[selinux-policy: 2165/3172] afs client patch from dan.

[Daniel J Walsh]

commit 13306f56b6512c89de9f14f72dca3d897f493ab7
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Tue Jul 21 10:11:03 2009 -0400

    afs client patch from dan.

 policy/modules/services/afs.fc |    9 +++
 policy/modules/services/afs.if |  106 ++++++++++++++++++++++++++++++++++++++++
 policy/modules/services/afs.te |   50 ++++++++++++++++++-
 3 files changed, 164 insertions(+), 1 deletions(-)
---
diff --git a/policy/modules/services/afs.fc b/policy/modules/services/afs.fc
index 1689223..15a4a62 100644
--- a/policy/modules/services/afs.fc
+++ b/policy/modules/services/afs.fc
@@ -1,3 +1,6 @@
+/etc/rc\.d/init\.d/openafs-client -- gen_context(system_u:object_r:afs_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/afs	--	gen_context(system_u:object_r:afs_initrc_exec_t,s0)
+
 /usr/afs/bin/bosserver	--	gen_context(system_u:object_r:afs_bosserver_exec_t,s0)
 /usr/afs/bin/fileserver	--	gen_context(system_u:object_r:afs_fsserver_exec_t,s0)
 /usr/afs/bin/kaserver	--	gen_context(system_u:object_r:afs_kaserver_exec_t,s0)
@@ -17,6 +20,12 @@
 
 /usr/afs/logs(/.*)?		gen_context(system_u:object_r:afs_logfile_t,s0)
 
+/usr/sbin/afsd		--	gen_context(system_u:object_r:afs_exec_t,s0)
+
+/usr/vice/etc/afsd	--	gen_context(system_u:object_r:afs_exec_t,s0)
+
+/var/cache/afs(/.*)?		gen_context(system_u:object_r:afs_cache_t,s0)
+
 /vicepa				gen_context(system_u:object_r:afs_files_t,s0)
 /vicepb				gen_context(system_u:object_r:afs_files_t,s0)
 /vicepc				gen_context(system_u:object_r:afs_files_t,s0)
diff --git a/policy/modules/services/afs.if b/policy/modules/services/afs.if
index e84153f..2a798ea 100644
--- a/policy/modules/services/afs.if
+++ b/policy/modules/services/afs.if
@@ -1 +1,107 @@
 ## <summary>Andrew Filesystem server</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run the
+##	afs client.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`afs_domtrans',`
+	gen_require(`
+		type afs_t, afs_exec_t;
+	')
+
+	domtrans_pattern($1, afs_exec_t, afs_t)
+')
+
+########################################
+## <summary>
+##	Read and write afs client UDP sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`afs_rw_udp_sockets',`
+	gen_require(`
+		type afs_t;
+	')
+
+	allow $1 afs_t:udp_socket { read write };
+')
+
+########################################
+## <summary>
+##	read/write afs cache files
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`afs_rw_cache',`
+	gen_require(`
+		type afs_cache_t;
+	')
+
+	allow $1 afs_cache_t:file { read write };
+')
+
+########################################
+## <summary>
+##	Execute afs server in the afs domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`afs_initrc_domtrans',`
+	gen_require(`
+		type afs_initrc_exec_t;
+	')
+
+	init_script_domtrans_spec($1, afs_initrc_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an afs environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the afs domain.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`afs_admin',`
+	gen_require(`
+		type afs_t, afs_initrc_exec_t;
+	')
+
+	allow $1 afs_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, afs_t, afs_t)
+
+	# Allow afs_t to restart the apache service
+	afs_initrc_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 afs_initrc_exec_t system_r;
+	allow $2 system_r;
+
+')
diff --git a/policy/modules/services/afs.te b/policy/modules/services/afs.te
index b7403e0..76affc1 100644
--- a/policy/modules/services/afs.te
+++ b/policy/modules/services/afs.te
@@ -1,15 +1,22 @@
 
-policy_module(afs, 1.4.1)
+policy_module(afs, 1.4.2)
 
 ########################################
 #
 # Declarations
 #
 
+type afs_t;
+type afs_exec_t;
+init_daemon_domain(afs_t, afs_exec_t)
+
 type afs_bosserver_t;
 type afs_bosserver_exec_t;
 init_daemon_domain(afs_bosserver_t, afs_bosserver_exec_t)
 
+type afs_cache_t;
+files_type(afs_cache_t)
+
 type afs_config_t;
 files_type(afs_config_t)
 
@@ -26,6 +33,9 @@ domain_type(afs_fsserver_t)
 domain_entry_file(afs_fsserver_t, afs_fsserver_exec_t)
 role system_r types afs_fsserver_t;
 
+type afs_initrc_exec_t;
+init_script_file(afs_initrc_exec_t)
+
 type afs_ka_db_t;
 files_type(afs_ka_db_t)
 
@@ -58,6 +68,44 @@ role system_r types afs_vlserver_t;
 
 ########################################
 #
+# afs client local policy
+#
+
+allow afs_t self:capability { sys_nice sys_tty_config };
+allow afs_t self:process setsched;
+allow afs_t self:udp_socket create_socket_perms;
+allow afs_t self:fifo_file rw_file_perms;
+allow afs_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_files_pattern(afs_t, afs_cache_t, afs_cache_t)
+manage_dirs_pattern(afs_t, afs_cache_t, afs_cache_t)
+files_var_filetrans(afs_t, afs_cache_t, { file dir })
+
+files_mounton_mnt(afs_t)
+files_read_etc_files(afs_t)
+files_rw_etc_runtime_files(afs_t)
+
+fs_getattr_xattr_fs(afs_t)
+fs_mount_nfs(afs_t)
+
+kernel_rw_afs_state(afs_t)
+
+corenet_all_recvfrom_unlabeled(afs_t)
+corenet_all_recvfrom_netlabel(afs_t)
+corenet_tcp_sendrecv_generic_if(afs_t)
+corenet_udp_sendrecv_generic_if(afs_t)
+corenet_tcp_sendrecv_generic_node(afs_t)
+corenet_udp_sendrecv_generic_node(afs_t)
+corenet_tcp_sendrecv_all_ports(afs_t)
+corenet_udp_sendrecv_all_ports(afs_t)
+corenet_udp_bind_generic_node(afs_t)
+
+logging_send_syslog_msg(afs_t)
+
+miscfiles_read_localization(afs_t)
+
+########################################
+#
 # AFS bossserver local policy
 #