[selinux-policy: 2619/3172] Ntop policy from Dan Walsh

[Daniel J Walsh]

commit 4f7b413cdc4b54f1d2b83fa2340647d83702f06a
Author: Jeremy Solt <jsolt at tresys.com>
Date:   Thu Apr 8 10:28:53 2010 -0400

    Ntop policy from Dan Walsh
    
    Added alias for ntop_http_content_t in apache
    Pulled in ntop port from corenetwork patch

 policy/modules/kernel/corenetwork.te.in |    1 +
 policy/modules/services/apache.te       |    1 +
 policy/modules/services/ntop.te         |   34 +++++++++++++++++++++----------
 3 files changed, 25 insertions(+), 11 deletions(-)
---
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index 48baaa1..0da4215 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -146,6 +146,7 @@ network_port(nessus, tcp,1241,s0)
 network_port(netsupport, tcp,5404,s0, udp,5404,s0, tcp,5405,s0, udp,5405,s0)
 network_port(nmbd, udp,137,s0, udp,138,s0)
 network_port(ntp, udp,123,s0)
+network_port(ntop, tcp,3000,s0, udp,3000,s0, tcp,3001,s0, udp,3001,s0)
 network_port(ocsp, tcp,9080,s0)
 network_port(openvpn, tcp,1194,s0, udp,1194,s0)
 network_port(pegasus_http, tcp,5988,s0)
diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index 39585ec..e0779a0 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -217,6 +217,7 @@ files_tmp_file(httpd_suexec_tmp_t)
 
 # setup the system domain for system CGI scripts
 apache_content_template(sys)
+typealias httpd_sys_content_t alias ntop_http_content_t;
 
 type httpd_tmp_t;
 files_tmp_file(httpd_tmp_t)
diff --git a/policy/modules/services/ntop.te b/policy/modules/services/ntop.te
index 45d23d5..b9210ed 100644
--- a/policy/modules/services/ntop.te
+++ b/policy/modules/services/ntop.te
@@ -11,12 +11,12 @@ type ntop_exec_t;
 init_daemon_domain(ntop_t, ntop_exec_t)
 application_domain(ntop_t, ntop_exec_t)
 
+type ntop_initrc_exec_t;
+init_script_file(ntop_initrc_exec_t)
+
 type ntop_etc_t;
 files_config_file(ntop_etc_t)
 
-type ntop_http_content_t;
-files_type(ntop_http_content_t)
-
 type ntop_tmp_t;
 files_tmp_file(ntop_tmp_t)
 
@@ -37,26 +37,28 @@ allow ntop_t self:process signal_perms;
 allow ntop_t self:fifo_file rw_fifo_file_perms;
 allow ntop_t self:tcp_socket create_stream_socket_perms;
 allow ntop_t self:udp_socket create_socket_perms;
+allow ntop_t self:unix_dgram_socket create_socket_perms;
+allow ntop_t self:unix_stream_socket create_stream_socket_perms;
 allow ntop_t self:packet_socket create_socket_perms;
+allow ntop_t self:socket create_socket_perms;
 
 allow ntop_t ntop_etc_t:dir list_dir_perms;
 read_files_pattern(ntop_t, ntop_etc_t, ntop_etc_t)
 read_lnk_files_pattern(ntop_t, ntop_etc_t, ntop_etc_t)
 
-allow ntop_t ntop_http_content_t:dir list_dir_perms;
-read_files_pattern(ntop_t, ntop_http_content_t, ntop_http_content_t)
-
 manage_dirs_pattern(ntop_t, ntop_tmp_t, ntop_tmp_t)
 manage_files_pattern(ntop_t, ntop_tmp_t, ntop_tmp_t)
 files_tmp_filetrans(ntop_t, ntop_tmp_t, { file dir })
 
-create_dirs_pattern(ntop_t, ntop_var_lib_t, ntop_var_lib_t)
-manage_files_pattern(ntop_t, ntop_var_lib_t, ntop_var_lib_t)
-files_var_lib_filetrans(ntop_t, ntop_var_lib_t, file)
+manage_dirs_pattern(ntop_t, ntop_var_lib_t,  ntop_var_lib_t)
+manage_files_pattern(ntop_t, ntop_var_lib_t,  ntop_var_lib_t)
+files_var_lib_filetrans(ntop_t, ntop_var_lib_t, { file dir } )
 
 manage_files_pattern(ntop_t, ntop_var_run_t, ntop_var_run_t)
 files_pid_filetrans(ntop_t, ntop_var_run_t, file)
 
+kernel_request_load_module(ntop_t)
+kernel_read_system_state(ntop_t)
 kernel_read_network_state(ntop_t)
 kernel_read_kernel_sysctls(ntop_t)
 kernel_list_proc(ntop_t)
@@ -72,26 +74,36 @@ corenet_udp_sendrecv_generic_node(ntop_t)
 corenet_raw_sendrecv_generic_node(ntop_t)
 corenet_tcp_sendrecv_all_ports(ntop_t)
 corenet_udp_sendrecv_all_ports(ntop_t)
+corenet_tcp_bind_ntop_port(ntop_t)
+corenet_tcp_connect_ntop_port(ntop_t)
+corenet_tcp_connect_http_port(ntop_t)
 
 dev_read_sysfs(ntop_t)
+dev_rw_generic_usb_dev(ntop_t)
 
 domain_use_interactive_fds(ntop_t)
 
 files_read_etc_files(ntop_t)
+files_read_usr_files(ntop_t)
 
 fs_getattr_all_fs(ntop_t)
 fs_search_auto_mountpoints(ntop_t)
 
+auth_use_nsswitch(ntop_t)
+
 logging_send_syslog_msg(ntop_t)
 
 miscfiles_read_localization(ntop_t)
-
-sysnet_read_config(ntop_t)
+miscfiles_read_fonts(ntop_t)
 
 userdom_dontaudit_use_unpriv_user_fds(ntop_t)
 userdom_dontaudit_search_user_home_dirs(ntop_t)
 
 optional_policy(`
+	apache_read_sys_content(ntop_t)
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(ntop_t)
 ')