|
Dominick Grift |
7aa5972 |
policy_module(likewise, 1.2.1)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Declarations
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
attribute likewise_domains;
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
likewise_domain_template(dcerpcd)
|
|
Dominick Grift |
7aa5972 |
likewise_domain_template(eventlogd)
|
|
Dominick Grift |
7aa5972 |
likewise_domain_template(lsassd)
|
|
Dominick Grift |
7aa5972 |
likewise_domain_template(lwiod)
|
|
Dominick Grift |
7aa5972 |
likewise_domain_template(lwregd)
|
|
Dominick Grift |
7aa5972 |
likewise_domain_template(lwsmd)
|
|
Dominick Grift |
7aa5972 |
likewise_domain_template(netlogond)
|
|
Dominick Grift |
7aa5972 |
likewise_domain_template(srvsvcd)
|
|
Dominick Grift |
7aa5972 |
|
|
|
1ec3d1a |
type likewise_etc_t;
|
|
|
1ec3d1a |
files_config_file(likewise_etc_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type likewise_initrc_exec_t;
|
|
|
1ec3d1a |
init_script_file(likewise_initrc_exec_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type likewise_var_lib_t;
|
|
|
1ec3d1a |
files_type(likewise_var_lib_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type likewise_pstore_lock_t;
|
|
|
1ec3d1a |
files_lock_file(likewise_pstore_lock_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type likewise_krb5_ad_t;
|
|
|
1ec3d1a |
files_type(likewise_krb5_ad_t)
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
type lsassd_tmp_t;
|
|
Dominick Grift |
7aa5972 |
files_tmp_file(lsassd_tmp_t)
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
#################################
|
|
Dominick Grift |
7aa5972 |
#
|
|
Dominick Grift |
7aa5972 |
# Common local policy
|
|
Dominick Grift |
7aa5972 |
#
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
allow likewise_domains likewise_var_lib_t:dir setattr_dir_perms;
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
dev_read_rand(likewise_domains)
|
|
Dominick Grift |
7aa5972 |
dev_read_urand(likewise_domains)
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
domain_use_interactive_fds(likewise_domains)
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
files_search_var_lib(likewise_domains)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#################################
|
|
|
1ec3d1a |
#
|
|
Dominick Grift |
7aa5972 |
# dcerpcd local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(dcerpcd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_all_recvfrom_netlabel(dcerpcd_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_all_recvfrom_unlabeled(dcerpcd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_if(dcerpcd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_node(dcerpcd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_port(dcerpcd_t)
|
|
|
1ec3d1a |
corenet_tcp_bind_generic_node(dcerpcd_t)
|
|
|
1ec3d1a |
corenet_udp_bind_generic_node(dcerpcd_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_if(dcerpcd_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_node(dcerpcd_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_port(dcerpcd_t)
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
corenet_sendrecv_epmap_server_packets(dcerpcd_t)
|
|
Dominick Grift |
7aa5972 |
corenet_tcp_bind_epmap_port(dcerpcd_t)
|
|
Dominick Grift |
7aa5972 |
corenet_udp_bind_epmap_port(dcerpcd_t)
|
|
Dominick Grift |
7aa5972 |
|
|
Dominick Grift |
7aa5972 |
corenet_sendrecv_generic_client_packets(dcerpcd_t)
|
|
Dominick Grift |
7aa5972 |
corenet_tcp_connect_generic_port(dcerpcd_t)
|
|
Dominick Grift |
7aa5972 |
|
|
|
1ec3d1a |
#################################
|
|
|
1ec3d1a |
#
|
|
Dominick Grift |
7aa5972 |
# eventlogd local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(eventlogd_t, likewise_var_lib_t, dcerpcd_var_socket_t, dcerpcd_t)
|
|
|
1ec3d1a |
stream_connect_pattern(eventlogd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_all_recvfrom_netlabel(eventlogd_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_all_recvfrom_unlabeled(eventlogd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_if(eventlogd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_node(eventlogd_t)
|
|
Dominick Grift |
7aa5972 |
|
|
Dominick Grift |
7aa5972 |
corenet_sendrecv_epmap_client_packets(eventlogd_t)
|
|
Dominick Grift |
7aa5972 |
corenet_tcp_connect_epmap_port(eventlogd_t)
|
|
Dominick Grift |
7aa5972 |
corenet_tcp_sendrecv_epmap_port(eventlogd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#################################
|
|
|
1ec3d1a |
#
|
|
Dominick Grift |
7aa5972 |
# lsassd local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow lsassd_t self:capability { fowner chown fsetid dac_override sys_time };
|
|
|
1ec3d1a |
allow lsassd_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
|
|
1ec3d1a |
allow lsassd_t self:netlink_route_socket rw_netlink_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow lsassd_t likewise_krb5_ad_t:file read_file_perms;
|
|
|
1ec3d1a |
allow lsassd_t netlogond_var_lib_t:file read_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(lsassd_t, likewise_etc_t, likewise_etc_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(lsassd_t, lsassd_tmp_t, lsassd_tmp_t)
|
|
|
1ec3d1a |
files_tmp_filetrans(lsassd_t, lsassd_tmp_t, file)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(lsassd_t, likewise_var_lib_t, dcerpcd_var_socket_t, dcerpcd_t)
|
|
|
1ec3d1a |
stream_connect_pattern(lsassd_t, likewise_var_lib_t, eventlogd_var_socket_t, eventlogd_t)
|
|
|
1ec3d1a |
stream_connect_pattern(lsassd_t, likewise_var_lib_t, lwiod_var_socket_t, lwiod_t)
|
|
|
1ec3d1a |
stream_connect_pattern(lsassd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t)
|
|
|
1ec3d1a |
stream_connect_pattern(lsassd_t, likewise_var_lib_t, netlogond_var_socket_t, netlogond_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
kernel_list_all_proc(lsassd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_exec_bin(lsassd_t)
|
|
|
1ec3d1a |
corecmd_exec_shell(lsassd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_all_recvfrom_netlabel(lsassd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_if(lsassd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_node(lsassd_t)
|
|
Dominick Grift |
7aa5972 |
|
|
Dominick Grift |
7aa5972 |
corenet_sendrecv_epmap_client_packets(lsassd_t)
|
|
|
1ec3d1a |
corenet_tcp_connect_epmap_port(lsassd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_epmap_port(lsassd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
domain_obj_id_change_exemption(lsassd_t)
|
|
Dominick Grift |
7aa5972 |
domain_dontaudit_search_all_domains_state(lsassd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_manage_etc_files(lsassd_t)
|
|
|
1ec3d1a |
files_manage_etc_symlinks(lsassd_t)
|
|
|
1ec3d1a |
files_manage_etc_runtime_files(lsassd_t)
|
|
|
1ec3d1a |
files_relabelto_home(lsassd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
selinux_get_fs_mount(lsassd_t)
|
|
|
1ec3d1a |
selinux_validate_context(lsassd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
seutil_read_config(lsassd_t)
|
|
|
1ec3d1a |
seutil_read_default_contexts(lsassd_t)
|
|
|
1ec3d1a |
seutil_read_file_contexts(lsassd_t)
|
|
|
1ec3d1a |
seutil_run_semanage(lsassd_t, system_r)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
sysnet_use_ldap(lsassd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
userdom_home_filetrans_user_home_dir(lsassd_t)
|
|
|
1ec3d1a |
userdom_manage_user_home_content_files(lsassd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
kerberos_rw_keytab(lsassd_t)
|
|
|
1ec3d1a |
kerberos_use(lsassd_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#################################
|
|
|
1ec3d1a |
#
|
|
Dominick Grift |
7aa5972 |
# lwiod local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
allow lwiod_t self:capability { fowner chown fsetid dac_override sys_resource };
|
|
Dominick Grift |
7aa5972 |
allow lwiod_t self:process setrlimit;
|
|
|
1ec3d1a |
allow lwiod_t self:netlink_route_socket rw_netlink_socket_perms;
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
allow lwiod_t { likewise_krb5_ad_t netlogond_var_lib_t }:file read_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(lwiod_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t)
|
|
|
1ec3d1a |
stream_connect_pattern(lwiod_t, likewise_var_lib_t, lsassd_var_socket_t, lsassd_t)
|
|
Dominick Grift |
7aa5972 |
stream_connect_pattern(lwiod_t, likewise_var_lib_t, netlogond_var_socket_t, netlogond_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_all_recvfrom_netlabel(lwiod_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_all_recvfrom_unlabeled(lwiod_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_if(lwiod_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_node(lwiod_t)
|
|
|
1ec3d1a |
corenet_tcp_bind_generic_node(lwiod_t)
|
|
Dominick Grift |
7aa5972 |
|
|
Dominick Grift |
7aa5972 |
corenet_sendrecv_smbd_server_packets(lwiod_t)
|
|
|
1ec3d1a |
corenet_tcp_bind_smbd_port(lwiod_t)
|
|
Dominick Grift |
7aa5972 |
corenet_sendrecv_smbd_client_packets(lwiod_t)
|
|
|
1ec3d1a |
corenet_tcp_connect_smbd_port(lwiod_t)
|
|
Dominick Grift |
7aa5972 |
corenet_tcp_sendrecv_smbd_port(lwiod_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
sysnet_read_config(lwiod_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
kerberos_rw_config(lwiod_t)
|
|
|
1ec3d1a |
kerberos_use(lwiod_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#################################
|
|
|
1ec3d1a |
#
|
|
Dominick Grift |
7aa5972 |
# lwsmd local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
allow lwsmd_t self:process setpgid;
|
|
Dominick Grift |
7aa5972 |
|
|
|
1ec3d1a |
allow lwsmd_t likewise_domains:process signal;
|
|
|
1ec3d1a |
|
|
Dominick Grift |
7aa5972 |
allow lwsmd_t { likewise_krb5_ad_t netlogond_var_lib_t }:file read_file_perms;
|
|
Dominick Grift |
7aa5972 |
|
|
|
1ec3d1a |
domtrans_pattern(lwsmd_t, dcerpcd_exec_t, dcerpcd_t)
|
|
|
1ec3d1a |
domtrans_pattern(lwsmd_t, eventlogd_exec_t, eventlogd_t)
|
|
|
1ec3d1a |
domtrans_pattern(lwsmd_t, lsassd_exec_t, lsassd_t)
|
|
|
1ec3d1a |
domtrans_pattern(lwsmd_t, lwiod_exec_t, lwiod_t)
|
|
|
1ec3d1a |
domtrans_pattern(lwsmd_t, lwregd_exec_t, lwregd_t)
|
|
|
1ec3d1a |
domtrans_pattern(lwsmd_t, netlogond_exec_t, netlogond_t)
|
|
|
1ec3d1a |
domtrans_pattern(lwsmd_t, srvsvcd_exec_t, srvsvcd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(lwsmd_t, likewise_var_lib_t, lwiod_var_socket_t, lwiod_t)
|
|
|
1ec3d1a |
stream_connect_pattern(lwsmd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#################################
|
|
|
1ec3d1a |
#
|
|
Dominick Grift |
7aa5972 |
# netlogond local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow netlogond_t self:capability dac_override;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(netlogond_t, likewise_etc_t, likewise_etc_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(netlogond_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
sysnet_dns_name_resolve(netlogond_t)
|
|
|
1ec3d1a |
sysnet_use_ldap(netlogond_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#################################
|
|
|
1ec3d1a |
#
|
|
Dominick Grift |
7aa5972 |
# srvsvcd local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow srvsvcd_t likewise_etc_t:dir search_dir_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(srvsvcd_t, likewise_var_lib_t, dcerpcd_var_socket_t, dcerpcd_t)
|
|
|
1ec3d1a |
stream_connect_pattern(srvsvcd_t, likewise_var_lib_t, lwiod_var_socket_t, lwiod_t)
|
|
|
1ec3d1a |
stream_connect_pattern(srvsvcd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_all_recvfrom_netlabel(srvsvcd_t)
|
|
|
1ec3d1a |
corenet_sendrecv_generic_server_packets(srvsvcd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_if(srvsvcd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_node(srvsvcd_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_port(srvsvcd_t)
|
|
|
1ec3d1a |
corenet_tcp_bind_generic_node(srvsvcd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
kerberos_use(srvsvcd_t)
|
|
|
1ec3d1a |
')
|