[selinux-policy: 660/3172] add tftp

[Daniel J Walsh]

commit 40adb57f47cc7d34617a3ac9984641f5d73e570d
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Fri Sep 16 15:18:09 2005 +0000

    add tftp

 refpolicy/Changelog                        |    1 +
 refpolicy/policy/modules/services/inetd.te |    1 +
 refpolicy/policy/modules/services/tftp.fc  |    5 ++
 refpolicy/policy/modules/services/tftp.if  |    1 +
 refpolicy/policy/modules/services/tftp.te  |  107 ++++++++++++++++++++++++++++
 5 files changed, 115 insertions(+), 0 deletions(-)
---
diff --git a/refpolicy/Changelog b/refpolicy/Changelog
index aa47aac..2c80653 100644
--- a/refpolicy/Changelog
+++ b/refpolicy/Changelog
@@ -7,6 +7,7 @@
 	portmap
 	samba
 	snmp
+	tftp
 	zebra
 
 * Wed Sep 07 2005 Chris PeBenito <selinux at tresys.com> - 20050907
diff --git a/refpolicy/policy/modules/services/inetd.te b/refpolicy/policy/modules/services/inetd.te
index bda7016..12869b9 100644
--- a/refpolicy/policy/modules/services/inetd.te
+++ b/refpolicy/policy/modules/services/inetd.te
@@ -85,6 +85,7 @@ corenet_udp_bind_rsync_port(inetd_t)
 #corenet_tcp_bind_stunnel_port(inetd_t)
 corenet_tcp_bind_swat_port(inetd_t)
 corenet_udp_bind_swat_port(inetd_t)
+corenet_udp_bind_tftp_port(inetd_t)
 
 dev_read_sysfs(inetd_t)
 
diff --git a/refpolicy/policy/modules/services/tftp.fc b/refpolicy/policy/modules/services/tftp.fc
new file mode 100644
index 0000000..7600dc6
--- /dev/null
+++ b/refpolicy/policy/modules/services/tftp.fc
@@ -0,0 +1,5 @@
+
+/usr/sbin/atftpd	--	context_template(system_u:object_r:tftpd_exec_t,s0)
+/usr/sbin/in\.tftpd	--	context_template(system_u:object_r:tftpd_exec_t,s0)
+
+/tftpboot(/.*)?			context_template(system_u:object_r:tftpdir_t,s0)
diff --git a/refpolicy/policy/modules/services/tftp.if b/refpolicy/policy/modules/services/tftp.if
new file mode 100644
index 0000000..ad41363
--- /dev/null
+++ b/refpolicy/policy/modules/services/tftp.if
@@ -0,0 +1 @@
+## <summary>Trivial file transfer protocol daemon</summary>
diff --git a/refpolicy/policy/modules/services/tftp.te b/refpolicy/policy/modules/services/tftp.te
new file mode 100644
index 0000000..d6e1096
--- /dev/null
+++ b/refpolicy/policy/modules/services/tftp.te
@@ -0,0 +1,107 @@
+
+policy_module(tftp,1.0)
+
+########################################
+#
+# Declarations
+#
+
+type tftpd_t;
+type tftpd_exec_t;
+init_daemon_domain(tftpd_t,tftpd_exec_t)
+inetd_udp_service_domain(tftpd_t,tftpd_exec_t)
+
+type tftpd_var_run_t;
+files_pid_file(tftpd_var_run_t)
+
+type tftpdir_t;
+files_type(tftpdir_t)
+
+########################################
+#
+# Local policy
+#
+
+allow tftpd_t self:capability { setgid setuid sys_chroot };
+allow tftpd_t self:tcp_socket create_stream_socket_perms;
+allow tftpd_t self:udp_socket create_socket_perms;
+allow tftpd_t self:unix_dgram_socket create_socket_perms;
+allow tftpd_t self:unix_stream_socket create_stream_socket_perms;
+dontaudit tftpd_t self:capability sys_tty_config;
+
+allow tftpd_t tftpdir_t:dir { getattr read search };
+allow tftpd_t tftpdir_t:file { read getattr };
+allow tftpd_t tftpdir_t:lnk_file { getattr read };
+
+allow tftpd_t tftpd_var_run_t:file create_file_perms;
+allow tftpd_t tftpd_var_run_t:dir rw_dir_perms;
+files_create_pid(tftpd_t,tftpd_var_run_t)
+
+kernel_read_kernel_sysctl(tftpd_t)
+kernel_list_proc(tftpd_t)
+kernel_read_proc_symlinks(tftpd_t)
+
+corenet_tcp_sendrecv_all_if(tftpd_t)
+corenet_udp_sendrecv_all_if(tftpd_t)
+corenet_raw_sendrecv_all_if(tftpd_t)
+corenet_tcp_sendrecv_all_nodes(tftpd_t)
+corenet_udp_sendrecv_all_nodes(tftpd_t)
+corenet_raw_sendrecv_all_nodes(tftpd_t)
+corenet_tcp_sendrecv_all_ports(tftpd_t)
+corenet_udp_sendrecv_all_ports(tftpd_t)
+corenet_tcp_bind_all_nodes(tftpd_t)
+corenet_udp_bind_all_nodes(tftpd_t)
+corenet_udp_bind_tftp_port(tftpd_t)
+
+dev_read_sysfs(tftpd_t)
+
+fs_getattr_all_fs(tftpd_t)
+fs_search_auto_mountpoints(tftpd_t)
+
+term_dontaudit_use_console(tftpd_t)
+
+domain_use_wide_inherit_fd(tftpd_t)
+
+files_read_etc_files(tftpd_t);
+files_read_var_files(tftpd_t)
+files_read_var_symlink(tftpd_t)
+files_search_var(tftpd_t)
+
+init_use_fd(tftpd_t)
+init_use_script_pty(tftpd_t)
+
+libs_use_ld_so(tftpd_t)
+libs_use_shared_libs(tftpd_t)
+
+logging_send_syslog_msg(tftpd_t)
+
+miscfiles_read_localization(tftpd_t)
+
+sysnet_read_config(tftpd_t)
+
+userdom_dontaudit_use_unpriv_user_fd(tftpd_t)
+userdom_dontaudit_use_sysadm_tty(tftpd_t)
+userdom_dontaudit_search_sysadm_home_dir(tftpd_t)
+
+ifdef(`targeted_policy', `
+        term_dontaudit_use_unallocated_tty(tftpd_t)
+        term_dontaudit_use_generic_pty(tftpd_t)
+        files_dontaudit_read_root_file(tftpd_t)
+')
+
+optional_policy(`mount.te',`
+        mount_send_nfs_client_request(tftpd_t)
+')
+
+optional_policy(`selinuxutil.te',`
+        seutil_sigchld_newrole(tftpd_t)
+')
+optional_policy(`udev.te', `
+        udev_read_db(tftpd_t)
+')
+
+ifdef(`TODO',`
+optional_policy(`rhgb.te',`
+        rhgb_domain(tftpd_t)
+')
+')