forked from OwlCyberDefense/refpolicy-contrib
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsetroubleshoot.if
155 lines (138 loc) · 3.47 KB
/
setroubleshoot.if
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
## <summary>SELinux troubleshooting service.</summary>
########################################
## <summary>
## Connect to setroubleshootd with a
## unix domain stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`setroubleshoot_stream_connect',`
gen_require(`
type setroubleshootd_t, setroubleshoot_var_run_t;
')
files_search_pids($1)
stream_connect_pattern($1, setroubleshoot_var_run_t, setroubleshoot_var_run_t, setroubleshootd_t)
allow $1 setroubleshoot_var_run_t:sock_file read;
')
########################################
## <summary>
## Do not audit attempts to connect to
## setroubleshootd with a unix
## domain stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`setroubleshoot_dontaudit_stream_connect',`
gen_require(`
type setroubleshootd_t, setroubleshoot_var_run_t;
')
dontaudit $1 setroubleshoot_var_run_t:sock_file rw_sock_file_perms;
dontaudit $1 setroubleshootd_t:unix_stream_socket connectto;
')
#######################################
## <summary>
## Send null signals to setroubleshoot.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`setroubleshoot_signull',`
gen_require(`
type setroubleshootd_t;
')
allow $1 setroubleshootd_t:process signull;
')
########################################
## <summary>
## Send and receive messages from
## setroubleshoot over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`setroubleshoot_dbus_chat',`
gen_require(`
type setroubleshootd_t;
class dbus send_msg;
')
allow $1 setroubleshootd_t:dbus send_msg;
allow setroubleshootd_t $1:dbus send_msg;
')
########################################
## <summary>
## Do not audit send and receive messages from
## setroubleshoot over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`setroubleshoot_dontaudit_dbus_chat',`
gen_require(`
type setroubleshootd_t;
class dbus send_msg;
')
dontaudit $1 setroubleshootd_t:dbus send_msg;
dontaudit setroubleshootd_t $1:dbus send_msg;
')
########################################
## <summary>
## Send and receive messages from
## setroubleshoot fixit over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`setroubleshoot_dbus_chat_fixit',`
gen_require(`
type setroubleshoot_fixit_t;
class dbus send_msg;
')
allow $1 setroubleshoot_fixit_t:dbus send_msg;
allow setroubleshoot_fixit_t $1:dbus send_msg;
')
########################################
## <summary>
## All of the rules required to
## administrate an setroubleshoot environment.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`setroubleshoot_admin',`
gen_require(`
type setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_fixit_t;
type setroubleshoot_var_lib_t, setroubleshoot_var_run_t;
')
allow $1 { setroubleshoot_fixit_t setroubleshootd_t }:process { ptrace signal_perms };
ps_process_pattern($1, { setroubleshootd_t setroubleshoot_fixit_t })
logging_list_logs($1)
admin_pattern($1, setroubleshoot_var_log_t)
files_list_var_lib($1)
admin_pattern($1, setroubleshoot_var_lib_t)
files_list_pids($1)
admin_pattern($1, setroubleshoot_var_run_t)
')