mdadm policy

[antoine <antoine@nagafix.co.uk>]

[-- Attachment #1: Type: text/plain, Size: 433 bytes --]

I was looking for a policy for mdadm, I know there is one in Fedora, but
I use gentoo and I couldn't download it without getting the whole rpm,
so I ended up writing one (attached) - it is also a good learning
exercise. Shouldn't it be in serefpolicy.sourceforge.net?

Works for me (tm)
Is this any good? (I think it should probably use macros for shlib and
ptys, and use dontaudit instead of allow for some of the devices)

Antoine

[-- Attachment #2: mdadm.fc --]
[-- Type: text/plain, Size: 102 bytes --]

/etc/mdadm.conf					--	system_u:object_r:mdadm_etc_t
/sbin/mdadm					--	system_u:object_r:mdadm_bin_t

[-- Attachment #3: mdadm.te --]
[-- Type: text/plain, Size: 1887 bytes --]

# antoine@nagafix.co.uk

daemon_domain(mdadm, `, fs_domain')

type mdadm_etc_t, file_type, sysadmfile;
type mdadm_bin_t, file_type, sysadmfile;

domain_auto_trans(initrc_t, mdadm_bin_t, mdadm_t)
domain_auto_trans(sysadm_t, mdadm_bin_t, mdadm_t)

# role system_r types mdadm_t;

allow initrc_t mdadm_etc_t:file read;
allow mdadm_t mdadm_etc_t:file { getattr read };

allow mdadm_t etc_t:dir search;

allow mdadm_t ld_so_cache_t:file { getattr read };
allow mdadm_t lib_t:dir search;
allow mdadm_t lib_t:lnk_file read;
allow mdadm_t shlib_t:file { execute getattr read };

allow mdadm_t proc_mdstat_t:file { getattr read };
allow mdadm_t proc_t:dir search;
allow mdadm_t root_t:dir search;

allow mdadm_t tmpfs_t:dir { getattr read };


allow mdadm_t device_t:lnk_file read;

allow mdadm_t self:capability sys_admin;


# DEV:
allow mdadm_t clock_device_t:chr_file getattr;
allow mdadm_t console_device_t:chr_file { getattr read write };
allow mdadm_t cpu_device_t:chr_file getattr;
allow mdadm_t device_t:blk_file { getattr ioctl read };
allow mdadm_t device_t:chr_file getattr;
allow mdadm_t device_t:dir { getattr read search };
allow mdadm_t device_t:file getattr;
allow mdadm_t device_t:lnk_file getattr;
allow mdadm_t devlog_t:sock_file getattr;
allow mdadm_t devpts_t:dir { getattr read };
allow mdadm_t devtty_t:chr_file getattr;
allow mdadm_t fixed_disk_device_t:blk_file getattr;
allow mdadm_t init_t:fd use;
allow mdadm_t initctl_t:fifo_file getattr;
allow mdadm_t memory_device_t:chr_file getattr;
allow mdadm_t mouse_device_t:chr_file getattr;
allow mdadm_t null_device_t:chr_file { getattr read };
allow mdadm_t ptmx_t:chr_file getattr;
allow mdadm_t random_device_t:chr_file getattr;
allow mdadm_t tty_device_t:chr_file getattr;
#allow mdadm_t tun_tap_device_t:chr_file getattr;
allow mdadm_t zero_device_t:chr_file getattr;

allow mdadm_t fixed_disk_device_t:blk_file read;