policy_module(nova, 1.0.0)

########################################

#

# Declarations

#

#

# nova-stack daemons contain security issue with using sudo in the code

# we make this policy as unconfined until this issue is fixed

#

attribute nova_domain;

nova_domain_template(ajax)

nova_domain_template(api)

nova_domain_template(cert)

nova_domain_template(compute)

nova_domain_template(console)

nova_domain_template(direct)

nova_domain_template(network)

nova_domain_template(objectstore)

nova_domain_template(scheduler)

nova_domain_template(vncproxy)

nova_domain_template(volume)

type nova_log_t;

logging_log_file(nova_log_t)

type nova_var_lib_t;

files_type(nova_var_lib_t)

type nova_var_run_t;

files_pid_file(nova_var_run_t)

######################################

#

# nova general domain local policy

#

allow nova_domain self:fifo_file rw_fifo_file_perms;

allow nova_domain self:tcp_socket create_stream_socket_perms;

allow nova_domain self:unix_stream_socket create_stream_socket_perms;

manage_dirs_pattern(nova_domain, nova_log_t, nova_log_t)

manage_files_pattern(nova_domain, nova_log_t, nova_log_t)

manage_dirs_pattern(nova_domain, nova_var_lib_t, nova_var_lib_t)

manage_files_pattern(nova_domain, nova_var_lib_t, nova_var_lib_t)

manage_dirs_pattern(nova_domain, nova_var_run_t, nova_var_run_t)

manage_files_pattern(nova_domain, nova_var_run_t, nova_var_run_t)

corenet_tcp_connect_amqp_port(nova_domain)

corecmd_exec_bin(nova_domain)

corecmd_exec_shell(nova_domain)

dev_read_urand(nova_domain)

fs_getattr_xattr_fs(nova_domain)

libs_exec_ldconfig(nova_domain)

optional_policy(`

	sysnet_read_config(nova_domain)

')

######################################

#

# nova ajax local policy

#

optional_policy(`

	unconfined_domain(nova_ajax_t)

')

#######################################

#

# nova api local policy

#

allow nova_api_t self:process setfscreate;

allow nova_api_t self:key write;

allow nova_api_t self:netlink_route_socket r_netlink_socket_perms;

allow nova_api_t self:udp_socket create_socket_perms;

kernel_read_kernel_sysctls(nova_api_t)

corenet_tcp_bind_generic_node(nova_api_t)

corenet_udp_bind_generic_node(nova_api_t)

# should be add to booleans

corenet_tcp_connect_all_ports(nova_api_t)

corenet_tcp_bind_all_unreserved_ports(nova_api_t)

auth_read_passwd(nova_api_t)

logging_send_syslog_msg(nova_api_t)

miscfiles_read_certs(nova_api_t)

ifdef(`hide_broken_symptoms',`

	optional_policy(`

		sudo_exec(nova_api_t)

		allow nova_api_t self:capability { setuid sys_resource setgid };

		allow nova_api_t self:process { setsched setrlimit };

		logging_send_audit_msgs(nova_api_t)

	')

')

optional_policy(`

	iptables_domtrans(nova_api_t)

')

optional_policy(`

	ssh_exec_keygen(nova_api_t)

')

optional_policy(`

	unconfined_domain(nova_api_t)

')

######################################

#

# nova cert local policy

#

allow nova_cert_t self:process setfscreate;

allow nova_cert_t self:udp_socket create_socket_perms;

auth_use_nsswitch(nova_cert_t)

miscfiles_read_certs(nova_cert_t)

optional_policy(`

	mysql_stream_connect(nova_cert_t)

')

#######################################

#

# nova compute local policy

#

# needs to be re-write since now runs as virtd_t

allow nova_compute_t self:udp_socket create_socket_perms;

kernel_read_network_state(nova_compute_t)

dev_read_rand(nova_compute_t)

dev_read_sysfs(nova_compute_t)

optional_policy(`

	virt_getattr_exec(nova_compute_t)

	virt_stream_connect(nova_compute_t)

')

######################################

#

# nova console local policy

#

allow nova_console_t self:udp_socket create_socket_perms;

auth_use_nsswitch(nova_console_t)

#######################################

#

# nova direct local policy

#

optional_policy(`

	unconfined_domain(nova_direct_t)

')

#######################################

#

# nova network local policy

#

allow nova_network_t self:capability { dac_override net_admin net_bind_service };

allow nova_network_t self:process { getcap setcap };

allow nova_network_t self:netlink_route_socket r_netlink_socket_perms;

allow nova_network_t self:udp_socket create_socket_perms;

kernel_read_network_state(nova_network_t)

kernel_read_kernel_sysctls(nova_network_t)

# should be added to boolean or fixed in the code

# dnsmasq domtrans does not work since then dnsmasq_t wants

# to do some stuff with nova_lib, nova_tmp

# nova-dhcpbridge runs in dnsmasq domain

corenet_all_recvfrom_netlabel(nova_network_t)

corenet_tcp_sendrecv_generic_if(nova_network_t)

corenet_udp_sendrecv_generic_if(nova_network_t)

corenet_raw_sendrecv_generic_if(nova_network_t)

corenet_tcp_sendrecv_generic_node(nova_network_t)

corenet_udp_sendrecv_generic_node(nova_network_t)

corenet_raw_sendrecv_generic_node(nova_network_t)

corenet_tcp_sendrecv_all_ports(nova_network_t)

corenet_udp_sendrecv_all_ports(nova_network_t)

corenet_tcp_bind_generic_node(nova_network_t)

corenet_udp_bind_generic_node(nova_network_t)

corenet_tcp_bind_dns_port(nova_network_t)

corenet_udp_bind_all_ports(nova_network_t)

corenet_sendrecv_dns_server_packets(nova_network_t)

corenet_sendrecv_dhcpd_server_packets(nova_network_t)

libs_exec_ldconfig(nova_network_t)

logging_send_syslog_msg(nova_network_t)

ifdef(`hide_broken_symptoms',`

    optional_policy(`

        sudo_exec(nova_network_t)

        allow nova_network_t self:capability { setuid sys_resource setgid };

        allow nova_network_t self:process { setsched setrlimit };

        logging_send_audit_msgs(nova_network_t)

    ')

')

optional_policy(`

	brctl_domtrans(nova_network_t)

')

optional_policy(`

	dnsmasq_exec(nova_network_t)

#	dnsmasq_domtrans(nova_network_t)

')

optional_policy(`

    iptables_domtrans(nova_network_t)

')

optional_policy(`

	sysnet_domtrans_ifconfig(nova_network_t)

')

optional_policy(`

	unconfined_domain(nova_network_t)

')

#######################################

#

# nova object store local policy

#

allow nova_objectstore_t self:udp_socket create_socket_perms;

corenet_tcp_bind_generic_node(nova_objectstore_t)

corenet_udp_bind_generic_node(nova_objectstore_t)

optional_policy(`

    unconfined_domain(nova_objectstore_t)

')

#######################################

#

# nova scheduler local policy

#

allow nova_scheduler_t self:netlink_route_socket r_netlink_socket_perms;

allow nova_scheduler_t self:udp_socket create_socket_perms;

optional_policy(`

	unconfined_domain(nova_scheduler_t)

')

#######################################

#

# nova vncproxy local policy

#

optional_policy(`

	unconfined_domain(nova_vncproxy_t)

')

#######################################

#

# nova volume local policy

#

allow nova_volume_t self:netlink_route_socket r_netlink_socket_perms;

allow nova_volume_t self:udp_socket create_socket_perms;

kernel_read_kernel_sysctls(nova_volume_t)

logging_send_syslog_msg(nova_volume_t)

optional_policy(`

	lvm_domtrans(nova_volume_t)

')

ifdef(`hide_broken_symptoms',`

	require {

		type sudo_exec_t;

	}

	allow nova_volume_t sudo_exec_t:file { read execute open execute_no_trans };

	allow nova_volume_t self:capability { setuid sys_resource setgid audit_write };

	allow nova_volume_t self:process { setsched setrlimit };

	logging_send_audit_msgs(nova_volume_t)

')

optional_policy(`

    unconfined_domain(nova_volume_t)

')