forked from pool/selinux-policy
e10fb17535
- Added module for wicked - New patches: * fix_authlogin.patch * fix_screen.patch * fix_unprivuser.patch * fix_rpm.patch * fix_apache.patch - Added module for rtorrent - Enable snapper module in minimum policy to reduce issues on BTRFS Updated fix_snapper.patch to prevent relabling of snapshot OBS-URL: https://build.opensuse.org/request/show/810877 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=76
655 lines
15 KiB
Plaintext
655 lines
15 KiB
Plaintext
## <summary>Manager for dynamically switching between networks.</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write wicked UDP sockets.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
# cjp: added for named.
|
|
interface(`wicked_rw_udp_sockets',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:udp_socket { read write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write wicked packet sockets.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
# cjp: added for named.
|
|
interface(`wicked_rw_packet_sockets',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:packet_socket { read write };
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Allow caller to relabel tun_socket
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_attach_tun_iface',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:tun_socket relabelfrom;
|
|
allow $1 self:tun_socket relabelto;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write wicked netlink
|
|
## routing sockets.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
# cjp: added for named.
|
|
interface(`wicked_rw_routing_sockets',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:netlink_route_socket { read write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute wicked with a domain transition.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_domtrans',`
|
|
gen_require(`
|
|
type wicked_t, wicked_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, wicked_exec_t, wicked_t)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Execute wicked scripts with an automatic domain transition to initrc.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_initrc_domtrans',`
|
|
gen_require(`
|
|
type wicked_initrc_exec_t;
|
|
')
|
|
|
|
init_labeled_script_domtrans($1, wicked_initrc_exec_t)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Allow reading of wicked link files
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to read the links
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_initrc_read_lnk_files',`
|
|
gen_require(`
|
|
type wicked_initrc_exec_t;
|
|
')
|
|
|
|
read_lnk_files_pattern($1, wicked_initrc_exec_t, wicked_initrc_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute wicked server in the wicked domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_systemctl',`
|
|
gen_require(`
|
|
type wicked_unit_file_t;
|
|
type wicked_t;
|
|
')
|
|
|
|
systemd_exec_systemctl($1)
|
|
init_reload_services($1)
|
|
allow $1 wicked_unit_file_t:file read_file_perms;
|
|
allow $1 wicked_unit_file_t:service manage_service_perms;
|
|
|
|
ps_process_pattern($1, wicked_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send and receive messages from
|
|
## wicked over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_dbus_chat',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
class dbus send_msg;
|
|
')
|
|
|
|
allow $1 wicked_t:dbus send_msg;
|
|
allow wicked_t $1:dbus send_msg;
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Read metworkmanager process state files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_read_state',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:dir search_dir_perms;
|
|
allow $1 wicked_t:file read_file_perms;
|
|
allow $1 wicked_t:lnk_file read_lnk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to send and
|
|
## receive messages from wicked
|
|
## over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_dontaudit_dbus_chat',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
class dbus send_msg;
|
|
')
|
|
|
|
dontaudit $1 wicked_t:dbus send_msg;
|
|
dontaudit wicked_t $1:dbus send_msg;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send a generic signal to wicked
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_signal',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:process signal;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create, read, and write
|
|
## wicked library files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_manage_lib_files',`
|
|
gen_require(`
|
|
type wicked_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
manage_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
|
|
allow $1 wicked_var_lib_t:file map;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read wicked lib files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_read_lib_files',`
|
|
gen_require(`
|
|
type wicked_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
list_dirs_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
|
|
read_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
|
|
allow $1 wicked_var_lib_t:file map;
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Read wicked conf files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_read_conf',`
|
|
gen_require(`
|
|
type wicked_etc_t;
|
|
type wicked_etc_rw_t;
|
|
')
|
|
|
|
allow $1 wicked_etc_t:dir list_dir_perms;
|
|
read_files_pattern($1,wicked_etc_t,wicked_etc_t)
|
|
read_files_pattern($1,wicked_etc_rw_t,wicked_etc_rw_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read wicked PID files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_read_pid_files',`
|
|
gen_require(`
|
|
type wicked_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
read_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Manage wicked PID files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_manage_pid_files',`
|
|
gen_require(`
|
|
type wicked_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
manage_dirs_pattern($1, wicked_var_run_t, wicked_var_run_t)
|
|
manage_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Manage wicked PID sock files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_manage_pid_sock_files',`
|
|
gen_require(`
|
|
type wicked_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
manage_sock_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create objects in /etc with a private
|
|
## type using a type_transition.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="file_type">
|
|
## <summary>
|
|
## Private file type.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="class">
|
|
## <summary>
|
|
## Object classes to be created.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="name" optional="true">
|
|
## <summary>
|
|
## The name of the object being created.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_pid_filetrans',`
|
|
gen_require(`
|
|
type wicked_var_run_t;
|
|
')
|
|
|
|
filetrans_pattern($1, wicked_var_run_t, $2, $3, $4)
|
|
')
|
|
|
|
####################################
|
|
## <summary>
|
|
## Connect to wicked over
|
|
## a unix domain stream socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_stream_connect',`
|
|
gen_require(`
|
|
type wicked_t, wicked_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
stream_connect_pattern($1, wicked_var_run_t, wicked_var_run_t, wicked_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Delete wicked PID files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_delete_pid_files',`
|
|
gen_require(`
|
|
type wicked_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
delete_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute wicked in the wicked domain, and
|
|
## allow the specified role the wicked domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`wicked_run',`
|
|
gen_require(`
|
|
type wicked_t, wicked_exec_t;
|
|
')
|
|
|
|
wicked_domtrans($1)
|
|
role $2 types wicked_t;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the specified domain to append
|
|
## to Network Manager log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_append_log',`
|
|
gen_require(`
|
|
type wicked_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
allow $1 wicked_log_t:dir list_dir_perms;
|
|
append_files_pattern($1, wicked_log_t, wicked_log_t)
|
|
allow $1 wicked_log_t:file map;
|
|
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Allow the specified domain to manage
|
|
## to Network Manager lib files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_manage_lib',`
|
|
gen_require(`
|
|
type wicked_var_lib_t;
|
|
')
|
|
|
|
manage_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
|
|
allow $1 wicked_var_lib_t:file map;
|
|
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Send to wicked with a unix dgram socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_dgram_send',`
|
|
gen_require(`
|
|
type wicked_t, wicked_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
dgram_send_pattern($1, wicked_var_run_t, wicked_var_run_t, wicked_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send sigchld to wicked.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
#
|
|
interface(`wicked_sigchld',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:process sigchld;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send signull to wicked.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
#
|
|
interface(`wicked_signull',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:process signull;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send sigkill to wicked.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
#
|
|
interface(`wicked_sigkill',`
|
|
gen_require(`
|
|
type wicked_t;
|
|
')
|
|
|
|
allow $1 wicked_t:process sigkill;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Transition to wicked named content
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`wicked_filetrans_named_content',`
|
|
gen_require(`
|
|
type wicked_var_run_t;
|
|
type wicked_var_lib_t;
|
|
')
|
|
|
|
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth0.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth1.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth2.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth3.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth4.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth5.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth6.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth7.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth8.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth9.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth0.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth1.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth2.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth3.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth4.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth5.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth6.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth7.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth8.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth9.dhcp.ipv6")
|
|
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em0.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em1.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em2.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em3.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em4.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em5.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em6.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em7.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em8.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em9.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em0.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em1.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em2.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em3.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em4.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em5.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em6.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em7.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em8.dhcp.ipv6")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em9.dhcp.ipv6")
|
|
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.lo.dhcp.ipv4")
|
|
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.lo.dhcp.ipv6")
|
|
|
|
files_pid_filetrans($1, wicked_var_run_t, dir, "extension")
|
|
files_pid_filetrans($1, wicked_var_run_t, dir, "nanny")
|
|
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-1.xml")
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-2.xml")
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-3.xml")
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-4.xml")
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-5.xml")
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-6.xml")
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-7.xml")
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-8.xml")
|
|
files_etc_filetrans($1, wicked_var_lib_t, file, "state-9.xml")
|
|
')
|