[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/roles/

[Sven Vermeulen]

commit:     413bec7b8ff8b290c817a4422e4d4a4bac834b63
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Tue Aug 28 17:27:07 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Aug 28 17:27:07 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=413bec7b

Add in administrative interface(s) for puppet

As the puppet domain has an named init script (puppet_initrc_exec_t and
puppetmaster_initrc_exec_t) we provide administrative interfaces to be used by
the users that need to admin the puppet domains.

Also assign this to the sysadm_t/sysadm_r user for general system administration
support.

---
 policy/modules/contrib/puppet.if |   78 ++++++++++++++++++++++++++++++++++++++
 policy/modules/roles/sysadm.te   |    4 ++
 2 files changed, 82 insertions(+), 0 deletions(-)

diff --git a/policy/modules/contrib/puppet.if b/policy/modules/contrib/puppet.if
index 2855a44..d2e5a12 100644
--- a/policy/modules/contrib/puppet.if
+++ b/policy/modules/contrib/puppet.if
@@ -10,6 +10,84 @@
 
 ################################################
 ## <summary>
+##	All of the rules required to manage a puppet (client) domain
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access
+##	</summary>
+## </param>
+#
+interface(`puppet_admin',`
+	gen_require(`
+		type puppet_t;
+		type puppet_initrc_exec_t;
+		type puppet_etc_t;
+		type puppet_log_t;
+		type puppet_var_run_t;
+	')
+
+	allow $1 puppet_t:process { getattr signal_perms };
+	ps_process_pattern($1, puppet_t)
+
+	init_labeled_script_domtrans($1, puppet_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 puppet_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	files_search_etc($1)
+	admin_pattern($1, puppet_etc_t)
+
+	logging_search_logs($1)
+	admin_pattern($1, puppet_log_t)
+
+	admin_pattern($1, puppet_var_run_t)
+
+	kernel_search_proc($1)
+	allow $1 puppet_t:dir list_dir_perms;
+
+	read_lnk_files_pattern($1, puppet_t, puppet_t)
+')
+
+################################################
+## <summary>
+##	All of the rules required to manage a puppetmaster domain
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access
+##	</summary>
+## </param>
+#
+interface(`puppet_admin_puppetmaster',`
+	gen_require(`
+		type puppetmaster_t;
+		type puppetmaster_initrc_exec_t;
+	')
+
+	allow $1 puppetmaster_t:process { getattr signal_perms };
+	ps_process_pattern($1, puppetmaster_t)
+
+	init_labeled_script_domtrans($1, puppetmaster_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 puppetmaster_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	puppet_admin($1, $2)
+')
+
+################################################
+## <summary>
 ##	Read / Write to Puppet temp files.  Puppet uses
 ##	some system binaries (groupadd, etc) that run in
 ##	a non-puppet domain and redirects output into temp

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index efba839..0a2714b 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -307,6 +307,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	puppet_admin_puppetmaster(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	pyzor_role(sysadm_r, sysadm_t)
 ')