|
Chris PeBenito |
992aba5 |
## <summary>Policy for the RPM package manager.</summary>
|
|
Chris PeBenito |
992aba5 |
|
|
Chris PeBenito |
992aba5 |
########################################
|
|
Chris PeBenito |
ebdc3b7 |
## <summary>
|
|
Chris PeBenito |
414e415 |
## Execute rpm programs in the rpm domain.
|
|
Chris PeBenito |
ebdc3b7 |
## </summary>
|
|
Chris PeBenito |
414e415 |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
414e415 |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
414e415 |
## </param>
|
|
Chris PeBenito |
992aba5 |
#
|
|
Chris PeBenito |
199895e |
interface(`rpm_domtrans',`
|
|
Chris PeBenito |
7f2e39b |
gen_require(`
|
|
Chris PeBenito |
7f2e39b |
type rpm_t, rpm_exec_t;
|
|
Chris PeBenito |
7f2e39b |
')
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
7f2e39b |
files_search_usr($1)
|
|
Chris PeBenito |
7f2e39b |
corecmd_search_bin($1)
|
|
Chris PeBenito |
0bfccda |
domtrans_pattern($1, rpm_exec_t, rpm_t)
|
|
Chris PeBenito |
992aba5 |
')
|
|
Chris PeBenito |
992aba5 |
|
|
Chris PeBenito |
992aba5 |
########################################
|
|
Chris PeBenito |
ebdc3b7 |
## <summary>
|
|
Chris PeBenito |
cd66769 |
## Execute rpm_script programs in the rpm_script domain.
|
|
Chris PeBenito |
cd66769 |
## </summary>
|
|
Chris PeBenito |
cd66769 |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
cd66769 |
## Domain allowed access.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
cd66769 |
## </param>
|
|
Chris PeBenito |
cd66769 |
#
|
|
Chris PeBenito |
1815bad |
interface(`rpm_domtrans_script',`
|
|
Chris PeBenito |
cd66769 |
gen_require(`
|
|
Chris PeBenito |
fc4054c |
type rpm_script_t;
|
|
Chris PeBenito |
cd66769 |
')
|
|
Chris PeBenito |
cd66769 |
|
|
Chris PeBenito |
cd66769 |
# transition to rpm script:
|
|
Chris PeBenito |
cd66769 |
corecmd_shell_domtrans($1,rpm_script_t)
|
|
Chris PeBenito |
cd66769 |
allow rpm_script_t $1:fd use;
|
|
Chris PeBenito |
cd66769 |
allow rpm_script_t $1:fifo_file rw_file_perms;
|
|
Chris PeBenito |
cd66769 |
allow rpm_script_t $1:process sigchld;
|
|
Chris PeBenito |
cd66769 |
')
|
|
Chris PeBenito |
cd66769 |
|
|
Chris PeBenito |
cd66769 |
########################################
|
|
Chris PeBenito |
cd66769 |
## <summary>
|
|
Chris PeBenito |
414e415 |
## Execute RPM programs in the RPM domain.
|
|
Chris PeBenito |
ebdc3b7 |
## </summary>
|
|
Chris PeBenito |
414e415 |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
414e415 |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
414e415 |
## </param>
|
|
Chris PeBenito |
414e415 |
## <param name="role">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
414e415 |
## The role to allow the RPM domain.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
414e415 |
## </param>
|
|
Chris PeBenito |
bbcd3c9 |
## <rolecap/>
|
|
Chris PeBenito |
992aba5 |
#
|
|
Chris PeBenito |
199895e |
interface(`rpm_run',`
|
|
Chris PeBenito |
7f2e39b |
gen_require(`
|
|
Chris PeBenito |
7f2e39b |
type rpm_t, rpm_script_t;
|
|
Chris PeBenito |
7f2e39b |
')
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
c9428d3 |
rpm_domtrans($1)
|
|
Chris PeBenito |
0c73cd2 |
role $2 types rpm_t;
|
|
Chris PeBenito |
0c73cd2 |
role $2 types rpm_script_t;
|
|
Chris PeBenito |
296273a |
seutil_run_loadpolicy(rpm_script_t, $2)
|
|
Chris PeBenito |
296273a |
seutil_run_semanage(rpm_script_t, $2)
|
|
Chris PeBenito |
296273a |
seutil_run_setfiles(rpm_script_t, $2)
|
|
Chris PeBenito |
992aba5 |
')
|
|
Chris PeBenito |
992aba5 |
|
|
Chris PeBenito |
992aba5 |
########################################
|
|
Chris PeBenito |
ebdc3b7 |
## <summary>
|
|
Chris PeBenito |
522b59b |
## Execute the rpm client in the caller domain.
|
|
Chris PeBenito |
522b59b |
## </summary>
|
|
Chris PeBenito |
522b59b |
## <param name="domain">
|
|
Chris PeBenito |
522b59b |
## <summary>
|
|
Chris PeBenito |
522b59b |
## Domain allowed access.
|
|
Chris PeBenito |
522b59b |
## </summary>
|
|
Chris PeBenito |
522b59b |
## </param>
|
|
Chris PeBenito |
522b59b |
#
|
|
Chris PeBenito |
522b59b |
interface(`rpm_exec',`
|
|
Chris PeBenito |
522b59b |
gen_require(`
|
|
Chris PeBenito |
522b59b |
type rpm_exec_t;
|
|
Chris PeBenito |
522b59b |
')
|
|
Chris PeBenito |
522b59b |
|
|
Chris PeBenito |
522b59b |
corecmd_search_bin($1)
|
|
Chris PeBenito |
0bfccda |
can_exec($1, rpm_exec_t)
|
|
Chris PeBenito |
522b59b |
')
|
|
Chris PeBenito |
522b59b |
|
|
Chris PeBenito |
522b59b |
########################################
|
|
Chris PeBenito |
522b59b |
## <summary>
|
|
Chris PeBenito |
414e415 |
## Inherit and use file descriptors from RPM.
|
|
Chris PeBenito |
ebdc3b7 |
## </summary>
|
|
Chris PeBenito |
414e415 |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
414e415 |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
414e415 |
## </param>
|
|
Chris PeBenito |
992aba5 |
#
|
|
Chris PeBenito |
1c1ac67 |
interface(`rpm_use_fds',`
|
|
Chris PeBenito |
7f2e39b |
gen_require(`
|
|
Chris PeBenito |
7f2e39b |
type rpm_t;
|
|
Chris PeBenito |
7f2e39b |
')
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
0c73cd2 |
allow $1 rpm_t:fd use;
|
|
Chris PeBenito |
992aba5 |
')
|
|
Chris PeBenito |
992aba5 |
|
|
Chris PeBenito |
992aba5 |
########################################
|
|
Chris PeBenito |
ebdc3b7 |
## <summary>
|
|
Chris PeBenito |
b24f35d |
## Read from an unnamed RPM pipe.
|
|
Chris PeBenito |
ebdc3b7 |
## </summary>
|
|
Chris PeBenito |
414e415 |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
414e415 |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
414e415 |
## </param>
|
|
Chris PeBenito |
992aba5 |
#
|
|
Chris PeBenito |
1815bad |
interface(`rpm_read_pipes',`
|
|
Chris PeBenito |
7f2e39b |
gen_require(`
|
|
Chris PeBenito |
7f2e39b |
type rpm_t;
|
|
Chris PeBenito |
7f2e39b |
')
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
c0868a7 |
allow $1 rpm_t:fifo_file read_fifo_file_perms;
|
|
Chris PeBenito |
992aba5 |
')
|
|
Chris PeBenito |
992aba5 |
|
|
Chris PeBenito |
992aba5 |
########################################
|
|
Chris PeBenito |
ebdc3b7 |
## <summary>
|
|
Chris PeBenito |
b24f35d |
## Read and write an unnamed RPM pipe.
|
|
Chris PeBenito |
b24f35d |
## </summary>
|
|
Chris PeBenito |
b24f35d |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
b24f35d |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
b24f35d |
## </param>
|
|
Chris PeBenito |
b24f35d |
#
|
|
Chris PeBenito |
1815bad |
interface(`rpm_rw_pipes',`
|
|
Chris PeBenito |
b24f35d |
gen_require(`
|
|
Chris PeBenito |
b24f35d |
type rpm_t;
|
|
Chris PeBenito |
b24f35d |
')
|
|
Chris PeBenito |
b24f35d |
|
|
Chris PeBenito |
c0868a7 |
allow $1 rpm_t:fifo_file rw_fifo_file_perms;
|
|
Chris PeBenito |
b24f35d |
')
|
|
Chris PeBenito |
b24f35d |
|
|
Chris PeBenito |
b24f35d |
########################################
|
|
Chris PeBenito |
b24f35d |
## <summary>
|
|
Chris PeBenito |
d9845ae |
## Send and receive messages from
|
|
Chris PeBenito |
d9845ae |
## rpm over dbus.
|
|
Chris PeBenito |
d9845ae |
## </summary>
|
|
Chris PeBenito |
d9845ae |
## <param name="domain">
|
|
Chris PeBenito |
d9845ae |
## <summary>
|
|
Chris PeBenito |
d9845ae |
## Domain allowed access.
|
|
Chris PeBenito |
d9845ae |
## </summary>
|
|
Chris PeBenito |
d9845ae |
## </param>
|
|
Chris PeBenito |
d9845ae |
#
|
|
Chris PeBenito |
d9845ae |
interface(`rpm_dbus_chat',`
|
|
Chris PeBenito |
d9845ae |
gen_require(`
|
|
Chris PeBenito |
d9845ae |
type rpm_t;
|
|
Chris PeBenito |
d9845ae |
class dbus send_msg;
|
|
Chris PeBenito |
d9845ae |
')
|
|
Chris PeBenito |
d9845ae |
|
|
Chris PeBenito |
d9845ae |
allow $1 rpm_t:dbus send_msg;
|
|
Chris PeBenito |
d9845ae |
allow rpm_t $1:dbus send_msg;
|
|
Chris PeBenito |
d9845ae |
')
|
|
Chris PeBenito |
d9845ae |
|
|
Chris PeBenito |
d9845ae |
########################################
|
|
Chris PeBenito |
d9845ae |
## <summary>
|
|
Chris PeBenito |
b24f35d |
## Create, read, write, and delete the RPM log.
|
|
Chris PeBenito |
b24f35d |
## </summary>
|
|
Chris PeBenito |
b24f35d |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
b24f35d |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
b24f35d |
## </param>
|
|
Chris PeBenito |
b24f35d |
#
|
|
Chris PeBenito |
b24f35d |
interface(`rpm_manage_log',`
|
|
Chris PeBenito |
b24f35d |
gen_require(`
|
|
Chris PeBenito |
b24f35d |
type rpm_log_t;
|
|
Chris PeBenito |
b24f35d |
')
|
|
Chris PeBenito |
b24f35d |
|
|
Chris PeBenito |
1815bad |
logging_rw_generic_log_dirs($1)
|
|
Chris PeBenito |
c0868a7 |
allow $1 rpm_log_t:file manage_file_perms;
|
|
Chris PeBenito |
b24f35d |
')
|
|
Chris PeBenito |
b24f35d |
|
|
Chris PeBenito |
b24f35d |
########################################
|
|
Chris PeBenito |
b24f35d |
## <summary>
|
|
Chris PeBenito |
df00b2e |
## Inherit and use file descriptors from RPM scripts.
|
|
Chris PeBenito |
df00b2e |
## </summary>
|
|
Chris PeBenito |
df00b2e |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
df00b2e |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
df00b2e |
## </param>
|
|
Chris PeBenito |
df00b2e |
#
|
|
Chris PeBenito |
15722ec |
interface(`rpm_use_script_fds',`
|
|
Chris PeBenito |
df00b2e |
gen_require(`
|
|
Chris PeBenito |
df00b2e |
type rpm_script_t;
|
|
Chris PeBenito |
df00b2e |
')
|
|
Chris PeBenito |
df00b2e |
|
|
Chris PeBenito |
df00b2e |
allow $1 rpm_script_t:fd use;
|
|
Chris PeBenito |
df00b2e |
')
|
|
Chris PeBenito |
df00b2e |
|
|
Chris PeBenito |
df00b2e |
########################################
|
|
Chris PeBenito |
df00b2e |
## <summary>
|
|
Chris PeBenito |
82e284b |
## Create, read, write, and delete RPM
|
|
Chris PeBenito |
82e284b |
## script temporary files.
|
|
Chris PeBenito |
82e284b |
## </summary>
|
|
Chris PeBenito |
82e284b |
## <param name="domain">
|
|
Chris PeBenito |
82e284b |
## <summary>
|
|
Chris PeBenito |
82e284b |
## Domain allowed access.
|
|
Chris PeBenito |
82e284b |
## </summary>
|
|
Chris PeBenito |
82e284b |
## </param>
|
|
Chris PeBenito |
82e284b |
#
|
|
Chris PeBenito |
82e284b |
interface(`rpm_manage_script_tmp_files',`
|
|
Chris PeBenito |
82e284b |
gen_require(`
|
|
Chris PeBenito |
82e284b |
type rpm_script_tmp_t;
|
|
Chris PeBenito |
82e284b |
')
|
|
Chris PeBenito |
82e284b |
|
|
Chris PeBenito |
82e284b |
files_search_tmp($1)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t)
|
|
Chris PeBenito |
82e284b |
')
|
|
Chris PeBenito |
82e284b |
|
|
Chris PeBenito |
82e284b |
########################################
|
|
Chris PeBenito |
82e284b |
## <summary>
|
|
Chris PeBenito |
ebdc3b7 |
## Read the RPM package database.
|
|
Chris PeBenito |
ebdc3b7 |
## </summary>
|
|
Chris PeBenito |
414e415 |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
414e415 |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
414e415 |
## </param>
|
|
Chris PeBenito |
992aba5 |
#
|
|
Chris PeBenito |
199895e |
interface(`rpm_read_db',`
|
|
Chris PeBenito |
7f2e39b |
gen_require(`
|
|
Chris PeBenito |
1f91e1b |
type rpm_var_lib_t;
|
|
Chris PeBenito |
7f2e39b |
')
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
9fd4b81 |
files_search_var_lib($1)
|
|
Chris PeBenito |
c0868a7 |
allow $1 rpm_var_lib_t:dir list_dir_perms;
|
|
Chris PeBenito |
0bfccda |
read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
|
|
Chris PeBenito |
0bfccda |
read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
|
|
Chris PeBenito |
992aba5 |
')
|
|
Chris PeBenito |
992aba5 |
|
|
Chris PeBenito |
dc771ff |
########################################
|
|
Chris PeBenito |
ebdc3b7 |
## <summary>
|
|
Chris PeBenito |
ebdc3b7 |
## Create, read, write, and delete the RPM package database.
|
|
Chris PeBenito |
ebdc3b7 |
## </summary>
|
|
Chris PeBenito |
ebdc3b7 |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
ebdc3b7 |
## The type of the process performing this action.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
ebdc3b7 |
## </param>
|
|
Chris PeBenito |
dc771ff |
#
|
|
Chris PeBenito |
199895e |
interface(`rpm_manage_db',`
|
|
Chris PeBenito |
7f2e39b |
gen_require(`
|
|
Chris PeBenito |
b24f35d |
type rpm_var_lib_t;
|
|
Chris PeBenito |
7f2e39b |
')
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
9fd4b81 |
files_search_var_lib($1)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
|
|
Chris PeBenito |
0bfccda |
manage_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
|
|
Chris PeBenito |
dc771ff |
')
|
|
Chris PeBenito |
7572070 |
|
|
Chris PeBenito |
7572070 |
########################################
|
|
Chris PeBenito |
7572070 |
## <summary>
|
|
Chris PeBenito |
7572070 |
## Do not audit attempts to create, read,
|
|
Chris PeBenito |
7572070 |
## write, and delete the RPM package database.
|
|
Chris PeBenito |
7572070 |
## </summary>
|
|
Chris PeBenito |
7572070 |
## <param name="domain">
|
|
Chris PeBenito |
885b83e |
## <summary>
|
|
Chris PeBenito |
7572070 |
## Domain to not audit.
|
|
Chris PeBenito |
885b83e |
## </summary>
|
|
Chris PeBenito |
7572070 |
## </param>
|
|
Chris PeBenito |
7572070 |
#
|
|
Chris PeBenito |
7572070 |
interface(`rpm_dontaudit_manage_db',`
|
|
Chris PeBenito |
7572070 |
gen_require(`
|
|
Chris PeBenito |
7572070 |
type rpm_var_lib_t;
|
|
Chris PeBenito |
7572070 |
')
|
|
Chris PeBenito |
7572070 |
|
|
Chris PeBenito |
7572070 |
dontaudit $1 rpm_var_lib_t:dir rw_dir_perms;
|
|
Chris PeBenito |
c0868a7 |
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
|
|
Chris PeBenito |
c0868a7 |
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
|
|
Chris PeBenito |
7572070 |
')
|