pool/selinux-policy
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
a7283c99d6
selinux-policy/wicked.if
Johannes Segitz e10fb17535 Accepting request 810877 from home:jsegitz:branches:security:SELinux 
- Added module for wicked
- New patches:
  * fix_authlogin.patch
  * fix_screen.patch
  * fix_unprivuser.patch
  * fix_rpm.patch
  * fix_apache.patch

- Added module for rtorrent
- Enable snapper module in minimum policy to reduce issues on BTRFS
  Updated fix_snapper.patch to prevent relabling of snapshot

OBS-URL: https://build.opensuse.org/request/show/810877
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=76
2020-06-02 15:31:08 +00:00

655 lines
15 KiB
Plaintext
Raw Blame History

## <summary>Manager for dynamically switching between networks.</summary>
########################################
## <summary>
## Read and write wicked UDP sockets.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
# cjp: added for named.
interface(`wicked_rw_udp_sockets',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:udp_socket { read write };
')
########################################
## <summary>
## Read and write wicked packet sockets.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
# cjp: added for named.
interface(`wicked_rw_packet_sockets',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:packet_socket { read write };
')
#######################################
## <summary>
## Allow caller to relabel tun_socket
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_attach_tun_iface',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:tun_socket relabelfrom;
allow $1 self:tun_socket relabelto;
')
########################################
## <summary>
## Read and write wicked netlink
## routing sockets.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
# cjp: added for named.
interface(`wicked_rw_routing_sockets',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:netlink_route_socket { read write };
')
########################################
## <summary>
## Execute wicked with a domain transition.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`wicked_domtrans',`
gen_require(`
type wicked_t, wicked_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, wicked_exec_t, wicked_t)
')
#######################################
## <summary>
## Execute wicked scripts with an automatic domain transition to initrc.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`wicked_initrc_domtrans',`
gen_require(`
type wicked_initrc_exec_t;
')
init_labeled_script_domtrans($1, wicked_initrc_exec_t)
')
#######################################
## <summary>
## Allow reading of wicked link files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to read the links
## </summary>
## </param>
#
interface(`wicked_initrc_read_lnk_files',`
gen_require(`
type wicked_initrc_exec_t;
')
read_lnk_files_pattern($1, wicked_initrc_exec_t, wicked_initrc_exec_t)
')
########################################
## <summary>
## Execute wicked server in the wicked domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`wicked_systemctl',`
gen_require(`
type wicked_unit_file_t;
type wicked_t;
')
systemd_exec_systemctl($1)
init_reload_services($1)
allow $1 wicked_unit_file_t:file read_file_perms;
allow $1 wicked_unit_file_t:service manage_service_perms;
ps_process_pattern($1, wicked_t)
')
########################################
## <summary>
## Send and receive messages from
## wicked over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_dbus_chat',`
gen_require(`
type wicked_t;
class dbus send_msg;
')
allow $1 wicked_t:dbus send_msg;
allow wicked_t $1:dbus send_msg;
')
#######################################
## <summary>
## Read metworkmanager process state files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_read_state',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:dir search_dir_perms;
allow $1 wicked_t:file read_file_perms;
allow $1 wicked_t:lnk_file read_lnk_file_perms;
')
########################################
## <summary>
## Do not audit attempts to send and
## receive messages from wicked
## over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`wicked_dontaudit_dbus_chat',`
gen_require(`
type wicked_t;
class dbus send_msg;
')
dontaudit $1 wicked_t:dbus send_msg;
dontaudit wicked_t $1:dbus send_msg;
')
########################################
## <summary>
## Send a generic signal to wicked
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_signal',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:process signal;
')
########################################
## <summary>
## Create, read, and write
## wicked library files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_manage_lib_files',`
gen_require(`
type wicked_var_lib_t;
')
files_search_var_lib($1)
manage_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
allow $1 wicked_var_lib_t:file map;
')
########################################
## <summary>
## Read wicked lib files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_read_lib_files',`
gen_require(`
type wicked_var_lib_t;
')
files_search_var_lib($1)
list_dirs_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
read_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
allow $1 wicked_var_lib_t:file map;
')
#######################################
## <summary>
## Read wicked conf files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_read_conf',`
gen_require(`
type wicked_etc_t;
type wicked_etc_rw_t;
')
allow $1 wicked_etc_t:dir list_dir_perms;
read_files_pattern($1,wicked_etc_t,wicked_etc_t)
read_files_pattern($1,wicked_etc_rw_t,wicked_etc_rw_t)
')
########################################
## <summary>
## Read wicked PID files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_read_pid_files',`
gen_require(`
type wicked_var_run_t;
')
files_search_pids($1)
read_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
')
########################################
## <summary>
## Manage wicked PID files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_manage_pid_files',`
gen_require(`
type wicked_var_run_t;
')
files_search_pids($1)
manage_dirs_pattern($1, wicked_var_run_t, wicked_var_run_t)
manage_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
')
########################################
## <summary>
## Manage wicked PID sock files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_manage_pid_sock_files',`
gen_require(`
type wicked_var_run_t;
')
files_search_pids($1)
manage_sock_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
')
########################################
## <summary>
## Create objects in /etc with a private
## type using a type_transition.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="file_type">
## <summary>
## Private file type.
## </summary>
## </param>
## <param name="class">
## <summary>
## Object classes to be created.
## </summary>
## </param>
## <param name="name" optional="true">
## <summary>
## The name of the object being created.
## </summary>
## </param>
#
interface(`wicked_pid_filetrans',`
gen_require(`
type wicked_var_run_t;
')
filetrans_pattern($1, wicked_var_run_t, $2, $3, $4)
')
####################################
## <summary>
## Connect to wicked over
## a unix domain stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_stream_connect',`
gen_require(`
type wicked_t, wicked_var_run_t;
')
files_search_pids($1)
stream_connect_pattern($1, wicked_var_run_t, wicked_var_run_t, wicked_t)
')
########################################
## <summary>
## Delete wicked PID files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_delete_pid_files',`
gen_require(`
type wicked_var_run_t;
')
files_search_pids($1)
delete_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
')
########################################
## <summary>
## Execute wicked in the wicked domain, and
## allow the specified role the wicked domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`wicked_run',`
gen_require(`
type wicked_t, wicked_exec_t;
')
wicked_domtrans($1)
role $2 types wicked_t;
')
########################################
## <summary>
## Allow the specified domain to append
## to Network Manager log files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_append_log',`
gen_require(`
type wicked_log_t;
')
logging_search_logs($1)
allow $1 wicked_log_t:dir list_dir_perms;
append_files_pattern($1, wicked_log_t, wicked_log_t)
allow $1 wicked_log_t:file map;
')
#######################################
## <summary>
## Allow the specified domain to manage
## to Network Manager lib files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_manage_lib',`
gen_require(`
type wicked_var_lib_t;
')
manage_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
allow $1 wicked_var_lib_t:file map;
')
#######################################
## <summary>
## Send to wicked with a unix dgram socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_dgram_send',`
gen_require(`
type wicked_t, wicked_var_run_t;
')
files_search_pids($1)
dgram_send_pattern($1, wicked_var_run_t, wicked_var_run_t, wicked_t)
')
########################################
## <summary>
## Send sigchld to wicked.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
#
interface(`wicked_sigchld',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:process sigchld;
')
########################################
## <summary>
## Send signull to wicked.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
#
interface(`wicked_signull',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:process signull;
')
########################################
## <summary>
## Send sigkill to wicked.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
#
interface(`wicked_sigkill',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:process sigkill;
')
########################################
## <summary>
## Transition to wicked named content
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_filetrans_named_content',`
gen_require(`
type wicked_var_run_t;
type wicked_var_lib_t;
')
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth0.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth1.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth2.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth3.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth4.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth5.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth6.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth7.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth8.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth9.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth0.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth1.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth2.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth3.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth4.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth5.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth6.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth7.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth8.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth9.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em0.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em1.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em2.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em3.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em4.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em5.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em6.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em7.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em8.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em9.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em0.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em1.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em2.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em3.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em4.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em5.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em6.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em7.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em8.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em9.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.lo.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.lo.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, dir, "extension")
files_pid_filetrans($1, wicked_var_run_t, dir, "nanny")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-1.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-2.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-3.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-4.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-5.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-6.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-7.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-8.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-9.xml")
')
Reference in New Issue View Git Blame Copy Permalink