|
|
1ec3d1a |
policy_module(dirsrv-admin,1.0.0)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Declarations for the daemon
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type dirsrvadmin_t;
|
|
|
1ec3d1a |
type dirsrvadmin_exec_t;
|
|
|
1ec3d1a |
init_daemon_domain(dirsrvadmin_t, dirsrvadmin_exec_t)
|
|
|
1ec3d1a |
role system_r types dirsrvadmin_t;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type dirsrvadmin_config_t;
|
|
|
1ec3d1a |
files_type(dirsrvadmin_config_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type dirsrvadmin_lock_t;
|
|
|
1ec3d1a |
files_lock_file(dirsrvadmin_lock_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type dirsrvadmin_tmp_t;
|
|
|
1ec3d1a |
files_tmp_file(dirsrvadmin_tmp_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type dirsrvadmin_unconfined_script_t;
|
|
|
1ec3d1a |
type dirsrvadmin_unconfined_script_exec_t;
|
|
|
1ec3d1a |
domain_type(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
domain_entry_file(dirsrvadmin_unconfined_script_t, dirsrvadmin_unconfined_script_exec_t)
|
|
|
1ec3d1a |
corecmd_shell_entry_type(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
role system_r types dirsrvadmin_unconfined_script_t;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Local policy for the daemon
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
allow dirsrvadmin_t self:fifo_file rw_fifo_file_perms;
|
|
|
1ec3d1a |
allow dirsrvadmin_t self:capability { dac_read_search dac_override sys_tty_config sys_resource };
|
|
|
1ec3d1a |
allow dirsrvadmin_t self:process setrlimit;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(dirsrvadmin_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
|
|
|
1ec3d1a |
manage_dirs_pattern(dirsrvadmin_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
|
|
|
1ec3d1a |
files_tmp_filetrans(dirsrvadmin_t, dirsrvadmin_tmp_t, { file dir })
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
kernel_read_system_state(dirsrvadmin_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_exec_bin(dirsrvadmin_t)
|
|
|
1ec3d1a |
corecmd_read_bin_symlinks(dirsrvadmin_t)
|
|
|
1ec3d1a |
corecmd_search_bin(dirsrvadmin_t)
|
|
|
1ec3d1a |
corecmd_shell_entry_type(dirsrvadmin_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_exec_etc_files(dirsrvadmin_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
libs_exec_ld_so(dirsrvadmin_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
logging_search_logs(dirsrvadmin_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# Needed for stop and restart scripts
|
|
|
1ec3d1a |
dirsrv_read_var_run(dirsrvadmin_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
apache_domtrans(dirsrvadmin_t)
|
|
|
1ec3d1a |
apache_signal(dirsrvadmin_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Local policy for the CGIs
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Create a domain for the CGI scripts
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
apache_content_template(dirsrvadmin)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow httpd_dirsrvadmin_script_t self:process { getsched getpgid };
|
|
|
1ec3d1a |
allow httpd_dirsrvadmin_script_t self:capability { setuid net_bind_service setgid chown sys_nice kill dac_read_search dac_override };
|
|
|
1ec3d1a |
allow httpd_dirsrvadmin_script_t self:tcp_socket create_stream_socket_perms;
|
|
|
1ec3d1a |
allow httpd_dirsrvadmin_script_t self:udp_socket create_socket_perms;
|
|
|
1ec3d1a |
allow httpd_dirsrvadmin_script_t self:unix_dgram_socket create_socket_perms;
|
|
|
1ec3d1a |
allow httpd_dirsrvadmin_script_t self:netlink_route_socket r_netlink_socket_perms;
|
|
|
1ec3d1a |
allow httpd_dirsrvadmin_script_t self:sem create_sem_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_lock_t, dirsrvadmin_lock_t)
|
|
|
1ec3d1a |
files_lock_filetrans(httpd_dirsrvadmin_script_t, dirsrvadmin_lock_t, { file })
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
kernel_read_kernel_sysctls(httpd_dirsrvadmin_script_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_all_recvfrom_netlabel(httpd_dirsrvadmin_script_t)
|
|
|
1ec3d1a |
corenet_tcp_connect_generic_port(httpd_dirsrvadmin_script_t)
|
|
|
1ec3d1a |
corenet_tcp_connect_ldap_port(httpd_dirsrvadmin_script_t)
|
|
|
1ec3d1a |
corenet_tcp_connect_http_port(httpd_dirsrvadmin_script_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_search_var_lib(httpd_dirsrvadmin_script_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
sysnet_read_config(httpd_dirsrvadmin_script_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
|
|
|
1ec3d1a |
manage_dirs_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
|
|
|
1ec3d1a |
files_tmp_filetrans(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, { file dir })
|
|
|
1ec3d1a |
|
|
|
835c61e |
optional_policy(`
|
|
|
835c61e |
# The CGI scripts must be able to manage dirsrv-admin
|
|
|
835c61e |
dirsrvadmin_run_exec(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrvadmin_manage_config(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_domtrans(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_signal(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_signull(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_manage_log(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_manage_var_lib(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_pid_filetrans(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_manage_var_run(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_manage_config(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
dirsrv_read_share(httpd_dirsrvadmin_script_t)
|
|
|
835c61e |
')
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#######################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Local policy for the admin CGIs
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
|
|
|
1ec3d1a |
manage_dirs_pattern(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
|
|
|
1ec3d1a |
files_tmp_filetrans(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, { file dir })
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# needed because of filetrans rules
|
|
|
1ec3d1a |
dirsrvadmin_run_exec(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrvadmin_manage_config(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_domtrans(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_signal(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_signull(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_manage_log(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_manage_var_lib(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_pid_filetrans(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_manage_var_run(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_manage_config(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
dirsrv_read_share(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
unconfined_domain(dirsrvadmin_unconfined_script_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|