[selinux-policy: 1399/3172] add nsd, bug 1534
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 21:06:21 UTC 2010
commit 6a21cefd8b22313c6b22849d1c32da67c58b1bda
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Thu Apr 27 19:41:35 2006 +0000
add nsd, bug 1534
refpolicy/Changelog | 1 +
refpolicy/policy/modules/services/bind.if | 1 -
refpolicy/policy/modules/services/bind.te | 7 +-
refpolicy/policy/modules/services/nsd.fc | 14 ++
refpolicy/policy/modules/services/nsd.if | 39 ++++++
refpolicy/policy/modules/services/nsd.te | 207 +++++++++++++++++++++++++++++
6 files changed, 267 insertions(+), 2 deletions(-)
---
diff --git a/refpolicy/Changelog b/refpolicy/Changelog
index 08b3f25..17f994a 100644
--- a/refpolicy/Changelog
+++ b/refpolicy/Changelog
@@ -58,6 +58,7 @@
mplayer
nagios
nessus
+ nsd
ntop
openvpn (Petre Rodan)
perdition
diff --git a/refpolicy/policy/modules/services/bind.if b/refpolicy/policy/modules/services/bind.if
index b551711..6797a13 100644
--- a/refpolicy/policy/modules/services/bind.if
+++ b/refpolicy/policy/modules/services/bind.if
@@ -271,4 +271,3 @@ interface(`bind_udp_chat_named',`
allow $1 named_t:udp_socket sendto;
allow named_t $1:udp_socket recvfrom;
')
-
diff --git a/refpolicy/policy/modules/services/bind.te b/refpolicy/policy/modules/services/bind.te
index 3993d4c..3543172 100644
--- a/refpolicy/policy/modules/services/bind.te
+++ b/refpolicy/policy/modules/services/bind.te
@@ -1,5 +1,5 @@
-policy_module(bind,1.1.1)
+policy_module(bind,1.1.2)
########################################
#
@@ -199,6 +199,11 @@ optional_policy(`
')
optional_policy(`
+ nsd_tcp_connect(named_t)
+ nsd_udp_chat(named_t)
+')
+
+optional_policy(`
seutil_sigchld_newrole(named_t)
')
diff --git a/refpolicy/policy/modules/services/nsd.fc b/refpolicy/policy/modules/services/nsd.fc
new file mode 100644
index 0000000..e18eae8
--- /dev/null
+++ b/refpolicy/policy/modules/services/nsd.fc
@@ -0,0 +1,14 @@
+
+/etc/nsd(/.*)? gen_context(system_u:object_r:nsd_conf_t,s0)
+/etc/nsd/nsd\.db -- gen_context(system_u:object_r:nsd_db_t,s0)
+/etc/nsd/primary(/.*)? gen_context(system_u:object_r:nsd_zone_t,s0)
+/etc/nsd/secondary(/.*)? gen_context(system_u:object_r:nsd_zone_t,s0)
+
+/usr/sbin/nsd -- gen_context(system_u:object_r:nsd_exec_t,s0)
+/usr/sbin/nsdc -- gen_context(system_u:object_r:nsd_exec_t,s0)
+/usr/sbin/nsd-notify -- gen_context(system_u:object_r:nsd_exec_t,s0)
+/usr/sbin/zonec -- gen_context(system_u:object_r:nsd_exec_t,s0)
+
+/var/lib/nsd(/.*)? gen_context(system_u:object_r:nsd_zone_t,s0)
+/var/lib/nsd/nsd\.db -- gen_context(system_u:object_r:nsd_db_t,s0)
+/var/run/nsd\.pid -- gen_context(system_u:object_r:nsd_var_run_t,s0)
diff --git a/refpolicy/policy/modules/services/nsd.if b/refpolicy/policy/modules/services/nsd.if
new file mode 100644
index 0000000..3004b55
--- /dev/null
+++ b/refpolicy/policy/modules/services/nsd.if
@@ -0,0 +1,39 @@
+## <summary>Authoritative only name server</summary>
+
+########################################
+## <summary>
+## Send and receive datagrams from NSD.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`nsd_udp_chat',`
+ gen_require(`
+ type nsd_t;
+ ')
+ allow $1 nsd_t:udp_socket sendto;
+ allow nsd_t $1:udp_socket recvfrom;
+')
+
+########################################
+## <summary>
+## Connect to NSD over a TCP socket
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`nsd_tcp_connect',`
+ gen_require(`
+ type nsd_t;
+ ')
+
+ allow $1 nsd_t:tcp_socket { connectto recvfrom };
+ allow nsd_t $1:tcp_socket { acceptfrom recvfrom };
+ kernel_tcp_recvfrom($1)
+')
diff --git a/refpolicy/policy/modules/services/nsd.te b/refpolicy/policy/modules/services/nsd.te
new file mode 100644
index 0000000..1b833bb
--- /dev/null
+++ b/refpolicy/policy/modules/services/nsd.te
@@ -0,0 +1,207 @@
+
+policy_module(nsd,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type nsd_t;
+type nsd_exec_t;
+init_daemon_domain(nsd_t,nsd_exec_t)
+
+# A type for configuration files of nsd
+type nsd_conf_t;
+files_type(nsd_conf_t)
+
+type nsd_crond_t;
+domain_type(nsd_crond_t)
+domain_entry_file(nsd_crond_t,nsd_exec_t)
+role system_r types nsd_crond_t;
+
+# a type for nsd.db
+type nsd_db_t;
+files_type(nsd_db_t)
+
+type nsd_var_run_t;
+files_pid_file(nsd_var_run_t)
+
+# A type for zone files
+type nsd_zone_t;
+files_type(nsd_zone_t)
+
+########################################
+#
+# NSD Local policy
+#
+
+allow nsd_t self:capability { dac_override chown setuid setgid };
+dontaudit nsd_t self:capability sys_tty_config;
+allow nsd_t self:process signal_perms;
+allow nsd_t self:tcp_socket create_stream_socket_perms;
+allow nsd_t self:udp_socket create_socket_perms;
+
+allow nsd_t nsd_conf_t:dir r_dir_perms;
+allow nsd_t nsd_conf_t:file r_file_perms;
+allow nsd_t nsd_conf_t:lnk_file { getattr read };
+
+allow nsd_t nsd_db_t:file manage_file_perms;
+type_transition nsd_t nsd_zone_t:file nsd_db_t;
+allow nsd_t nsd_zone_t:dir rw_dir_perms;
+
+allow nsd_t nsd_var_run_t:file create_file_perms;
+allow nsd_t nsd_var_run_t:dir rw_dir_perms;
+files_pid_filetrans(nsd_t,nsd_var_run_t,file)
+
+allow nsd_t nsd_zone_t:dir r_dir_perms;
+allow nsd_t nsd_zone_t:file r_file_perms;
+allow nsd_t nsd_zone_t:lnk_file { getattr read };
+
+can_exec(nsd_t,nsd_exec_t)
+
+kernel_read_system_state(nsd_t)
+kernel_read_kernel_sysctls(nsd_t)
+
+corecmd_exec_bin(nsd_t)
+
+corenet_tcp_sendrecv_generic_if(nsd_t)
+corenet_udp_sendrecv_generic_if(nsd_t)
+corenet_raw_sendrecv_generic_if(nsd_t)
+corenet_tcp_sendrecv_all_nodes(nsd_t)
+corenet_udp_sendrecv_all_nodes(nsd_t)
+corenet_raw_sendrecv_all_nodes(nsd_t)
+corenet_tcp_sendrecv_all_ports(nsd_t)
+corenet_udp_sendrecv_all_ports(nsd_t)
+corenet_non_ipsec_sendrecv(nsd_t)
+corenet_tcp_bind_all_nodes(nsd_t)
+corenet_udp_bind_all_nodes(nsd_t)
+corenet_tcp_bind_dns_port(nsd_t)
+corenet_udp_bind_dns_port(nsd_t)
+
+dev_read_sysfs(nsd_t)
+
+domain_use_interactive_fds(nsd_t)
+
+files_read_etc_files(nsd_t)
+files_read_etc_runtime_files(nsd_t)
+
+fs_getattr_all_fs(nsd_t)
+fs_search_auto_mountpoints(nsd_t)
+
+term_dontaudit_use_console(nsd_t)
+
+init_use_fds(nsd_t)
+init_use_script_ptys(nsd_t)
+
+libs_use_ld_so(nsd_t)
+libs_use_shared_libs(nsd_t)
+
+logging_send_syslog_msg(nsd_t)
+
+miscfiles_read_localization(nsd_t)
+
+sysnet_read_config(nsd_t)
+
+userdom_dontaudit_use_unpriv_user_fds(nsd_t)
+userdom_dontaudit_search_sysadm_home_dirs(nsd_t)
+
+ifdef(`targeted_policy',`
+ term_dontaudit_use_unallocated_ttys(nsd_t)
+ term_dontaudit_use_generic_ptys(nsd_t)
+ files_dontaudit_read_root_files(nsd_t)
+')
+
+optional_policy(`
+ nis_use_ypbind(nsd_t)
+')
+
+optional_policy(`
+ seutil_sigchld_newrole(nsd_t)
+')
+
+optional_policy(`
+ udev_read_db(nsd_t)
+')
+
+########################################
+#
+# Zone update cron job local policy
+#
+
+# kill capability for root cron job and non-root daemon
+allow nsd_crond_t self:capability { dac_override kill };
+dontaudit nsd_crond_t self:capability sys_nice;
+allow nsd_crond_t self:process { setsched signal_perms };
+allow nsd_crond_t self:fifo_file rw_file_perms;
+allow nsd_crond_t self:tcp_socket create_socket_perms;
+allow nsd_crond_t self:udp_socket create_socket_perms;
+
+allow nsd_crond_t nsd_conf_t:file { getattr read ioctl };
+
+allow nsd_crond_t nsd_db_t:file manage_file_perms;
+type_transition nsd_crond_t nsd_zone_t:file nsd_db_t;
+allow nsd_crond_t nsd_zone_t:dir rw_dir_perms;
+files_search_var_lib(nsd_crond_t)
+
+allow nsd_crond_t nsd_t:process signal;
+allow nsd_crond_t nsd_t:dir { search getattr read };
+allow nsd_crond_t nsd_t:{ file lnk_file } { read getattr };
+allow nsd_crond_t nsd_t:process getattr;
+
+allow nsd_crond_t nsd_zone_t:file manage_file_perms;
+allow nsd_crond_t nsd_zone_t:dir rw_dir_perms;
+type_transition nsd_crond_t nsd_conf_t:file nsd_zone_t;
+allow nsd_crond_t nsd_conf_t:dir rw_dir_perms;
+
+can_exec(nsd_crond_t,nsd_exec_t)
+
+kernel_read_system_state(nsd_crond_t)
+
+corecmd_exec_bin(nsd_crond_t)
+corecmd_exec_sbin(nsd_crond_t)
+corecmd_exec_shell(nsd_crond_t)
+
+corenet_non_ipsec_sendrecv(nsd_crond_t)
+corenet_tcp_sendrecv_generic_if(nsd_crond_t)
+corenet_udp_sendrecv_generic_if(nsd_crond_t)
+corenet_raw_sendrecv_generic_if(nsd_crond_t)
+corenet_tcp_sendrecv_all_nodes(nsd_crond_t)
+corenet_udp_sendrecv_all_nodes(nsd_crond_t)
+corenet_raw_sendrecv_all_nodes(nsd_crond_t)
+corenet_tcp_sendrecv_all_ports(nsd_crond_t)
+corenet_udp_sendrecv_all_ports(nsd_crond_t)
+corenet_tcp_bind_all_nodes(nsd_crond_t)
+corenet_udp_bind_all_nodes(nsd_crond_t)
+corenet_tcp_connect_all_ports(nsd_crond_t)
+
+# for SSP
+dev_read_urand(nsd_crond_t)
+
+domain_dontaudit_read_all_domains_state(nsd_crond_t)
+
+files_read_etc_files(nsd_crond_t)
+files_read_etc_runtime_files(nsd_crond_t)
+files_search_var_lib(nsd_t)
+
+libs_use_ld_so(nsd_crond_t)
+libs_use_shared_libs(nsd_crond_t)
+
+logging_send_syslog_msg(nsd_crond_t)
+
+miscfiles_read_localization(nsd_crond_t)
+
+sysnet_read_config(nsd_crond_t)
+
+userdom_dontaudit_search_sysadm_home_dirs(nsd_crond_t)
+
+optional_policy(`
+ cron_system_entry(nsd_crond_t,nsd_exec_t)
+')
+
+optional_policy(`
+ nis_use_ypbind(nsd_crond_t)
+')
+
+optional_policy(`
+ nscd_read_pid(nsd_crond_t)
+')
More information about the scm-commits
mailing list