[kup/el6] Add SELinux policy to be tracked in this package.
Konstantin Ryabitsev
icon at fedoraproject.org
Thu Dec 1 16:13:02 UTC 2011
commit d8bc3a2db628deac32ebf13a92297b01d389ef36
Author: Konstantin Ryabitsev <mricon at kernel.org>
Date: Thu Dec 1 11:12:35 2011 -0500
Add SELinux policy to be tracked in this package.
kup.fc | 8 +++
kup.if | 160 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
kup.sh | 60 ++++++++++++++++++++++++
kup.te | 93 +++++++++++++++++++++++++++++++++++++
4 files changed, 321 insertions(+), 0 deletions(-)
---
diff --git a/kup.fc b/kup.fc
new file mode 100644
index 0000000..1795d34
--- /dev/null
+++ b/kup.fc
@@ -0,0 +1,8 @@
+/usr/bin/kup-server -- gen_context(system_u:object_r:kup_server_exec_t,s0)
+/etc/kup(/.*)? gen_context(system_u:object_r:kup_server_etc_t,s0)
+/var/lib/kup gen_context(system_u:object_r:kup_server_var_lib_t,s0)
+/var/lib/kup/pgp(/.*)? gen_context(system_u:object_r:kup_server_var_lib_t,s0)
+/var/lib/kup/pub(/.*)? gen_context(system_u:object_r:kup_server_content_rw_t,s0)
+/var/lib/kup/tmp(/.*)? gen_context(system_u:object_r:kup_server_content_rw_t,s0)
+/var/run/kup(/.*)? gen_context(system_u:object_r:kup_server_var_run_t,s0)
+
diff --git a/kup.if b/kup.if
new file mode 100644
index 0000000..9daa425
--- /dev/null
+++ b/kup.if
@@ -0,0 +1,160 @@
+
+## <summary>policy for kup-server</summary>
+
+
+########################################
+## <summary>
+## Execute a domain transition to run kup.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kup_server_domtrans',`
+ gen_require(`
+ type kup_server_t, kup_server_exec_t;
+ ')
+
+ domtrans_pattern($1, kup_server_exec_t, kup_server_t)
+')
+
+
+########################################
+## <summary>
+## Read content uploaded via kup.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kup_server_read_content',`
+ gen_require(`
+ type kup_server_content_rw_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, kup_server_content_rw_t, kup_server_content_rw_t)
+ list_dirs_pattern($1, kup_server_content_rw_t, kup_server_content_rw_t)
+')
+
+########################################
+## <summary>
+## Create, read, write, and delete
+## content uploaded via kup.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kup_server_manage_content',`
+ gen_require(`
+ type kup_server_content_rw_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, kup_server_content_rw_t, kup_server_content_rw_t)
+ manage_dirs_pattern($1, kup_server_content_rw_t, kup_server_content_rw_t)
+')
+
+
+########################################
+## <summary>
+## Execute kup in the kup domain, and
+## allow the specified role the kup domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role to be allowed the kup domain.
+## </summary>
+## </param>
+#
+interface(`kup_server_run',`
+ gen_require(`
+ type kup_server_t;
+ ')
+
+ kup_server_domtrans($1)
+ role $2 types kup_server_t;
+ allow $1 kup_server_t:process { siginh noatsecure rlimitinh };
+')
+
+########################################
+## <summary>
+## Role access for kup
+## </summary>
+## <param name="role">
+## <summary>
+## Role allowed access
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## User domain for the role
+## </summary>
+## </param>
+#
+interface(`kup_server_role',`
+ gen_require(`
+ type kup_server_t;
+ ')
+
+ role $1 types kup_server_t;
+
+ kup_server_domtrans($2)
+
+ ps_process_pattern($2, kup_server_t)
+ allow $2 kup_server_t:process signal;
+')
+
+
+########################################
+## <summary>
+## All of the rules required to administrate
+## an kup environment
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`kup_server_admin',`
+ gen_require(`
+ type kup_server_t;
+ type kup_server_etc_t;
+ type kup_server_var_lib_t;
+ type kup_server_content_rw_t;
+ type kup_server_var_run_t;
+ ')
+
+ allow $1 kup_server_t:process { ptrace signal_perms };
+ ps_process_pattern($1, kup_server_t)
+
+ files_search_etc($1)
+ admin_pattern($1, kup_server_etc_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, kup_server_var_lib_t)
+ admin_pattern($1, kup_server_content_rw_t)
+
+ files_search_pids($1)
+ admin_pattern($1, kup_server_var_run_t)
+
+')
diff --git a/kup.sh b/kup.sh
new file mode 100755
index 0000000..8dbbd56
--- /dev/null
+++ b/kup.sh
@@ -0,0 +1,60 @@
+#!/bin/sh -e
+
+DIRNAME=`dirname $0`
+cd $DIRNAME
+USAGE="$0 [ --update ]"
+if [ `id -u` != 0 ]; then
+echo 'You must be root to run this script'
+exit 1
+fi
+
+if [ $# -eq 1 ]; then
+ if [ "$1" = "--update" ] ; then
+ time=`ls -l --time-style="+%x %X" kup.te | awk '{ printf "%s %s", $6, $7 }'`
+ rules=`ausearch --start $time -m avc --raw -se kup`
+ if [ x"$rules" != "x" ] ; then
+ echo "Found avc's to update policy with"
+ echo -e "$rules" | audit2allow -R
+ echo "Do you want these changes added to policy [y/n]?"
+ read ANS
+ if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then
+ echo "Updating policy"
+ echo -e "$rules" | audit2allow -R >> kup.te
+ # Fall though and rebuild policy
+ else
+ exit 0
+ fi
+ else
+ echo "No new avcs found"
+ exit 0
+ fi
+ else
+ echo -e $USAGE
+ exit 1
+ fi
+elif [ $# -ge 2 ] ; then
+ echo -e $USAGE
+ exit 1
+fi
+
+echo "Building and Loading Policy"
+set -x
+make -f /usr/share/selinux/devel/Makefile
+/usr/sbin/semodule -i kup.pp
+
+# Fixing the file context on /usr/bin/kup-server
+/sbin/restorecon -F -R -v /usr/bin/kup-server
+# Fixing the file context on /var/run/kup/lock
+/sbin/restorecon -F -R -v /var/run/kup/lock
+# Fixing the file context on /var/lib/kup
+/sbin/restorecon -F -R -v /var/lib/kup
+# Fixing the file context on /var/lib/kup/pub
+/sbin/restorecon -F -R -v /var/lib/kup/pub
+# Fixing the file context on /var/lib/kup/pgp
+/sbin/restorecon -F -R -v /var/lib/kup/pgp
+# Fixing the file context on /var/run/kup
+/sbin/restorecon -F -R -v /var/run/kup
+# Fixing the file context on /var/lib/kup/tmp
+/sbin/restorecon -F -R -v /var/lib/kup/tmp
+# Fixing the file context on /etc/kup
+/sbin/restorecon -F -R -v /etc/kup
diff --git a/kup.te b/kup.te
new file mode 100644
index 0000000..5e3ddfb
--- /dev/null
+++ b/kup.te
@@ -0,0 +1,93 @@
+policy_module(kup,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type kup_server_t;
+type kup_server_exec_t;
+application_domain(kup_server_t, kup_server_exec_t)
+role system_r types kup_server_t;
+
+type kup_server_etc_t;
+files_config_file(kup_server_etc_t);
+
+type kup_server_var_lib_t;
+files_type(kup_server_var_lib_t)
+
+type kup_server_content_rw_t;
+files_type(kup_server_content_rw_t)
+
+type kup_server_var_run_t;
+# not really a pid file, but the policy suits what we want to do
+files_pid_file(kup_server_var_run_t)
+
+########################################
+#
+# kup_server local policy
+#
+
+allow kup_server_t self:fifo_file manage_fifo_file_perms;
+allow kup_server_t self:process setrlimit;
+
+read_files_pattern(kup_server_t, kup_server_etc_t, kup_server_etc_t)
+read_files_pattern(kup_server_t, kup_server_var_lib_t, kup_server_var_lib_t)
+
+manage_files_pattern(kup_server_t, kup_server_content_rw_t, kup_server_content_rw_t)
+manage_dirs_pattern(kup_server_t, kup_server_content_rw_t, kup_server_content_rw_t)
+files_var_lib_filetrans(kup_server_t, kup_server_content_rw_t, { dir file })
+
+manage_dirs_pattern(kup_server_t, kup_server_var_run_t, kup_server_var_run_t)
+manage_files_pattern(kup_server_t, kup_server_var_run_t, kup_server_var_run_t)
+files_pid_filetrans(kup_server_t, kup_server_var_run_t, { dir file })
+
+domain_use_interactive_fds(kup_server_t)
+
+# used internally by perl to load modules and localizations
+files_read_usr_files(kup_server_t)
+miscfiles_read_localization(kup_server_t)
+# looking up user info
+auth_use_nsswitch(kup_server_t)
+# sending logs to syslog
+logging_send_syslog_msg(kup_server_t)
+# gathering entropy for uniqueness
+dev_read_urand(kup_server_t)
+# accessing git trees for kup put --tar and --diff
+git_read_generic_system_content_files(kup_server_t)
+# executing gzip, bzip2, xz
+corecmd_exec_bin(kup_server_t)
+# xz wants to read /proc/meminfo
+kernel_read_system_state(kup_server_t)
+# Temp.pm wants to stat bits in the userdir
+files_search_home(kup_server_t)
+userdom_search_user_home_dirs(kup_server_t)
+userdom_getattr_user_home_dirs(kup_server_t)
+
+optional_policy(`
+ gen_require(`
+ type staff_t;
+ role staff_r;
+ ')
+
+ kup_server_run(staff_t, staff_r)
+')
+
+optional_policy(`
+ gen_require(`
+ type user_t;
+ role user_r;
+ ')
+
+ kup_server_run(user_t, user_r)
+')
+
+optional_policy(`
+ gen_require(`
+ type guest_t;
+ role guest_r;
+ ')
+
+ kup_server_run(guest_t, guest_r)
+')
+
More information about the scm-commits
mailing list