policy additions needed to make my system run in secure mode

[Justin Smith <jsmith@mcs.drexel.edu>]

These are lines of text I had to ADD to the default NSA policy to
allow my system to boot and run its normal functions in secure mode:


(I haven't tested X windows and my usual desktop environment yet, 
so there may be more such additions...)
------------------------------------------------------------------------
initrc.te:

# ipchains
allow initrc_t initrc_t:rawip_socket { create setopt };

# usb

allow initrc_t unlabeled_t:dir { search };
allow initrc_t unlabeled_t:file { read getattr };
allow mount_t usr_t:dir { mounton };
allow mount_t usr_t:file { append setattr };
allow mount_t proc_t:dir { mounton };


# postgres

allow initrc_t user_home_t:dir { append };
allow initrc_t user_home_t:file { append };
allow initrc_t var_lib_t:dir { write add_name create };
allow initrc_t var_lib_t:file { create };
allow initrc_t tmpfs_t:file { read write };
--------------------------------------------------------------------------
apache.te:

# General (allow server-side includes)

allow httpd_t httpd_user_script_rw_t:file { getattr read };

#
# Servlets
# (I modified file types to make all my web pages t
#  httpd_user_script_rw_t
# and the Tomcat servlet directory to httpd_user_script)
#

allow httpd_t httpd_user_script_t:file { append };
allow initrc_t httpd_user_script_rw_t:dir 
       { getattr search };

allow httpd_t httpd_user_script_rw_t:dir 
       { search getattr };
allow initrc_t httpd_user_script_rw_t:file 
       { read getattr append write };

allow initrc_t httpd_user_script_t:dir { read write };
allow initrc_t httpd_user_script_t:file 
       { read write execute execute_no_trans setattr append };
allow initrc_t file_t:lnk_file { read };
allow initrc_t file_t:file { execute execute_no_trans };
allow initrc_t usr_t:file { execute execute_no_trans };
allow initrc_t http_port_t:tcp_socket { name_bind };
--------------------------------------------------------------

user.te:

# Postgres

allow user_t usr_t:file { execute execute_no_trans };
allow user_t initrc_tmp_t:sock_file { write };
allow user_t initrc_t:unix_stream_socket { connect };

----------------------------------------------------------

These may not be ideal from a security point of view but they work.

-- 


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.