policy_module(hadoop, 1.2.0) ######################################## # # Declarations. # attribute hadoop_domain; type hadoop_t; type hadoop_exec_t; userdom_user_application_domain(hadoop_t, hadoop_exec_t) type hadoop_etc_t; files_config_file(hadoop_etc_t) type hadoop_home_t; userdom_user_home_content(hadoop_home_t) type hadoop_lan_t; corenet_spd_type(hadoop_lan_t) type hadoop_log_t; logging_log_file(hadoop_log_t) type hadoop_tmp_t; userdom_user_tmp_file(hadoop_tmp_t) type hadoop_var_lib_t; files_type(hadoop_var_lib_t) type hadoop_var_run_t; files_pid_file(hadoop_var_run_t) type hadoop_hsperfdata_t; userdom_user_tmp_file(hadoop_hsperfdata_t) hadoop_domain_template(datanode) hadoop_domain_template(jobtracker) hadoop_domain_template(namenode) hadoop_domain_template(secondarynamenode) hadoop_domain_template(tasktracker) type zookeeper_t; type zookeeper_exec_t; userdom_user_application_domain(zookeeper_t, zookeeper_exec_t) type zookeeper_etc_t; files_config_file(zookeeper_etc_t) type zookeeper_log_t; logging_log_file(zookeeper_log_t) type zookeeper_server_t; type zookeeper_server_exec_t; init_daemon_domain(zookeeper_server_t, zookeeper_server_exec_t) type zookeeper_server_initrc_exec_t; init_script_file(zookeeper_server_initrc_exec_t) type zookeeper_server_tmp_t; files_tmp_file(zookeeper_server_tmp_t) type zookeeper_server_var_t; files_type(zookeeper_server_var_t) # This will need a file context specification. type zookeeper_server_var_run_t; files_pid_file(zookeeper_server_var_run_t) type zookeeper_tmp_t; userdom_user_tmp_file(zookeeper_tmp_t) ######################################## # # Hadoop policy. # allow hadoop_t self:capability sys_resource; allow hadoop_t self:process { getsched setsched signal signull setrlimit execmem }; allow hadoop_t self:fifo_file rw_fifo_file_perms; allow hadoop_t self:key write; allow hadoop_t self:tcp_socket create_stream_socket_perms; allow hadoop_t self:udp_socket create_socket_perms; dontaudit hadoop_t self:netlink_route_socket rw_netlink_socket_perms; allow hadoop_t hadoop_domain:process signull; hadoop_match_lan_spd(hadoop_t) allow hadoop_t self:peer recv; hadoop_recvfrom_datanode(hadoop_t) hadoop_recvfrom_jobtracker(hadoop_t) hadoop_recvfrom_namenode(hadoop_t) hadoop_recvfrom_tasktracker(hadoop_t) read_files_pattern(hadoop_t, hadoop_etc_t, hadoop_etc_t) read_lnk_files_pattern(hadoop_t, hadoop_etc_t, hadoop_etc_t) can_exec(hadoop_t, hadoop_etc_t) manage_dirs_pattern(hadoop_t, hadoop_home_t, hadoop_home_t) manage_files_pattern(hadoop_t, hadoop_home_t, hadoop_home_t) manage_lnk_files_pattern(hadoop_t, hadoop_home_t, hadoop_home_t) userdom_user_home_content_filetrans(hadoop_t, hadoop_home_t, { file dir }) allow hadoop_t hadoop_hsperfdata_t:dir manage_dir_perms; files_tmp_filetrans(hadoop_t, hadoop_hsperfdata_t, dir) manage_dirs_pattern(hadoop_t, hadoop_log_t, hadoop_log_t) manage_dirs_pattern(hadoop_t, hadoop_tmp_t, hadoop_tmp_t) manage_files_pattern(hadoop_t, hadoop_tmp_t, hadoop_tmp_t) filetrans_pattern(hadoop_t, hadoop_hsperfdata_t, hadoop_tmp_t, { dir file }) manage_dirs_pattern(hadoop_t, hadoop_var_lib_t, hadoop_var_lib_t) manage_files_pattern(hadoop_t, hadoop_var_lib_t, hadoop_var_lib_t) files_search_var_lib(hadoop_t) getattr_dirs_pattern(hadoop_t, hadoop_var_run_t, hadoop_var_run_t) kernel_read_network_state(hadoop_t) kernel_read_system_state(hadoop_t) corecmd_exec_bin(hadoop_t) corecmd_exec_shell(hadoop_t) corenet_all_recvfrom_netlabel(hadoop_t) corenet_tcp_sendrecv_generic_if(hadoop_t) corenet_udp_sendrecv_generic_if(hadoop_t) corenet_tcp_sendrecv_generic_node(hadoop_t) corenet_udp_sendrecv_generic_node(hadoop_t) corenet_tcp_bind_generic_node(hadoop_t) corenet_udp_bind_generic_node(hadoop_t) corenet_tcp_sendrecv_all_ports(hadoop_t) corenet_udp_sendrecv_all_ports(hadoop_t) corenet_tcp_connect_hadoop_namenode_port(hadoop_t) corenet_tcp_connect_hadoop_datanode_port(hadoop_t) corenet_tcp_connect_portmap_port(hadoop_t) corenet_tcp_connect_zope_port(hadoop_t) corenet_sendrecv_hadoop_namenode_client_packets(hadoop_t) corenet_sendrecv_portmap_client_packets(hadoop_t) corenet_sendrecv_zope_client_packets(hadoop_t) # Hadoop uses high ordered random ports for services # If permanent ports are chosen, remove line below and lock down corenet_tcp_connect_generic_port(hadoop_t) dev_read_rand(hadoop_t) dev_read_sysfs(hadoop_t) dev_read_urand(hadoop_t) domain_use_interactive_fds(hadoop_t) files_dontaudit_search_spool(hadoop_t) files_read_usr_files(hadoop_t) fs_getattr_xattr_fs(hadoop_t) auth_use_nsswitch(hadoop_t) userdom_use_inherited_user_terminals(hadoop_t) optional_policy(` java_exec(hadoop_t) ') optional_policy(` kerberos_use(hadoop_t) ') optional_policy(` nis_use_ypbind(hadoop_t) ') optional_policy(` nscd_socket_use(hadoop_t) ') ######################################## # # Hadoop datanode policy. # allow hadoop_datanode_t self:process signal; manage_dirs_pattern(hadoop_datanode_t, hadoop_var_lib_t, hadoop_var_lib_t) corenet_tcp_bind_hadoop_datanode_port(hadoop_datanode_t) corenet_tcp_connect_hadoop_datanode_port(hadoop_datanode_t) corenet_tcp_connect_hadoop_namenode_port(hadoop_datanode_t) fs_getattr_xattr_fs(hadoop_datanode_t) allow hadoop_datanode_t self:peer recv; hadoop_recvfrom_jobtracker(hadoop_datanode_t) hadoop_recvfrom_namenode(hadoop_datanode_t) hadoop_recvfrom(hadoop_datanode_t) hadoop_recvfrom_tasktracker(hadoop_datanode_t) ######################################## # # Hadoop jobtracker policy. # create_dirs_pattern(hadoop_jobtracker_t, hadoop_jobtracker_log_t, hadoop_jobtracker_log_t) setattr_dirs_pattern(hadoop_jobtracker_t, hadoop_jobtracker_log_t, hadoop_jobtracker_log_t) manage_dirs_pattern(hadoop_jobtracker_t, hadoop_var_lib_t, hadoop_var_lib_t) corenet_tcp_bind_zope_port(hadoop_jobtracker_t) corenet_tcp_connect_hadoop_datanode_port(hadoop_jobtracker_t) corenet_tcp_connect_hadoop_namenode_port(hadoop_jobtracker_t) allow hadoop_jobtracker_t self:peer recv; hadoop_recvfrom_datanode(hadoop_jobtracker_t) hadoop_recvfrom_namenode(hadoop_jobtracker_t) hadoop_recvfrom(hadoop_jobtracker_t) hadoop_recvfrom_tasktracker(hadoop_jobtracker_t) ######################################## # # Hadoop namenode policy. # manage_dirs_pattern(hadoop_namenode_t, hadoop_var_lib_t, hadoop_var_lib_t) manage_files_pattern(hadoop_namenode_t, hadoop_var_lib_t, hadoop_var_lib_t) corenet_tcp_bind_hadoop_namenode_port(hadoop_namenode_t) corenet_tcp_connect_hadoop_namenode_port(hadoop_namenode_t) allow hadoop_namenode_t self:peer recv; hadoop_recvfrom_datanode(hadoop_namenode_t) hadoop_recvfrom_jobtracker(hadoop_namenode_t) hadoop_recvfrom(hadoop_namenode_t) hadoop_recvfrom_secondarynamenode(hadoop_namenode_t) hadoop_recvfrom_tasktracker(hadoop_namenode_t) ######################################## # # Hadoop secondary namenode policy. # manage_dirs_pattern(hadoop_secondarynamenode_t, hadoop_var_lib_t, hadoop_var_lib_t) corenet_tcp_connect_hadoop_namenode_port(hadoop_secondarynamenode_t) allow hadoop_secondarynamenode_t self:peer recv; hadoop_recvfrom_namenode(hadoop_secondarynamenode_t) ######################################## # # Hadoop tasktracker policy. # allow hadoop_tasktracker_t self:process signal; manage_dirs_pattern(hadoop_tasktracker_t, hadoop_tasktracker_log_t, hadoop_tasktracker_log_t) setattr_dirs_pattern(hadoop_tasktracker_t, hadoop_log_t, hadoop_log_t) filetrans_pattern(hadoop_tasktracker_t, hadoop_log_t, hadoop_tasktracker_log_t, dir) filetrans_pattern(hadoop_tasktracker_t, hadoop_var_lib_t, hadoop_tasktracker_var_lib_t, lnk_file) manage_lnk_files_pattern(hadoop_tasktracker_t, hadoop_tasktracker_var_lib_t, hadoop_tasktracker_var_lib_t) manage_dirs_pattern(hadoop_tasktracker_t, hadoop_var_lib_t, hadoop_var_lib_t) corenet_tcp_connect_hadoop_datanode_port(hadoop_tasktracker_t) corenet_tcp_connect_hadoop_namenode_port(hadoop_tasktracker_t) corenet_tcp_connect_zope_port(hadoop_tasktracker_t) fs_getattr_xattr_fs(hadoop_tasktracker_t) allow hadoop_tasktracker_t self:peer recv; hadoop_recvfrom_datanode(hadoop_tasktracker_t) hadoop_recvfrom_jobtracker(hadoop_tasktracker_t) hadoop_recvfrom(hadoop_tasktracker_t) hadoop_recvfrom_namenode(hadoop_tasktracker_t) ######################################## # # Hadoop zookeeper client policy. # allow zookeeper_t self:process { getsched sigkill signal signull execmem }; allow zookeeper_t self:fifo_file rw_fifo_file_perms; allow zookeeper_t self:tcp_socket create_stream_socket_perms; allow zookeeper_t self:udp_socket create_socket_perms; dontaudit zookeeper_t self:netlink_route_socket rw_netlink_socket_perms; hadoop_match_lan_spd(zookeeper_t) hadoop_recvfrom_zookeeper_server(zookeeper_t) read_files_pattern(zookeeper_t, zookeeper_etc_t, zookeeper_etc_t) read_lnk_files_pattern(zookeeper_t, zookeeper_etc_t, zookeeper_etc_t) can_exec(zookeeper_t, zookeeper_exec_t) allow zookeeper_t hadoop_hsperfdata_t:dir manage_dir_perms; files_tmp_filetrans(zookeeper_t, hadoop_hsperfdata_t, dir) allow zookeeper_t zookeeper_log_t:dir { rw_dir_perms setattr_dir_perms }; allow zookeeper_t zookeeper_log_t:file { create_file_perms append_file_perms read_file_perms setattr_file_perms }; append_files_pattern(zookeeper_t, zookeeper_log_t, zookeeper_log_t) logging_log_filetrans(zookeeper_t, zookeeper_log_t, file) allow zookeeper_t zookeeper_server_t:process signull; manage_files_pattern(zookeeper_t, zookeeper_tmp_t, zookeeper_tmp_t) filetrans_pattern(zookeeper_t, hadoop_hsperfdata_t, zookeeper_tmp_t, file) kernel_read_network_state(zookeeper_t) kernel_read_system_state(zookeeper_t) corecmd_exec_bin(zookeeper_t) corecmd_exec_shell(zookeeper_t) corenet_all_recvfrom_netlabel(zookeeper_t) corenet_tcp_sendrecv_generic_if(zookeeper_t) corenet_udp_sendrecv_generic_if(zookeeper_t) corenet_tcp_sendrecv_generic_node(zookeeper_t) corenet_udp_sendrecv_generic_node(zookeeper_t) corenet_tcp_sendrecv_all_ports(zookeeper_t) corenet_udp_sendrecv_all_ports(zookeeper_t) corenet_tcp_bind_generic_node(zookeeper_t) corenet_udp_bind_generic_node(zookeeper_t) corenet_tcp_connect_zookeeper_client_port(zookeeper_t) corenet_sendrecv_zookeeper_client_client_packets(zookeeper_t) # Hadoop uses high ordered random ports for services # If permanent ports are chosen, remove line below and lock down corenet_tcp_connect_generic_port(zookeeper_t) dev_read_rand(zookeeper_t) dev_read_sysfs(zookeeper_t) dev_read_urand(zookeeper_t) domain_use_interactive_fds(zookeeper_t) files_read_usr_files(zookeeper_t) auth_use_nsswitch(zookeeper_t) sysnet_read_config(zookeeper_t) userdom_use_inherited_user_terminals(zookeeper_t) userdom_dontaudit_search_user_home_dirs(zookeeper_t) optional_policy(` java_exec(zookeeper_t) ') ######################################## # # Hadoop zookeeper server policy. # allow zookeeper_server_t self:capability kill; allow zookeeper_server_t self:process { execmem getsched sigkill signal signull }; allow zookeeper_server_t self:fifo_file rw_fifo_file_perms; allow zookeeper_server_t self:netlink_route_socket rw_netlink_socket_perms; allow zookeeper_server_t self:tcp_socket create_stream_socket_perms; allow zookeeper_server_t self:udp_socket create_socket_perms; hadoop_match_lan_spd(zookeeper_server_t) allow zookeeper_server_t self:peer recv; hadoop_recvfrom_zookeeper_client(zookeeper_server_t) allow zookeeper_server_t hadoop_hsperfdata_t:dir manage_dir_perms; files_tmp_filetrans(zookeeper_server_t, hadoop_hsperfdata_t, dir) read_files_pattern(zookeeper_server_t, zookeeper_etc_t, zookeeper_etc_t) read_lnk_files_pattern(zookeeper_server_t, zookeeper_etc_t, zookeeper_etc_t) manage_dirs_pattern(zookeeper_server_t, zookeeper_server_var_t, zookeeper_server_var_t) manage_files_pattern(zookeeper_server_t, zookeeper_server_var_t, zookeeper_server_var_t) files_var_lib_filetrans(zookeeper_server_t, zookeeper_server_var_t, { dir file }) allow zookeeper_server_t zookeeper_log_t:dir { rw_dir_perms setattr_dir_perms }; allow zookeeper_server_t zookeeper_log_t:file { create_file_perms append_file_perms read_file_perms setattr_file_perms }; logging_log_filetrans(zookeeper_server_t, zookeeper_log_t, file) manage_files_pattern(zookeeper_server_t, zookeeper_server_tmp_t, zookeeper_server_tmp_t) filetrans_pattern(zookeeper_server_t, hadoop_hsperfdata_t, zookeeper_server_tmp_t, file) manage_files_pattern(zookeeper_server_t, zookeeper_server_var_run_t, zookeeper_server_var_run_t) files_pid_filetrans(zookeeper_server_t, zookeeper_server_var_run_t, file) can_exec(zookeeper_server_t, zookeeper_server_exec_t) kernel_read_network_state(zookeeper_server_t) kernel_read_system_state(zookeeper_server_t) corecmd_exec_bin(zookeeper_server_t) corecmd_exec_shell(zookeeper_server_t) corenet_all_recvfrom_netlabel(zookeeper_server_t) corenet_tcp_sendrecv_generic_if(zookeeper_server_t) corenet_udp_sendrecv_generic_if(zookeeper_server_t) corenet_tcp_sendrecv_generic_node(zookeeper_server_t) corenet_udp_sendrecv_generic_node(zookeeper_server_t) corenet_tcp_sendrecv_all_ports(zookeeper_server_t) corenet_udp_sendrecv_all_ports(zookeeper_server_t) corenet_tcp_bind_generic_node(zookeeper_server_t) corenet_udp_bind_generic_node(zookeeper_server_t) corenet_tcp_bind_zookeeper_client_port(zookeeper_server_t) corenet_tcp_bind_zookeeper_election_port(zookeeper_server_t) corenet_tcp_bind_zookeeper_leader_port(zookeeper_server_t) corenet_tcp_connect_zookeeper_election_port(zookeeper_server_t) corenet_tcp_connect_zookeeper_leader_port(zookeeper_server_t) corenet_sendrecv_zookeeper_election_client_packets(zookeeper_server_t) corenet_sendrecv_zookeeper_leader_client_packets(zookeeper_server_t) corenet_sendrecv_zookeeper_client_server_packets(zookeeper_server_t) corenet_sendrecv_zookeeper_election_server_packets(zookeeper_server_t) corenet_sendrecv_zookeeper_leader_server_packets(zookeeper_server_t) # Hadoop uses high ordered random ports for services # If permanent ports are chosen, remove line below and lock down corenet_tcp_connect_generic_port(zookeeper_server_t) dev_read_rand(zookeeper_server_t) dev_read_sysfs(zookeeper_server_t) dev_read_urand(zookeeper_server_t) files_read_usr_files(zookeeper_server_t) fs_getattr_xattr_fs(zookeeper_server_t) logging_send_syslog_msg(zookeeper_server_t) sysnet_read_config(zookeeper_server_t) optional_policy(` java_exec(zookeeper_server_t) ')