Updated policy

Updated policy

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 234 bytes --]

Added booleans to turn on httpd connecting to mysql/postgres as well as 
relay.

nis_signal_ypbind requires you to be able to read pidfile.

mount command wants access to tty. needs to be able to search rpc_pipefs 
in Fedora.


-- 



[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 4019 bytes --]

diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-2.1.2/Makefile
--- nsaserefpolicy/Makefile	2005-12-09 23:35:04.000000000 -0500
+++ serefpolicy-2.1.2/Makefile	2005-12-10 00:10:25.000000000 -0500
@@ -92,7 +92,7 @@
 
 # enable MLS if requested.
 ifneq ($(findstring -mls,$(TYPE)),)
-	override M4PARAM += -D enable_mls
+	override M4PARAM += -D enable_mls -D separate_secadm
 	override CHECKPOLICY += -M
 	override CHECKMODULE += -M
 endif
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.1.2/policy/global_tunables
--- nsaserefpolicy/policy/global_tunables	2005-12-02 17:53:25.000000000 -0500
+++ serefpolicy-2.1.2/policy/global_tunables	2005-12-10 00:14:31.000000000 -0500
@@ -68,6 +68,12 @@
 ## Allow http daemon to tcp connect 
 gen_tunable(httpd_can_network_connect,false)
 
+## allow httpd to connect to mysql/posgresql 
+gen_tunable(httpd_can_network_connect_db, false)
+
+## allow httpd to connect to mysql/posgresql 
+gen_tunable(httpd_can_network_relay, false)
+
 ## Allow httpd cgi support
 gen_tunable(httpd_enable_cgi,false)
 
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.1.2/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te	2005-12-09 23:35:05.000000000 -0500
+++ serefpolicy-2.1.2/policy/modules/services/apache.te	2005-12-10 00:10:25.000000000 -0500
@@ -226,14 +226,6 @@
 corenet_udp_bind_all_nodes(httpd_t)
 corenet_tcp_bind_http_port(httpd_t)
 corenet_tcp_bind_http_cache_port(httpd_t)
-# allow httpd to connect to mysql/posgresql 
-corenet_tcp_connect_postgresql_port(httpd_t)
-corenet_tcp_connect_mysqld_port(httpd_t)
-# allow httpd to work as a relay
-corenet_tcp_connect_gopher_port(httpd_t)
-corenet_tcp_connect_ftp_port(httpd_t)
-corenet_tcp_connect_http_port(httpd_t)
-corenet_tcp_connect_http_cache_port(httpd_t)
 
 dev_read_sysfs(httpd_t)
 dev_read_rand(httpd_t)
@@ -304,6 +296,21 @@
 	miscfiles_manage_public_files(httpd_t)
 ') 
 
+# allow httpd to connect to mysql/posgresql 
+tunable_policy(`httpd_can_network_connect_db',`
+	corenet_tcp_connect_postgresql_port(httpd_t)
+	corenet_tcp_connect_mysqld_port(httpd_t)
+')
+
+# allow httpd to connect to mysql/posgresql 
+tunable_policy(`httpd_can_network_relay',`
+	# allow httpd to work as a relay
+	corenet_tcp_connect_gopher_port(httpd_t)
+	corenet_tcp_connect_ftp_port(httpd_t)
+	corenet_tcp_connect_http_port(httpd_t)
+	corenet_tcp_connect_http_cache_port(httpd_t)
+')
+
 tunable_policy(`httpd_can_network_connect',`
 	allow httpd_t self:tcp_socket create_socket_perms;
 	allow httpd_t self:udp_socket create_socket_perms;
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.1.2/policy/modules/services/nis.if
--- nsaserefpolicy/policy/modules/services/nis.if	2005-12-06 19:49:50.000000000 -0500
+++ serefpolicy-2.1.2/policy/modules/services/nis.if	2005-12-10 00:10:25.000000000 -0500
@@ -150,8 +150,10 @@
 interface(`nis_signal_ypbind',`
 	gen_require(`
 		type ypbind_t;
+		type ypbind_var_run_t;
 	')
 
+	allow $1 ypbind_var_run_t:file read;
 	allow $1 ypbind_t:process signal;
 ')
 
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.1.2/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te	2005-12-09 23:35:08.000000000 -0500
+++ serefpolicy-2.1.2/policy/modules/system/mount.te	2005-12-10 00:10:25.000000000 -0500
@@ -47,6 +47,7 @@
 fs_use_tmpfs_chr_dev(mount_t)
 
 term_use_console(mount_t)
+term_use_generic_pty(mount_t)
 
 # required for mount.smbfs
 corecmd_exec_sbin(mount_t)
@@ -94,9 +95,7 @@
 
 optional_policy(`portmap',`
 	# for nfs
-	#allow portmap_t mount_t:udp_socket { sendto recvfrom };
-	#allow mount_t portmap_t:udp_socket { sendto recvfrom };
-	#allow mount_t rpc_pipefs_t:dir search;
+	allow mount_t rpc_pipefs_t:dir search;
 	corenet_tcp_sendrecv_all_if(mount_t)
 	corenet_raw_sendrecv_all_if(mount_t)
 	corenet_udp_sendrecv_all_if(mount_t)

Re: Updated policy

[Christopher J. PeBenito]

On Sat, 2005-12-10 at 00:26 -0500, Daniel J Walsh wrote:
> Added booleans to turn on httpd connecting to mysql/postgres as well as 
> relay.

merged.

> nis_signal_ypbind requires you to be able to read pidfile.

Not going to merge this, for a couple reasons.  First, it would still be
good to have an interface that allows just the signal, for the case that
the signaler already knows the PID.  Second, it introduces a large info
flow backchannel, since ypbid can write it's pid file.  This is a
candidate for a more abstract interface whose implementation would be to
call the signal interface and the read pid interface.

> mount command wants access to tty

This sounds specific to targeted since its devpts_t, shouldn't it be in
a ifdef(`targeted_policy' ?

>  needs to be able to search rpc_pipefs 
> in Fedora.

Added an interface to handle this, rather than the raw rule.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

postfix mysql

[Antoine Martin]

Based on a similar policy update, I guess that what I have been adding
to the postfix policy to enable it to use the mysql backend could be
achieved with a boolean and merged upsteam?


ifdef(`mysqld.te', `
tunable_policy(`postfix_can_network_connect_db',`
can_unix_connect(postfix_smtpd_t, mysqld_t)
allow postfix_smtpd_t mysqld_var_run_t:dir { search };
allow postfix_smtpd_t mysqld_var_run_t:sock_file { write };

can_unix_connect(postfix_pipe_t, mysqld_t)
allow postfix_pipe_t mysqld_var_run_t:dir { search };
allow postfix_pipe_t mysqld_var_run_t:sock_file { write };

can_unix_connect(postfix_master_t, mysqld_t)
allow postfix_master_t mysqld_var_run_t:dir { search };
allow postfix_master_t mysqld_var_run_t:sock_file { write };

can_unix_connect(postfix_cleanup_t, mysqld_t)
allow postfix_cleanup_t mysqld_var_run_t:dir { search };
allow postfix_cleanup_t mysqld_var_run_t:sock_file { write };

can_unix_connect(postfix_postdrop_t, mysqld_t)
allow postfix_postdrop_t mysqld_var_run_t:dir { search };
allow postfix_postdrop_t mysqld_var_run_t:sock_file { write };
')
# Why postfix_cleanup/postdrop needs access to this charset file?
(/usr/share/mysql/charsets/Index)
# beats me:
allow postfix_cleanup_t usr_t:file { getattr read };
allow postfix_postdrop_t usr_t:file { getattr read };
 ')
')


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.