CouchDB with SELinux

[Michael Milverton]

Oops, sorry,

Is this what you want?

#
policy_module(couchdb, 1.0.0)

########################################
#
# Declarations
#

permissive couchdb_t;

type couchdb_t;
type couchdb_exec_t;
init_daemon_domain(couchdb_t, couchdb_exec_t)

type couchdb_initrc_exec_t;
init_script_file(couchdb_initrc_exec_t)

type couchdb_etc_t;
files_config_file(couchdb_etc_t)

type couchdb_tmp_t;
files_tmp_file(couchdb_tmp_t)

type couchdb_var_lib_t;
files_type(couchdb_var_lib_t)

type couchdb_var_log_t;
logging_log_file(couchdb_var_log_t)

type couchdb_var_run_t;
files_pid_file(couchdb_var_run_t)

########################################
#
# Local policy
#

allow couchdb_t self:process { setsched signal signull sigkill };
allow couchdb_t self:fifo_file rw_fifo_file_perms;
allow couchdb_t self:tcp_socket create_stream_socket_perms;
allow couchdb_t self:udp_socket create_socket_perms;

allow couchdb_t couchdb_etc_t:dir list_dir_perms;
read_files_pattern(couchdb_t, couchdb_etc_t, couchdb_etc_t)

manage_files_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t)
files_tmp_filetrans(couchdb_t, couchdb_tmp_t, file)

manage_dirs_pattern(couchdb_t, couchdb_var_lib_t, couchdb_var_lib_t)
manage_files_pattern(couchdb_t, couchdb_var_lib_t, couchdb_var_lib_t)

create_files_pattern(couchdb_t, couchdb_var_log_t, couchdb_var_log_t)
append_files_pattern(couchdb_t, couchdb_var_log_t, couchdb_var_log_t)

manage_files_pattern(couchdb_t, couchdb_var_run_t, couchdb_var_run_t)

can_exec(couchdb_t, couchdb_exec_t)

kernel_read_system_state(couchdb_t)

# 5984
corenet_sendrecv_vnc_server_packets(couchdb_t)
corenet_tcp_bind_generic_node(couchdb_t)
corenet_tcp_bind_vnc_port(couchdb_t)
corenet_tcp_sendrecv_vnc_port(couchdb_t)
corenet_udp_bind_generic_node(couchdb_t)

# basename, /usr/lib/erlang/erts-5.8.3/bin/erl
corecmd_exec_bin(couchdb_t)
corecmd_exec_shell(couchdb_t)

dev_read_sysfs(couchdb_t)
dev_read_urand(couchdb_t)

# /usr/share/couchdb/www/index.html
files_read_usr_files(couchdb_t)

# /
fs_getattr_xattr_fs(couchdb_t)

miscfiles_read_localization(couchdb_t)

optional_policy(`
# /usr/lib/erlang/erts-5.8.3/bin/beam.smp
execmem_exec(couchdb_t)
')

On Tue, Mar 13, 2012 at 10:07 PM, Daniel J Walsh <dwalsh at redhat.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 03/13/2012 10:04 AM, Michael Milverton wrote:
> > Thanks Dan,
> >
> > I don't have access to Fedora 17 at the moment so I can't test it
> > but I will write a small python script this weekend so you can test
> > it if you like. My feeling is that it  won't work properly like it
> > is because the fc file doesn't include couchjs, the JavaScript
> > compiler. I think that was the main issue I had if I remember
> > correctly.
> >
> > Could you test the policy I attached as that seemed to work on
> > Fedora 15 or is it too outdated? It was for couchdb 1.0.2.
> >
> > P.S If you can wait a couple of weeks I should be able to get
> > Fedora 17 running. It takes time because I have limited bandwidth
> > (wireless) at the moment.
> >
> > Thanks Michael
> >
> > On 12/03/2012, at 21:54, Daniel J Walsh <dwalsh at redhat.com> wrote:
> >
> > I wrote my own policy for couchdb using sepolgen for Fedora 17.
> >
> > Totally untested, since I have no idea how to use couchdb.
> >
> > Fixed avc's created by starting and stopping the service.
> >
> > ps -eZ | grep couch system_u:system_r:couchdb_t:s0   4103 ?
> > 00:00:00 couchdb system_u:system_r:couchdb_t:s0   4113 ?
> > 00:00:00 couchdb system_u:system_r:couchdb_t:s0   4114 ?
> > 00:00:00 beam.smp system_u:system_r:couchdb_t:s0   4130 ?
> > 00:00:00 heart
> >
> > Might want to write separate polciy for heart?  beam.smp?
> >
> > I added port definitions for tcp port couchdb_port_t 5984 and
> > 6984.
> >> <couchdb.te> <couchdb.if> <couchdb.fc> <couchdb.sh>
> > -- selinux mailing list selinux at lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
>
> The policy you attached did not include any allow rules.  Could you
> mail me the original source, te file.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk9fVKEACgkQrlYvE4MpobOUEgCg296xb2E45lvFOO4kS1vYDq44
> hJsAn0A5YF19vItKoLibqKUG7mZm6FZi
> =LrXW
> -----END PGP SIGNATURE-----
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/selinux/attachments/20120313/bdcde29e/attachment.html>