[selinux-policy: 1424/3172] add afs, bug 1514

[Daniel J Walsh]

commit 48b1d0b0a0cd270b9fb210dadfa4ea4e34136364
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Fri May 5 17:53:45 2006 +0000

    add afs, bug 1514

 refpolicy/Changelog                      |    1 +
 refpolicy/policy/modules/services/afs.fc |   22 ++
 refpolicy/policy/modules/services/afs.if |    1 +
 refpolicy/policy/modules/services/afs.te |  337 ++++++++++++++++++++++++++++++
 4 files changed, 361 insertions(+), 0 deletions(-)
---
diff --git a/refpolicy/Changelog b/refpolicy/Changelog
index 8b3485e..e361e59 100644
--- a/refpolicy/Changelog
+++ b/refpolicy/Changelog
@@ -36,6 +36,7 @@
 - Fix temporary rules at the bottom of portmap.
 - Updated comments in mls file from Chad Hanson.
 - Added modules:
+	afs
 	amavis (Erich Schubert)
 	apt (Erich Schubert)
 	asterisk
diff --git a/refpolicy/policy/modules/services/afs.fc b/refpolicy/policy/modules/services/afs.fc
new file mode 100644
index 0000000..1689223
--- /dev/null
+++ b/refpolicy/policy/modules/services/afs.fc
@@ -0,0 +1,22 @@
+/usr/afs/bin/bosserver	--	gen_context(system_u:object_r:afs_bosserver_exec_t,s0)
+/usr/afs/bin/fileserver	--	gen_context(system_u:object_r:afs_fsserver_exec_t,s0)
+/usr/afs/bin/kaserver	--	gen_context(system_u:object_r:afs_kaserver_exec_t,s0)
+/usr/afs/bin/ptserver	--	gen_context(system_u:object_r:afs_ptserver_exec_t,s0)
+/usr/afs/bin/salvager	--	gen_context(system_u:object_r:afs_fsserver_exec_t,s0)
+/usr/afs/bin/volserver	--	gen_context(system_u:object_r:afs_fsserver_exec_t,s0)
+/usr/afs/bin/vlserver	--	gen_context(system_u:object_r:afs_vlserver_exec_t,s0)
+
+/usr/afs/db		-d	gen_context(system_u:object_r:afs_dbdir_t,s0)
+/usr/afs/db/pr.*	--	gen_context(system_u:object_r:afs_pt_db_t,s0)
+/usr/afs/db/ka.*	--	gen_context(system_u:object_r:afs_ka_db_t,s0)
+/usr/afs/db/vl.*	--	gen_context(system_u:object_r:afs_vl_db_t,s0)
+
+/usr/afs/etc(/.*)?		gen_context(system_u:object_r:afs_config_t,s0)
+
+/usr/afs/local(/.*)?		gen_context(system_u:object_r:afs_config_t,s0)
+
+/usr/afs/logs(/.*)?		gen_context(system_u:object_r:afs_logfile_t,s0)
+
+/vicepa				gen_context(system_u:object_r:afs_files_t,s0)
+/vicepb				gen_context(system_u:object_r:afs_files_t,s0)
+/vicepc				gen_context(system_u:object_r:afs_files_t,s0)
diff --git a/refpolicy/policy/modules/services/afs.if b/refpolicy/policy/modules/services/afs.if
new file mode 100644
index 0000000..e84153f
--- /dev/null
+++ b/refpolicy/policy/modules/services/afs.if
@@ -0,0 +1 @@
+## <summary>Andrew Filesystem server</summary>
diff --git a/refpolicy/policy/modules/services/afs.te b/refpolicy/policy/modules/services/afs.te
new file mode 100644
index 0000000..ffcc7e1
--- /dev/null
+++ b/refpolicy/policy/modules/services/afs.te
@@ -0,0 +1,337 @@
+
+policy_module(afs,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type afs_bosserver_t;
+type afs_bosserver_exec_t;
+init_daemon_domain(afs_bosserver_t,afs_bosserver_exec_t)
+
+type afs_config_t;
+files_type(afs_config_t)
+
+type afs_dbdir_t;
+files_type(afs_dbdir_t)
+
+# exported files
+type afs_files_t;
+files_type(afs_files_t)
+
+type afs_fsserver_t;
+type afs_fsserver_exec_t;
+domain_type(afs_fsserver_t)
+domain_entry_file(afs_fsserver_t,afs_fsserver_exec_t)
+role system_r types afs_fsserver_t;
+
+type afs_ka_db_t;
+files_type(afs_ka_db_t)
+
+type afs_kaserver_t;
+type afs_kaserver_exec_t;
+domain_type(afs_kaserver_t)
+domain_entry_file(afs_kaserver_t,afs_kaserver_exec_t)
+role system_r types afs_kaserver_t;
+
+type afs_logfile_t;
+logging_log_file(afs_logfile_t)
+
+type afs_pt_db_t;
+files_type(afs_pt_db_t)
+
+type afs_ptserver_t;
+type afs_ptserver_exec_t;
+domain_type(afs_ptserver_t)
+domain_entry_file(afs_ptserver_t,afs_ptserver_exec_t)
+role system_r types afs_ptserver_t;
+
+type afs_vl_db_t;
+files_type(afs_vl_db_t)
+
+type afs_vlserver_t;
+type afs_vlserver_exec_t;
+domain_type(afs_vlserver_t)
+domain_entry_file(afs_vlserver_t,afs_vlserver_exec_t)
+role system_r types afs_vlserver_t;
+
+########################################
+#
+# AFS bossserver local policy
+#
+
+allow afs_bosserver_t self:process { setsched signal_perms };
+allow afs_bosserver_t self:tcp_socket create_stream_socket_perms;
+allow afs_bosserver_t self:udp_socket create_socket_perms;
+
+can_exec(afs_bosserver_t,afs_bosserver_exec_t)
+
+allow afs_bosserver_t afs_config_t:file manage_file_perms;
+allow afs_bosserver_t afs_config_t:dir manage_dir_perms;
+
+allow afs_bosserver_t afs_dbdir_t:dir { search read getattr };
+
+allow afs_bosserver_t afs_fsserver_t:process signal_perms;
+domain_auto_trans(afs_bosserver_t, afs_fsserver_exec_t, afs_fsserver_t)
+allow afs_fsserver_t afs_bosserver_t:fd use;
+allow afs_fsserver_t afs_bosserver_t:fifo_file rw_file_perms;
+allow afs_fsserver_t afs_bosserver_t:process sigchld;
+
+allow afs_bosserver_t afs_kaserver_t:process signal_perms;
+domain_auto_trans(afs_bosserver_t, afs_kaserver_exec_t, afs_kaserver_t)
+allow afs_kaserver_t afs_bosserver_t:fd use;
+allow afs_kaserver_t afs_bosserver_t:fifo_file rw_file_perms;
+allow afs_kaserver_t afs_bosserver_t:process sigchld;
+
+allow afs_bosserver_t afs_logfile_t:file create_file_perms;
+allow afs_bosserver_t afs_logfile_t:dir create_dir_perms;
+
+allow afs_bosserver_t afs_ptserver_t:process signal_perms;
+domain_auto_trans(afs_bosserver_t, afs_ptserver_exec_t, afs_ptserver_t)
+allow afs_ptserver_t afs_bosserver_t:fd use;
+allow afs_ptserver_t afs_bosserver_t:fifo_file rw_file_perms;
+allow afs_ptserver_t afs_bosserver_t:process sigchld;
+
+allow afs_bosserver_t afs_vlserver_t:process signal_perms;
+domain_auto_trans(afs_bosserver_t, afs_vlserver_exec_t, afs_vlserver_t)
+allow afs_vlserver_t afs_bosserver_t:fd use;
+allow afs_vlserver_t afs_bosserver_t:fifo_file rw_file_perms;
+allow afs_vlserver_t afs_bosserver_t:process sigchld;
+
+kernel_read_kernel_sysctls(afs_bosserver_t)
+
+corenet_non_ipsec_sendrecv(afs_bosserver_t)
+corenet_tcp_sendrecv_generic_if(afs_bosserver_t)
+corenet_udp_sendrecv_generic_if(afs_bosserver_t)
+corenet_tcp_sendrecv_all_nodes(afs_bosserver_t)
+corenet_udp_sendrecv_all_nodes(afs_bosserver_t)
+corenet_tcp_sendrecv_all_ports(afs_bosserver_t)
+corenet_udp_sendrecv_all_ports(afs_bosserver_t)
+corenet_udp_bind_all_nodes(afs_bosserver_t)
+corenet_udp_bind_afs_bos_port(afs_bosserver_t)
+
+files_read_etc_files(afs_bosserver_t)
+files_list_home(afs_bosserver_t)
+files_read_usr_files(afs_bosserver_t)
+
+libs_use_ld_so(afs_bosserver_t)
+libs_use_shared_libs(afs_bosserver_t)
+
+miscfiles_read_localization(afs_bosserver_t)
+
+seutil_read_config(afs_bosserver_t)
+
+sysnet_read_config(afs_bosserver_t)
+
+########################################
+#
+# fileserver local policy
+#
+
+allow afs_fsserver_t self:capability { kill dac_override chown fowner sys_nice };
+dontaudit afs_fsserver_t self:capability fsetid;
+allow afs_fsserver_t self:process { setsched signal_perms };
+allow afs_fsserver_t self:fifo_file rw_file_perms;
+allow afs_fsserver_t self:tcp_socket { create_stream_socket_perms connectto acceptfrom recvfrom };
+allow afs_fsserver_t self:udp_socket { create_socket_perms sendto recvfrom };
+
+allow afs_fsserver_t afs_config_t:file r_file_perms;
+allow afs_fsserver_t afs_config_t:dir r_dir_perms;
+
+allow afs_fsserver_t afs_config_t:file manage_file_perms;
+allow afs_fsserver_t afs_config_t:dir manage_dir_perms;
+
+allow afs_fsserver_t afs_files_t:filesystem getattr;
+allow afs_fsserver_t afs_files_t:dir manage_dir_perms;
+allow afs_fsserver_t afs_files_t:file manage_file_perms;
+allow afs_fsserver_t afs_files_t:lnk_file create_lnk_perms;
+allow afs_fsserver_t afs_files_t:sock_file manage_file_perms;
+allow afs_fsserver_t afs_files_t:fifo_file manage_file_perms;
+type_transition afs_fsserver_t afs_config_t:{ file lnk_file sock_file fifo_file } afs_files_t;
+allow afs_fsserver_t afs_config_t:dir rw_dir_perms;
+
+can_exec(afs_fsserver_t, afs_fsserver_exec_t)
+
+allow afs_fsserver_t afs_logfile_t:file create_file_perms;
+allow afs_fsserver_t afs_logfile_t:dir create_dir_perms;
+
+allow afs_fsserver_t afs_ptserver_t:udp_socket recvfrom;
+
+allow afs_fsserver_t afs_vlserver_t:udp_socket recvfrom;
+
+kernel_read_system_state(afs_fsserver_t)
+kernel_read_kernel_sysctls(afs_fsserver_t)
+
+corenet_tcp_sendrecv_generic_if(afs_fsserver_t)
+corenet_udp_sendrecv_generic_if(afs_fsserver_t)
+corenet_tcp_sendrecv_all_nodes(afs_fsserver_t)
+corenet_udp_sendrecv_all_nodes(afs_fsserver_t)
+corenet_tcp_sendrecv_all_ports(afs_fsserver_t)
+corenet_udp_sendrecv_all_ports(afs_fsserver_t)
+corenet_non_ipsec_sendrecv(afs_fsserver_t)
+corenet_tcp_bind_all_nodes(afs_fsserver_t)
+corenet_udp_bind_all_nodes(afs_fsserver_t)
+corenet_tcp_bind_afs_fs_port(afs_fsserver_t)
+corenet_udp_bind_afs_fs_port(afs_fsserver_t)
+
+files_read_etc_files(afs_fsserver_t)
+files_read_etc_runtime_files(afs_fsserver_t)
+files_list_home(afs_fsserver_t)
+files_read_usr_files(afs_fsserver_t)
+files_list_pids(afs_fsserver_t)
+files_dontaudit_search_mnt(afs_fsserver_t)
+
+fs_getattr_xattr_fs(afs_fsserver_t)
+
+term_dontaudit_use_console(afs_fsserver_t)
+
+init_dontaudit_use_script_fds(afs_fsserver_t)
+
+libs_use_ld_so(afs_fsserver_t)
+libs_use_shared_libs(afs_fsserver_t)
+
+logging_send_syslog_msg(afs_fsserver_t)
+
+miscfiles_read_localization(afs_fsserver_t)
+
+seutil_read_config(afs_fsserver_t)
+
+sysnet_read_config(afs_fsserver_t)
+
+userdom_dontaudit_use_sysadm_ttys(afs_fsserver_t)
+userdom_dontaudit_use_sysadm_ptys(afs_fsserver_t)
+
+########################################
+#
+# kaserver local policy
+#
+
+allow afs_kaserver_t self:unix_stream_socket create_stream_socket_perms;
+allow afs_kaserver_t self:tcp_socket create_stream_socket_perms;
+allow afs_kaserver_t self:udp_socket create_socket_perms;
+
+allow afs_kaserver_t afs_config_t:file manage_file_perms;
+allow afs_kaserver_t afs_config_t:dir rw_dir_perms;
+
+allow afs_kaserver_t afs_ka_db_t:file manage_file_perms;
+allow afs_kaserver_t afs_dbdir_t:dir rw_dir_perms;
+type_transition afs_kaserver_t afs_dbdir_t:file afs_ka_db_t;
+
+allow afs_kaserver_t afs_logfile_t:file manage_file_perms;
+allow afs_kaserver_t afs_logfile_t:dir manage_dir_perms;
+
+kernel_read_kernel_sysctls(afs_kaserver_t)
+
+corenet_non_ipsec_sendrecv(afs_kaserver_t)
+corenet_tcp_sendrecv_generic_if(afs_kaserver_t)
+corenet_udp_sendrecv_generic_if(afs_kaserver_t)
+corenet_tcp_sendrecv_all_nodes(afs_kaserver_t)
+corenet_udp_sendrecv_all_nodes(afs_kaserver_t)
+corenet_tcp_sendrecv_all_ports(afs_kaserver_t)
+corenet_udp_sendrecv_all_ports(afs_kaserver_t)
+corenet_udp_bind_all_nodes(afs_kaserver_t)
+corenet_udp_bind_afs_ka_port(afs_kaserver_t)
+corenet_udp_bind_kerberos_port(afs_kaserver_t)
+
+files_read_etc_files(afs_kaserver_t)
+files_list_home(afs_kaserver_t)
+files_read_usr_files(afs_kaserver_t)
+
+libs_use_ld_so(afs_kaserver_t)
+libs_use_shared_libs(afs_kaserver_t)
+
+miscfiles_read_localization(afs_kaserver_t)
+
+seutil_read_config(afs_kaserver_t)
+
+sysnet_read_config(afs_kaserver_t)
+
+userdom_dontaudit_use_sysadm_ttys(afs_kaserver_t)
+userdom_dontaudit_use_sysadm_ptys(afs_kaserver_t)
+
+########################################
+#
+# ptserver local policy
+#
+
+allow afs_ptserver_t self:unix_stream_socket create_stream_socket_perms;
+allow afs_ptserver_t self:tcp_socket create_stream_socket_perms;
+allow afs_ptserver_t self:udp_socket create_socket_perms;
+
+allow afs_ptserver_t afs_config_t:file r_file_perms;
+allow afs_ptserver_t afs_config_t:dir r_dir_perms;
+
+allow afs_ptserver_t afs_logfile_t:file create_file_perms;
+allow afs_ptserver_t afs_logfile_t:dir create_dir_perms;
+
+allow afs_ptserver_t afs_fsserver_t:udp_socket recvfrom;
+
+allow afs_ptserver_t afs_pt_db_t:file manage_file_perms;
+allow afs_ptserver_t afs_dbdir_t:dir rw_dir_perms;
+type_transition afs_ptserver_t afs_dbdir_t:file afs_pt_db_t;
+
+corenet_non_ipsec_sendrecv(afs_ptserver_t)
+corenet_tcp_sendrecv_generic_if(afs_ptserver_t)
+corenet_udp_sendrecv_generic_if(afs_ptserver_t)
+corenet_tcp_sendrecv_all_nodes(afs_ptserver_t)
+corenet_udp_sendrecv_all_nodes(afs_ptserver_t)
+corenet_tcp_sendrecv_all_ports(afs_ptserver_t)
+corenet_udp_sendrecv_all_ports(afs_ptserver_t)
+corenet_udp_bind_all_nodes(afs_ptserver_t)
+corenet_udp_bind_afs_pt_port(afs_ptserver_t)
+
+files_read_etc_files(afs_ptserver_t)
+
+libs_use_ld_so(afs_ptserver_t)
+libs_use_shared_libs(afs_ptserver_t)
+
+miscfiles_read_localization(afs_ptserver_t)
+
+sysnet_read_config(afs_ptserver_t)
+
+userdom_dontaudit_use_sysadm_ttys(afs_ptserver_t)
+userdom_dontaudit_use_sysadm_ptys(afs_ptserver_t)
+
+########################################
+#
+# vlserver local policy
+#
+
+allow afs_vlserver_t self:unix_stream_socket create_stream_socket_perms;
+allow afs_vlserver_t self:tcp_socket create_stream_socket_perms;
+allow afs_vlserver_t self:udp_socket create_socket_perms;
+
+allow afs_vlserver_t afs_config_t:file r_file_perms;
+allow afs_vlserver_t afs_config_t:dir r_dir_perms;
+
+allow afs_vlserver_t afs_fsserver_t:udp_socket recvfrom;
+
+allow afs_vlserver_t afs_logfile_t:file create_file_perms;
+allow afs_vlserver_t afs_logfile_t:dir create_dir_perms;
+
+allow afs_vlserver_t afs_vl_db_t:file manage_file_perms;
+allow afs_vlserver_t afs_dbdir_t:dir rw_dir_perms;
+type_transition afs_vlserver_t afs_dbdir_t:file afs_vl_db_t;
+
+corenet_non_ipsec_sendrecv(afs_vlserver_t)
+corenet_tcp_sendrecv_generic_if(afs_vlserver_t)
+corenet_udp_sendrecv_generic_if(afs_vlserver_t)
+corenet_tcp_sendrecv_all_nodes(afs_vlserver_t)
+corenet_udp_sendrecv_all_nodes(afs_vlserver_t)
+corenet_tcp_sendrecv_all_ports(afs_vlserver_t)
+corenet_udp_sendrecv_all_ports(afs_vlserver_t)
+corenet_udp_bind_all_nodes(afs_vlserver_t)
+corenet_udp_bind_afs_vl_port(afs_vlserver_t)
+
+files_read_etc_files(afs_vlserver_t)
+
+libs_use_ld_so(afs_vlserver_t)
+libs_use_shared_libs(afs_vlserver_t)
+
+miscfiles_read_localization(afs_vlserver_t)
+
+sysnet_read_config(afs_vlserver_t)
+
+userdom_dontaudit_use_sysadm_ttys(afs_vlserver_t)
+userdom_dontaudit_use_sysadm_ptys(afs_vlserver_t)