[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     adc98ed46f3758c57f03ed69da0a8c08eb674060
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sun Oct 28 16:31:47 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sun Oct 28 17:58:56 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=adc98ed4

Changes to the snmp policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/snmp.fc |   18 ++++--------
 policy/modules/contrib/snmp.if |   35 ++++++++++++----------
 policy/modules/contrib/snmp.te |   61 +++++++++++++++++++++++----------------
 3 files changed, 61 insertions(+), 53 deletions(-)

diff --git a/policy/modules/contrib/snmp.fc b/policy/modules/contrib/snmp.fc
index cbe31d2..c73fa24 100644
--- a/policy/modules/contrib/snmp.fc
+++ b/policy/modules/contrib/snmp.fc
@@ -1,24 +1,18 @@
-/etc/rc\.d/init\.d/snmpd	--	gen_context(system_u:object_r:snmpd_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/snmptrapd	--	gen_context(system_u:object_r:snmpd_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/((snmpd)|(snmptrapd))	--	gen_context(system_u:object_r:snmpd_initrc_exec_t,s0)
 
-#
-# /usr
-#
-/usr/sbin/snmp(trap)?d	--	gen_context(system_u:object_r:snmpd_exec_t,s0)
+/usr/sbin/snmptrap	--	gen_context(system_u:object_r:snmpd_exec_t,s0)
+/usr/sbin/snmptrapd	--	gen_context(system_u:object_r:snmpd_exec_t,s0)
 
 /usr/share/snmp/mibs/\.index	--	gen_context(system_u:object_r:snmpd_var_lib_t,s0)
 
-#
-# /var
-#
 /var/agentx(/.*)?	gen_context(system_u:object_r:snmpd_var_lib_t,s0)
+/var/net-snmp(/.*)	gen_context(system_u:object_r:snmpd_var_lib_t,s0)
 
 /var/lib/net-snmp(/.*)?	gen_context(system_u:object_r:snmpd_var_lib_t,s0)
 /var/lib/snmp(/.*)?	gen_context(system_u:object_r:snmpd_var_lib_t,s0)
 
-/var/log/snmpd\.log	--	gen_context(system_u:object_r:snmpd_log_t,s0)
-
-/var/net-snmp(/.*)	gen_context(system_u:object_r:snmpd_var_lib_t,s0)
+/var/log/snmpd\.log.*	--	gen_context(system_u:object_r:snmpd_log_t,s0)
 
+/var/run/net-snmpd(/.*)?	gen_context(system_u:object_r:snmpd_var_run_t,s0)
 /var/run/snmpd(/.*)?	gen_context(system_u:object_r:snmpd_var_run_t,s0)
 /var/run/snmpd\.pid	--	gen_context(system_u:object_r:snmpd_var_run_t,s0)

diff --git a/policy/modules/contrib/snmp.if b/policy/modules/contrib/snmp.if
index d057046..7a9cc9d 100644
--- a/policy/modules/contrib/snmp.if
+++ b/policy/modules/contrib/snmp.if
@@ -1,8 +1,9 @@
-## <summary>Simple network management protocol services</summary>
+## <summary>Simple network management protocol services.</summary>
 
 ########################################
 ## <summary>
-##	Connect to snmpd using a unix domain stream socket.
+##	Connect to snmpd with a unix
+##	domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -11,12 +12,12 @@
 ## </param>
 #
 interface(`snmp_stream_connect',`
-	 gen_require(`
+	gen_require(`
 		type snmpd_t, snmpd_var_lib_t;
-	 ')
+	')
 
-	 files_search_var_lib($1)
-	 stream_connect_pattern($1, snmpd_var_lib_t, snmpd_var_lib_t, snmpd_t)
+	files_search_var_lib($1)
+	stream_connect_pattern($1, snmpd_var_lib_t, snmpd_var_lib_t, snmpd_t)
 ')
 
 ########################################
@@ -97,7 +98,7 @@ interface(`snmp_manage_var_lib_files',`
 
 ########################################
 ## <summary>
-##	Read snmpd libraries.
+##	Read snmpd lib content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -117,7 +118,8 @@ interface(`snmp_read_snmp_var_lib_files',`
 
 ########################################
 ## <summary>
-##	dontaudit Read snmpd libraries.
+##	Do not audit attempts to read
+##	snmpd lib content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -129,14 +131,16 @@ interface(`snmp_dontaudit_read_snmp_var_lib_files',`
 	gen_require(`
 		type snmpd_var_lib_t;
 	')
+
 	dontaudit $1 snmpd_var_lib_t:dir list_dir_perms;
 	dontaudit $1 snmpd_var_lib_t:file read_file_perms;
-	dontaudit $1 snmpd_var_lib_t:lnk_file { getattr read };
+	dontaudit $1 snmpd_var_lib_t:lnk_file read_lnk_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	dontaudit write snmpd libraries files.
+##	Do not audit attempts to write
+##	snmpd lib files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -154,8 +158,8 @@ interface(`snmp_dontaudit_write_snmp_var_lib_files',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an snmp environment
+##	All of the rules required to
+##	administrate an snmp environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -164,19 +168,18 @@ interface(`snmp_dontaudit_write_snmp_var_lib_files',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to be allowed to manage the snmp domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>
 #
 interface(`snmp_admin',`
 	gen_require(`
-		type snmpd_t, snmpd_log_t;
+		type snmpd_t, snmpd_log_t, snmpd_initrc_exec_t;
 		type snmpd_var_lib_t, snmpd_var_run_t;
-		type snmpd_initrc_exec_t;
 	')
 
-	allow $1 snmpd_t:process { ptrace signal_perms getattr };
+	allow $1 snmpd_t:process { ptrace signal_perms };
 	ps_process_pattern($1, snmpd_t)
 
 	init_labeled_script_domtrans($1, snmpd_initrc_exec_t)

diff --git a/policy/modules/contrib/snmp.te b/policy/modules/contrib/snmp.te
index 709139b..02f3b3b 100644
--- a/policy/modules/contrib/snmp.te
+++ b/policy/modules/contrib/snmp.te
@@ -1,9 +1,10 @@
-policy_module(snmp, 1.13.2)
+policy_module(snmp, 1.13.3)
 
 ########################################
 #
 # Declarations
 #
+
 type snmpd_t;
 type snmpd_exec_t;
 init_daemon_domain(snmpd_t, snmpd_exec_t)
@@ -24,16 +25,16 @@ files_type(snmpd_var_lib_t)
 #
 # Local policy
 #
-allow snmpd_t self:capability { chown dac_override kill ipc_lock sys_ptrace net_admin sys_nice sys_tty_config };
+
+allow snmpd_t self:capability { chown dac_override kill ipc_lock setgid setuid net_admin sys_nice sys_tty_config sys_ptrace };
 dontaudit snmpd_t self:capability { sys_module sys_tty_config };
 allow snmpd_t self:process { signal_perms getsched setsched };
 allow snmpd_t self:fifo_file rw_fifo_file_perms;
-allow snmpd_t self:unix_dgram_socket create_socket_perms;
-allow snmpd_t self:unix_stream_socket create_stream_socket_perms;
-allow snmpd_t self:tcp_socket create_stream_socket_perms;
+allow snmpd_t self:unix_stream_socket { accept connectto listen };
+allow snmpd_t self:tcp_socket { accept listen };
 allow snmpd_t self:udp_socket connected_stream_socket_perms;
 
-allow snmpd_t snmpd_log_t:file manage_file_perms;
+allow snmpd_t snmpd_log_t:file { append_file_perms create_file_perms setattr_file_perms };
 logging_log_filetrans(snmpd_t, snmpd_log_t, file)
 
 manage_dirs_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
@@ -41,18 +42,18 @@ manage_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
 manage_sock_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
 files_usr_filetrans(snmpd_t, snmpd_var_lib_t, file)
 files_var_filetrans(snmpd_t, snmpd_var_lib_t, { file dir sock_file })
-files_var_lib_filetrans(snmpd_t, snmpd_var_lib_t, file)
+files_var_lib_filetrans(snmpd_t, snmpd_var_lib_t, { dir file })
 
+manage_dirs_pattern(snmpd_t, snmpd_var_run_t, snmpd_var_run_t)
 manage_files_pattern(snmpd_t, snmpd_var_run_t, snmpd_var_run_t)
-files_pid_filetrans(snmpd_t, snmpd_var_run_t, file)
+files_pid_filetrans(snmpd_t, snmpd_var_run_t, { file dir })
 
 kernel_read_device_sysctls(snmpd_t)
 kernel_read_kernel_sysctls(snmpd_t)
 kernel_read_fs_sysctls(snmpd_t)
 kernel_read_net_sysctls(snmpd_t)
-kernel_read_proc_symlinks(snmpd_t)
-kernel_read_system_state(snmpd_t)
 kernel_read_network_state(snmpd_t)
+kernel_read_system_state(snmpd_t)
 
 corecmd_exec_bin(snmpd_t)
 corecmd_exec_shell(snmpd_t)
@@ -63,16 +64,22 @@ corenet_tcp_sendrecv_generic_if(snmpd_t)
 corenet_udp_sendrecv_generic_if(snmpd_t)
 corenet_tcp_sendrecv_generic_node(snmpd_t)
 corenet_udp_sendrecv_generic_node(snmpd_t)
-corenet_tcp_sendrecv_all_ports(snmpd_t)
-corenet_udp_sendrecv_all_ports(snmpd_t)
 corenet_tcp_bind_generic_node(snmpd_t)
 corenet_udp_bind_generic_node(snmpd_t)
+
+corenet_sendrecv_snmp_server_packets(snmpd_t)
 corenet_tcp_bind_snmp_port(snmpd_t)
 corenet_udp_bind_snmp_port(snmpd_t)
-corenet_sendrecv_snmp_server_packets(snmpd_t)
+corenet_tcp_sendrecv_snmp_port(snmpd_t)
+corenet_udp_sendrecv_snmp_port(snmpd_t)
+
+corenet_sendrecv_snmp_client_packets(snmpd_t)
 corenet_tcp_connect_agentx_port(snmpd_t)
+corenet_sendrecv_snmp_server_packets(snmpd_t)
 corenet_tcp_bind_agentx_port(snmpd_t)
 corenet_udp_bind_agentx_port(snmpd_t)
+corenet_tcp_sendrecv_agentx_port(snmpd_t)
+corenet_udp_sendrecv_agentx_port(snmpd_t)
 
 dev_list_sysfs(snmpd_t)
 dev_read_sysfs(snmpd_t)
@@ -83,23 +90,23 @@ dev_getattr_usbfs_dirs(snmpd_t)
 domain_use_interactive_fds(snmpd_t)
 domain_signull_all_domains(snmpd_t)
 domain_read_all_domains_state(snmpd_t)
-domain_dontaudit_ptrace_all_domains(snmpd_t)
 domain_exec_all_entry_files(snmpd_t)
 
-files_read_etc_files(snmpd_t)
 files_read_usr_files(snmpd_t)
 files_read_etc_runtime_files(snmpd_t)
 files_search_home(snmpd_t)
 
 fs_getattr_all_dirs(snmpd_t)
 fs_getattr_all_fs(snmpd_t)
+files_list_all(snmpd_t)
+files_search_all_mountpoints(snmpd_t)
 fs_search_auto_mountpoints(snmpd_t)
 
 storage_dontaudit_read_fixed_disk(snmpd_t)
 storage_dontaudit_read_removable_device(snmpd_t)
+storage_dontaudit_write_removable_device(snmpd_t)
 
 auth_use_nsswitch(snmpd_t)
-files_list_non_auth_dirs(snmpd_t)
 
 init_read_utmp(snmpd_t)
 init_dontaudit_write_utmp(snmpd_t)
@@ -110,18 +117,9 @@ miscfiles_read_localization(snmpd_t)
 
 seutil_dontaudit_search_config(snmpd_t)
 
-sysnet_read_config(snmpd_t)
-
 userdom_dontaudit_use_unpriv_user_fds(snmpd_t)
 userdom_dontaudit_search_user_home_dirs(snmpd_t)
 
-ifdef(`distro_redhat', `
-	optional_policy(`
-		rpm_read_db(snmpd_t)
-		rpm_dontaudit_manage_db(snmpd_t)
-	')
-')
-
 optional_policy(`
 	amanda_dontaudit_read_dumpdates(snmpd_t)
 ')
@@ -131,6 +129,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	corosync_stream_connect(snmpd_t)
+')
+
+optional_policy(`
 	cups_read_rw_config(snmpd_t)
 ')
 
@@ -140,10 +142,19 @@ optional_policy(`
 ')
 
 optional_policy(`
+	ricci_stream_connect_modclusterd(snmpd_t)
+')
+
+optional_policy(`
 	rpc_search_nfs_state_data(snmpd_t)
 ')
 
 optional_policy(`
+	rpm_read_db(snmpd_t)
+	rpm_dontaudit_manage_db(snmpd_t)
+')
+
+optional_policy(`
 	sendmail_read_log(snmpd_t)
 ')