(/.*)?		gen_context(system_u:object_r:cobbler_var_lib_t, s0)
-/var/log/cobbler(/.*)?		gen_context(system_u:object_r:cobbler_var_log_t, s0)
+/usr/bin/cobblerd	--	gen_context(system_u:object_r:cobblerd_exec_t,s0)
+
+/var/lib/cobbler(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+
+/var/lib/tftpboot/etc(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/grub(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/images(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/memdisk	--	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/menu\.c32	--	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/ppc(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/pxelinux\.0	--	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/pxelinux\.cfg(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/s390x(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/yaboot	--	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+
+/var/log/cobbler(/.*)?	gen_context(system_u:object_r:cobbler_var_log_t,s0)
+
+# This should removable when cobbler package installs /var/www/cobbler/rendered
+/var/www/cobbler(/.*)?	gen_context(system_u:object_r:httpd_cobbler_content_t,s0)
+
+/var/www/cobbler/images(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/ks_mirror(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/links(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/localmirror(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/pub(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/rendered(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/repo_mirror(/.*)?	gen_context(system_u:object_r:cobbler_var_lib_t,s0)

diff --git a/policy/modules/contrib/cobbler.if b/policy/modules/contrib/cobbler.if
index 116d60f..f304c68 100644
--- a/policy/modules/contrib/cobbler.if
+++ b/policy/modules/contrib/cobbler.if
@@ -143,8 +143,8 @@ interface(`cobbler_manage_lib_files',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an cobblerd environment
+##	All of the rules required to
+##	administrate an cobblerd environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -161,25 +161,30 @@ interface(`cobbler_manage_lib_files',`
 interface(`cobblerd_admin',`
 	gen_require(`
 		type cobblerd_t, cobbler_var_lib_t, cobbler_var_log_t;
-		type cobbler_etc_t, cobblerd_initrc_exec_t;
+		type cobbler_etc_t, cobblerd_initrc_exec_t, httpd_cobbler_content_t;
+		type httpd_cobbler_content_ra_t, httpd_cobbler_content_rw_t, cobbler_tmp_t;
 	')
 
-	allow $1 cobblerd_t:process { ptrace signal_perms getattr };
-	read_files_pattern($1, cobblerd_t, cobblerd_t)
+	allow $1 cobblerd_t:process { ptrace signal_perms };
+	ps_process_pattern($1, cobblerd_t)
+
+	cobblerd_initrc_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 cobblerd_initrc_exec_t system_r;
+	allow $2 system_r;
 
 	files_search_etc($1)
 	admin_pattern($1, cobbler_etc_t)
 
-	files_list_var_lib($1)
+	files_search_tmp($1)
+	admin_pattern($1, cobbler_tmp_t)
+
+	files_search_var_lib($1)
 	admin_pattern($1, cobbler_var_lib_t)
 
 	logging_search_logs($1)
 	admin_pattern($1, cobbler_var_log_t)
 
-	admin_pattern($1, httpd_cobbler_content_rw_t)
-
-	cobblerd_initrc_domtrans($1)
-	domain_system_change_exemption($1)
-	role_transition $2 cobblerd_initrc_exec_t system_r;
-	allow $2 system_r;
+	apache_search_sys_content($1)
+	admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t httpd_cobbler_content_rw_t })
 ')

diff --git a/policy/modules/contrib/cobbler.te b/policy/modules/contrib/cobbler.te
index 0258b48..948cbcc 100644
--- a/policy/modules/contrib/cobbler.te
+++ b/policy/modules/contrib/cobbler.te
@@ -2,17 +2,43 @@ policy_module(cobbler, 1.1.0)
 
 ########################################
 #
-# Cobbler personal declarations.
+# Declarations
 #
 
+
 ## <desc>
-## <p>
-## Allow Cobbler to modify public files
-## used for public file transfer services.
-## </p>
+##	<p>
+##	Determine whether Cobbler can modify
+##	public files used for public file
+##	transfer services.
+##	</p>
 ## </desc>
 gen_tunable(cobbler_anon_write, false)
 
+## <desc>
+##	<p>
+##	Determine whether Cobbler can connect
+##	to the network using TCP.
+##	</p>
+## </desc>
+gen_tunable(cobbler_can_network_connect, false)
+
+## <desc>
+##	<p>
+##	Determine whether Cobbler can access
+##	cifs file systems.
+##	</p>
+## </desc>
+gen_tunable(cobbler_use_cifs, false)
+
+## <desc>
+##	<p>
+##	Determine whether Cobbler can access
+##	nfs file systems.
+##	</p>
+## </desc>
+gen_tunable(cobbler_use_nfs, false)
+
 type cobblerd_t;
 type cobblerd_exec_t;
 init_daemon_domain(cobblerd_t, cobblerd_exec_t)
@@ -26,25 +52,38 @@ files_config_file(cobbler_etc_t)
 type cobbler_var_log_t;
 logging_log_file(cobbler_var_log_t)
 
-type cobbler_var_lib_t;
+type cobbler_var_lib_t alias cobbler_content_t;
 files_type(cobbler_var_lib_t)
 
+type cobbler_tmp_t;
+files_tmp_file(cobbler_tmp_t)
+
+apache_content_template(cobbler)
+
 ########################################
 #
-# Cobbler personal policy.
+# Local policy
 #
 
-allow cobblerd_t self:capability { chown dac_override fowner sys_nice };
+allow cobblerd_t self:capability { chown dac_override fowner fsetid sys_nice };
+dontaudit cobblerd_t self:capability sys_tty_config;
 allow cobblerd_t self:process { getsched setsched signal };
 allow cobblerd_t self:fifo_file rw_fifo_file_perms;
+allow cobblerd_t self:netlink_route_socket create_netlink_socket_perms;
 allow cobblerd_t self:tcp_socket create_stream_socket_perms;
+allow cobblerd_t self:udp_socket create_socket_perms;
 
 list_dirs_pattern(cobblerd_t, cobbler_etc_t, cobbler_etc_t)
 read_files_pattern(cobblerd_t, cobbler_etc_t, cobbler_etc_t)
 
+manage_dirs_pattern(cobblerd_t, cobbler_tmp_t, cobbler_tmp_t)
+manage_files_pattern(cobblerd_t, cobbler_tmp_t, cobbler_tmp_t)
+files_tmp_filetrans(cobblerd_t, cobbler_tmp_t, { dir file })
+
 manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
 manage_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
-files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, { dir file })
+manage_lnk_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
+files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, dir)
 
 append_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
 create_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
@@ -53,26 +92,45 @@ setattr_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
 logging_log_filetrans(cobblerd_t, cobbler_var_log_t, file)
 
 kernel_read_system_state(cobblerd_t)
+kernel_dontaudit_search_network_state(cobblerd_t)
 
 corecmd_exec_bin(cobblerd_t)
 corecmd_exec_shell(cobblerd_t)
 
 corenet_all_recvfrom_netlabel(cobblerd_t)
 corenet_all_recvfrom_unlabeled(cobblerd_t)
-corenet_sendrecv_cobbler_server_packets(cobblerd_t)
-corenet_tcp_bind_cobbler_port(cobblerd_t)
-corenet_tcp_bind_generic_node(cobblerd_t)
 corenet_tcp_sendrecv_generic_if(cobblerd_t)
 corenet_tcp_sendrecv_generic_node(cobblerd_t)
-corenet_tcp_sendrecv_generic_port(cobblerd_t)
+corenet_tcp_bind_generic_node(cobblerd_t)
+
+corenet_sendrecv_cobbler_server_packets(cobblerd_t)
+corenet_tcp_bind_cobbler_port(cobblerd_t)
+corenet_tcp_sendrecv_cobbler_port(cobblerd_t)
+
+corenet_sendrecv_ftp_client_packets(cobblerd_t)
+corenet_tcp_connect_ftp_port(cobblerd_t)
+corenet_tcp_sendrecv_ftp_port(cobblerd_t)
+
+corenet_tcp_sendrecv_http_port(cobblerd_t)
+corenet_tcp_connect_http_port(cobblerd_t)
+corenet_sendrecv_http_client_packets(cobblerd_t)
 
 dev_read_urand(cobblerd_t)
 
-files_read_usr_files(cobblerd_t)
 files_list_boot(cobblerd_t)
 files_list_tmp(cobblerd_t)
-# read /etc/nsswitch.conf
+files_read_boot_files(cobblerd_t)
 files_read_etc_files(cobblerd_t)
+files_read_etc_runtime_files(cobblerd_t)
+files_read_usr_files(cobblerd_t)
+
+fs_read_iso9660_files(cobblerd_t)
+
+selinux_get_enforce_mode(cobblerd_t)
+
+term_use_console(cobblerd_t)
+
+logging_send_syslog_msg(cobblerd_t)
 
 miscfiles_read_localization(cobblerd_t)
 miscfiles_read_public_files(cobblerd_t)
@@ -85,6 +143,28 @@ tunable_policy(`cobbler_anon_write',`
 	miscfiles_manage_public_files(cobblerd_t)
 ')
 
+tunable_policy(`cobbler_can_network_connect',`
+	corenet_sendrecv_all_client_packets(cobblerd_t)
+	corenet_tcp_connect_all_ports(cobblerd_t)
+	corenet_tcp_sendrecv_all_ports(cobblerd_t)
+')
+
+tunable_policy(`cobbler_use_cifs',`
+	fs_manage_cifs_dirs(cobblerd_t)
+	fs_manage_cifs_files(cobblerd_t)
+	fs_manage_cifs_symlinks(cobblerd_t)
+')
+
+tunable_policy(`cobbler_use_nfs',`
+	fs_manage_nfs_dirs(cobblerd_t)
+	fs_manage_nfs_files(cobblerd_t)
+	fs_manage_nfs_symlinks(cobblerd_t)
+')
+
+optional_policy(`
+	apache_search_sys_content(cobblerd_t)
+')
+
 optional_policy(`
 	bind_read_config(cobblerd_t)
 	bind_write_config(cobblerd_t)
@@ -95,6 +175,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	certmaster_exec(cobblerd_t)
+')
+
+optional_policy(`
 	dhcpd_domtrans(cobblerd_t)
 	dhcpd_initrc_domtrans(cobblerd_t)
 ')
@@ -111,18 +195,21 @@ optional_policy(`
 
 optional_policy(`
 	rsync_read_config(cobblerd_t)
-	rsync_write_config(cobblerd_t)
+	rsync_manage_config_files(cobblerd_t)
+	rsync_etc_filetrans_config(cobblerd_t, file, "rsync.conf")
 ')
 
 optional_policy(`
-	tftp_manage_rw_content(cobblerd_t)
+	tftp_manage_config_files(cobblerd_t)
+	tftp_etc_filetrans_config(cobblerd_t, file, "tftp")
+	tftp_filetrans_tftpdir(cobblerd_t, cobbler_var_lib_t, { dir file })
 ')
 
 ########################################
 #
-# Cobbler web local policy.
+# Web local policy
 #
 
-apache_content_template(cobbler)
+list_dirs_pattern(cobblerd_t, httpd_cobbler_content_t, httpd_cobbler_content_t)
 manage_dirs_pattern(cobblerd_t, httpd_cobbler_content_rw_t, httpd_cobbler_content_rw_t)
 manage_files_pattern(cobblerd_t, httpd_cobbler_content_rw_t, httpd_cobbler_content_rw_t)

diff --git a/policy/modules/contrib/rsync.if b/policy/modules/contrib/rsync.if
index 3386f29..a580523 100644
--- a/policy/modules/contrib/rsync.if
+++ b/policy/modules/contrib/rsync.if
@@ -141,3 +141,52 @@ interface(`rsync_write_config',`
 	allow $1 rsync_etc_t:file read_file_perms;
 	files_search_etc($1)
 ')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	rsync config files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`rsync_manage_config_files',`
+	gen_require(`
+		type rsync_etc_t;
+	')
+
+	manage_files_pattern($1, rsync_etc_t, rsync_etc_t)
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
+##	Create objects in etc directories
+##	with rsync etc type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`rsync_etc_filetrans_config',`
+	gen_require(`
+		type rsync_etc_t;
+	')
+
+	files_etc_filetrans($1, rsync_etc_t, $2, $3)
+')

diff --git a/policy/modules/contrib/rsync.te b/policy/modules/contrib/rsync.te
index 2834d86..d5e469e 100644
--- a/policy/modules/contrib/rsync.te
+++ b/policy/modules/contrib/rsync.te
@@ -1,4 +1,4 @@
-policy_module(rsync, 1.12.0)
+policy_module(rsync, 1.12.1)
 
 ########################################
 #

diff --git a/policy/modules/contrib/tftp.if b/policy/modules/contrib/tftp.if
index 38bb312..29b1bd9 100644
--- a/policy/modules/contrib/tftp.if
+++ b/policy/modules/contrib/tftp.if
@@ -40,6 +40,89 @@ interface(`tftp_manage_rw_content',`
 
 ########################################
 ## <summary>
+##	Manage tftp config files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`tftp_manage_config_files',`
+	gen_require(`
+		type tftpd_etc_t;
+	')
+
+	files_search_etc($1)
+ 	manage_files_pattern($1, tftpd_etc_t, tftpd_etc_t)
+')
+
+########################################
+## <summary>
+##	Create objects in etc directories
+##	with tftp etc type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`tftp_etc_filetrans_config',`
+	gen_require(`
+		type tftp_etc_t;
+	')
+
+	files_etc_filetrans($1, tftp_etc_t, $2, $3)
+')
+
+########################################
+## <summary>
+##	Create objects in tftpdir directories
+##	with a private type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="private_type">
+##	<summary>
+##	Private file type.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`tftp_filetrans_tftpdir',`
+	gen_require(`
+		type tftpdir_rw_t;
+	')
+
+	files_search_var_lib($1)
+	filetrans_pattern($1, tftpdir_rw_t, $2, $3, $4)
+')
+
+########################################
+## <summary>
 ##	All of the rules required to administrate
 ##	an tftp environment
 ## </summary>

diff --git a/policy/modules/contrib/tftp.te b/policy/modules/contrib/tftp.te
index d50c10d..2fa2133 100644
--- a/policy/modules/contrib/tftp.te
+++ b/policy/modules/contrib/tftp.te
@@ -1,4 +1,4 @@
-policy_module(tftp, 1.12.0)
+policy_module(tftp, 1.12.1)
 
 ########################################
 #