[selinux-policy: 2133/3172] trunk: nis patch from dan.

[Daniel J Walsh]

commit c989807d4aff7b9493f7abe876625141b1f90ff4
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Thu Jun 25 15:16:29 2009 +0000

    trunk: nis patch from dan.

 policy/modules/services/nis.fc |    1 +
 policy/modules/services/nis.if |   75 +++++++++++++++++++++++++++++++++++++--
 policy/modules/services/nis.te |   25 +++++++++----
 3 files changed, 90 insertions(+), 11 deletions(-)
---
diff --git a/policy/modules/services/nis.fc b/policy/modules/services/nis.fc
index cc23fb5..ee62b9d 100644
--- a/policy/modules/services/nis.fc
+++ b/policy/modules/services/nis.fc
@@ -4,6 +4,7 @@
 /sbin/ypbind		--	gen_context(system_u:object_r:ypbind_exec_t,s0)
 
 /usr/lib/yp/ypxfr	--	gen_context(system_u:object_r:ypxfr_exec_t,s0)
+/usr/lib64/yp/ypxfr	--	gen_context(system_u:object_r:ypxfr_exec_t,s0)
 
 /usr/sbin/rpc\.yppasswdd --	gen_context(system_u:object_r:yppasswdd_exec_t,s0)
 /usr/sbin/rpc\.ypxfrd	--	gen_context(system_u:object_r:ypxfr_exec_t,s0)
diff --git a/policy/modules/services/nis.if b/policy/modules/services/nis.if
index ff85c8d..df608e9 100644
--- a/policy/modules/services/nis.if
+++ b/policy/modules/services/nis.if
@@ -49,8 +49,8 @@ interface(`nis_use_ypbind_uncond',`
 	corenet_udp_bind_generic_node($1)
 	corenet_tcp_bind_generic_port($1)
 	corenet_udp_bind_generic_port($1)
-	corenet_tcp_bind_reserved_port($1)
-	corenet_udp_bind_reserved_port($1)
+	corenet_dontaudit_tcp_bind_all_reserved_ports($1)
+	corenet_dontaudit_udp_bind_all_reserved_ports($1)
 	corenet_dontaudit_tcp_bind_all_ports($1)
 	corenet_dontaudit_udp_bind_all_ports($1)
 	corenet_tcp_connect_portmap_port($1)
@@ -76,12 +76,27 @@ interface(`nis_use_ypbind_uncond',`
 ## <rolecap/>
 #
 interface(`nis_use_ypbind',`
-	gen_require(`
-		type var_yp_t;
+	tunable_policy(`allow_ypbind',`
+		nis_use_ypbind_uncond($1)
 	')
+')
 
+########################################
+## <summary>
+##	Use the nis to authenticate passwords
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`nis_authenticate',`
 	tunable_policy(`allow_ypbind',`
 		nis_use_ypbind_uncond($1)
+		corenet_tcp_bind_all_rpc_ports($1)
+		corenet_udp_bind_all_rpc_ports($1)
 	')
 ')
 
@@ -244,3 +259,55 @@ interface(`nis_domtrans_ypxfr',`
 	corecmd_search_bin($1)
 	domtrans_pattern($1, ypxfr_exec_t, ypxfr_t)
 ')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an nis environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`nis_admin',`
+	gen_require(`
+		type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t;
+		type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t;
+		type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t;
+	')
+
+	allow $1 ypbind_t:process { ptrace signal_perms };
+	ps_process_pattern($1, ypbind_t)
+
+	allow $1 yppasswdd_t:process { ptrace signal_perms };
+	ps_process_pattern($1, yppasswdd_t)
+
+	allow $1 ypserv_t:process { ptrace signal_perms };
+	ps_process_pattern($1, ypserv_t)
+
+	allow $1 ypxfr_t:process { ptrace signal_perms };
+	ps_process_pattern($1, ypxfr_t)
+
+	files_list_tmp($1)
+	admin_pattern($1, ypbind_tmp_t)
+
+	files_list_pids($1)
+	admin_pattern($1, ypbind_var_run_t)
+
+	admin_pattern($1, yppasswdd_var_run_t)
+
+	files_list_etc($1)
+	admin_pattern($1, ypserv_conf_t)
+
+	admin_pattern($1, ypserv_tmp_t)
+
+	admin_pattern($1, ypserv_var_run_t)
+')
diff --git a/policy/modules/services/nis.te b/policy/modules/services/nis.te
index 3fd2ae2..fbc6609 100644
--- a/policy/modules/services/nis.te
+++ b/policy/modules/services/nis.te
@@ -1,5 +1,5 @@
 
-policy_module(nis, 1.8.2)
+policy_module(nis, 1.8.3)
 
 ########################################
 #
@@ -111,6 +111,16 @@ userdom_dontaudit_use_unpriv_user_fds(ypbind_t)
 userdom_dontaudit_search_user_home_dirs(ypbind_t)
 
 optional_policy(`
+	dbus_system_bus_client(ypbind_t)
+	dbus_connect_system_bus(ypbind_t)
+	init_dbus_chat_script(ypbind_t)
+
+	optional_policy(`
+		networkmanager_dbus_chat(ypbind_t)
+	')
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(ypbind_t)
 ')
 
@@ -123,6 +133,7 @@ optional_policy(`
 # yppasswdd local policy
 #
 
+allow yppasswdd_t self:capability dac_override;
 dontaudit yppasswdd_t self:capability sys_tty_config;
 allow yppasswdd_t self:fifo_file rw_fifo_file_perms;
 allow yppasswdd_t self:process { setfscreate signal_perms };
@@ -153,8 +164,8 @@ corenet_tcp_sendrecv_all_ports(yppasswdd_t)
 corenet_udp_sendrecv_all_ports(yppasswdd_t)
 corenet_tcp_bind_generic_node(yppasswdd_t)
 corenet_udp_bind_generic_node(yppasswdd_t)
-corenet_tcp_bind_reserved_port(yppasswdd_t)
-corenet_udp_bind_reserved_port(yppasswdd_t)
+corenet_tcp_bind_all_rpc_ports(yppasswdd_t)
+corenet_udp_bind_all_rpc_ports(yppasswdd_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(yppasswdd_t)
 corenet_dontaudit_udp_bind_all_reserved_ports(yppasswdd_t)
 corenet_sendrecv_generic_server_packets(yppasswdd_t)
@@ -239,8 +250,8 @@ corenet_tcp_sendrecv_all_ports(ypserv_t)
 corenet_udp_sendrecv_all_ports(ypserv_t)
 corenet_tcp_bind_generic_node(ypserv_t)
 corenet_udp_bind_generic_node(ypserv_t)
-corenet_tcp_bind_reserved_port(ypserv_t)
-corenet_udp_bind_reserved_port(ypserv_t)
+corenet_tcp_bind_all_rpc_ports(ypserv_t)
+corenet_udp_bind_all_rpc_ports(ypserv_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t)
 corenet_dontaudit_udp_bind_all_reserved_ports(ypserv_t)
 corenet_sendrecv_generic_server_packets(ypserv_t)
@@ -304,8 +315,8 @@ corenet_tcp_sendrecv_all_ports(ypxfr_t)
 corenet_udp_sendrecv_all_ports(ypxfr_t)
 corenet_tcp_bind_generic_node(ypxfr_t)
 corenet_udp_bind_generic_node(ypxfr_t)
-corenet_tcp_bind_reserved_port(ypxfr_t)
-corenet_udp_bind_reserved_port(ypxfr_t)
+corenet_tcp_bind_all_rpc_ports(ypxfr_t)
+corenet_udp_bind_all_rpc_ports(ypxfr_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
 corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
 corenet_tcp_connect_all_ports(ypxfr_t)