* [refpolicy] [PATCH 1/4] Introduce lvm_admin interface
@ 2015-07-11 9:15 Jason Zaman
2015-07-11 9:15 ` [refpolicy] [PATCH 2/4] Introduce ipsec_admin interface Jason Zaman
` (3 more replies)
0 siblings, 4 replies; 8+ messages in thread
From: Jason Zaman @ 2015-07-11 9:15 UTC (permalink / raw)
To: refpolicy
---
policy/modules/roles/sysadm.te | 1 +
policy/modules/system/lvm.if | 44 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 45 insertions(+)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 9e27a3a..0a6b4b2 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -578,6 +578,7 @@ optional_policy(`
')
optional_policy(`
+ lvm_admin(sysadm_t, sysadm_r)
lvm_run(sysadm_t, sysadm_r)
')
diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if
index 58bc27f..86b223c 100644
--- a/policy/modules/system/lvm.if
+++ b/policy/modules/system/lvm.if
@@ -123,3 +123,47 @@ interface(`lvm_domtrans_clvmd',`
corecmd_search_bin($1)
domtrans_pattern($1, clvmd_exec_t, clvmd_t)
')
+
+######################################
+## <summary>
+## All of the rules required to
+## administrate an lvm environment.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+#
+interface(`lvm_admin',`
+ gen_require(`
+ type clvmd_t, clvmd_exec_t, clvmd_initrc_exec_t;
+ type lvm_etc_t, lvm_lock_t, lvm_metadata_t;
+ type lvm_var_lib_t, lvm_var_run_t, clvmd_var_run_t, lvm_tmp_t;
+ ')
+
+ allow $1 clvmd_t:process { ptrace signal_perms };
+ ps_process_pattern($1, clvmd_t)
+
+ init_startstop_service($1, $2, clvmd_t, clvmd_initrc_exec_t)
+
+ files_search_etc($1)
+ admin_pattern($1, lvm_etc_t)
+
+ files_search_locks($1)
+ admin_pattern($1, lvm_lock_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, lvm_var_lib_t)
+
+ files_search_pids($1)
+ admin_pattern($1, { lvm_var_run_t clvmd_var_run_t })
+
+ files_search_tmp($1)
+ admin_pattern($1, lvm_tmp_t)
+')
--
2.3.6
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [refpolicy] [PATCH 2/4] Introduce ipsec_admin interface
2015-07-11 9:15 [refpolicy] [PATCH 1/4] Introduce lvm_admin interface Jason Zaman
@ 2015-07-11 9:15 ` Jason Zaman
2015-07-14 15:17 ` Christopher J. PeBenito
2015-07-11 9:15 ` [refpolicy] [PATCH 3/4] Introduce setrans_admin interface Jason Zaman
` (2 subsequent siblings)
3 siblings, 1 reply; 8+ messages in thread
From: Jason Zaman @ 2015-07-11 9:15 UTC (permalink / raw)
To: refpolicy
---
policy/modules/roles/sysadm.te | 8 +------
policy/modules/system/ipsec.if | 51 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 52 insertions(+), 7 deletions(-)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 0a6b4b2..253f6ba 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -473,13 +473,7 @@ optional_policy(`
')
optional_policy(`
- # allow system administrator to use the ipsec script to look
- # at things (e.g., ipsec auto --status)
- # probably should create an ipsec_admin role for this kind of thing
- ipsec_exec_mgmt(sysadm_t)
- ipsec_stream_connect(sysadm_t)
- # for lsof
- ipsec_getattr_key_sockets(sysadm_t)
+ ipsec_admin(sysadm_t, sysadm_r)
')
optional_policy(`
diff --git a/policy/modules/system/ipsec.if b/policy/modules/system/ipsec.if
index 0d4c8d3..3d64054 100644
--- a/policy/modules/system/ipsec.if
+++ b/policy/modules/system/ipsec.if
@@ -369,3 +369,54 @@ interface(`ipsec_run_setkey',`
ipsec_domtrans_setkey($1)
role $2 types setkey_t;
')
+
+########################################
+## <summary>
+## All of the rules required to
+## administrate an ipsec environment.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`ipsec_admin',`
+ gen_require(`
+ type ipsec_t, ipsec_initrc_exec_t, ipsec_conf_file_t;
+ type ipsec_key_file_t, ipsec_log_t, ipsec_tmp_t;
+ type ipsec_var_run_t, ipsec_mgmt_lock_t;
+ type ipsec_mgmt_var_run_t, racoon_tmp_t;
+ ')
+
+ allow $1 ipsec_t:process { ptrace signal_perms };
+ ps_process_pattern($1, ipsec_t)
+
+ init_startstop_service($1, $2, ipsec_t, ipsec_initrc_exec_t)
+
+ ipsec_exec_mgmt($1)
+ ipsec_stream_connect($1)
+ # for lsof
+ ipsec_getattr_key_sockets($1)
+
+ files_search_etc($1)
+ admin_pattern($1, { ipsec_conf_file_t ipsec_key_file_t })
+
+ files_search_tmp($1)
+ admin_pattern($1, { ipsec_tmp_t racoon_tmp_t })
+
+ files_search_pids($1)
+ admin_pattern($1, { ipsec_var_run_t ipsec_mgmt_var_run_t })
+
+ files_search_locks($1)
+ admin_pattern($1, ipsec_mgmt_lock_t)
+
+ logging_search_logs($1)
+ admin_pattern($1, ipsec_log_t)
+')
--
2.3.6
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [refpolicy] [PATCH 3/4] Introduce setrans_admin interface
2015-07-11 9:15 [refpolicy] [PATCH 1/4] Introduce lvm_admin interface Jason Zaman
2015-07-11 9:15 ` [refpolicy] [PATCH 2/4] Introduce ipsec_admin interface Jason Zaman
@ 2015-07-11 9:15 ` Jason Zaman
2015-07-14 15:18 ` Christopher J. PeBenito
2015-07-11 9:15 ` [refpolicy] [PATCH 4/4] add new cron_admin interface to sysadm Jason Zaman
2015-07-14 15:17 ` [refpolicy] [PATCH 1/4] Introduce lvm_admin interface Christopher J. PeBenito
3 siblings, 1 reply; 8+ messages in thread
From: Jason Zaman @ 2015-07-11 9:15 UTC (permalink / raw)
To: refpolicy
---
policy/modules/roles/sysadm.te | 4 ++++
policy/modules/system/setrans.if | 31 +++++++++++++++++++++++++++++++
2 files changed, 35 insertions(+)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 253f6ba..db7b54f 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -952,6 +952,10 @@ optional_policy(`
')
optional_policy(`
+ setrans_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
setroubleshoot_admin(sysadm_t, sysadm_r)
')
diff --git a/policy/modules/system/setrans.if b/policy/modules/system/setrans.if
index efa9c27..2a8ecaa 100644
--- a/policy/modules/system/setrans.if
+++ b/policy/modules/system/setrans.if
@@ -40,3 +40,34 @@ interface(`setrans_translate_context',`
stream_connect_pattern($1, setrans_var_run_t, setrans_var_run_t, setrans_t)
files_list_pids($1)
')
+
+######################################
+## <summary>
+## All of the rules required to
+## administrate an setrans environment.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+#
+interface(`setrans_admin',`
+ gen_require(`
+ type setrans_t, setrans_initrc_exec_t;
+ type setrans_var_run_t;
+ ')
+
+ allow $1 setrans_t:process { ptrace signal_perms };
+ ps_process_pattern($1, setrans_t)
+
+ init_startstop_service($1, $2, setrans_t, setrans_initrc_exec_t)
+
+ files_search_pids($1)
+ admin_pattern($1, setrans_var_run_t)
+')
--
2.3.6
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [refpolicy] [PATCH 4/4] add new cron_admin interface to sysadm
2015-07-11 9:15 [refpolicy] [PATCH 1/4] Introduce lvm_admin interface Jason Zaman
2015-07-11 9:15 ` [refpolicy] [PATCH 2/4] Introduce ipsec_admin interface Jason Zaman
2015-07-11 9:15 ` [refpolicy] [PATCH 3/4] Introduce setrans_admin interface Jason Zaman
@ 2015-07-11 9:15 ` Jason Zaman
2015-07-17 13:30 ` Christopher J. PeBenito
2015-07-14 15:17 ` [refpolicy] [PATCH 1/4] Introduce lvm_admin interface Christopher J. PeBenito
3 siblings, 1 reply; 8+ messages in thread
From: Jason Zaman @ 2015-07-11 9:15 UTC (permalink / raw)
To: refpolicy
---
policy/modules/roles/sysadm.te | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index db7b54f..f61075d 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -274,6 +274,10 @@ optional_policy(`
')
optional_policy(`
+ cron_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
ctdb_admin(sysadm_t, sysadm_r)
')
--
2.3.6
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [refpolicy] [PATCH 1/4] Introduce lvm_admin interface
2015-07-11 9:15 [refpolicy] [PATCH 1/4] Introduce lvm_admin interface Jason Zaman
` (2 preceding siblings ...)
2015-07-11 9:15 ` [refpolicy] [PATCH 4/4] add new cron_admin interface to sysadm Jason Zaman
@ 2015-07-14 15:17 ` Christopher J. PeBenito
3 siblings, 0 replies; 8+ messages in thread
From: Christopher J. PeBenito @ 2015-07-14 15:17 UTC (permalink / raw)
To: refpolicy
On 7/11/2015 5:15 AM, Jason Zaman wrote:
> ---
> policy/modules/roles/sysadm.te | 1 +
> policy/modules/system/lvm.if | 44 ++++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 45 insertions(+)
>
> diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
> index 9e27a3a..0a6b4b2 100644
> --- a/policy/modules/roles/sysadm.te
> +++ b/policy/modules/roles/sysadm.te
> @@ -578,6 +578,7 @@ optional_policy(`
> ')
>
> optional_policy(`
> + lvm_admin(sysadm_t, sysadm_r)
> lvm_run(sysadm_t, sysadm_r)
> ')
>
> diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if
> index 58bc27f..86b223c 100644
> --- a/policy/modules/system/lvm.if
> +++ b/policy/modules/system/lvm.if
> @@ -123,3 +123,47 @@ interface(`lvm_domtrans_clvmd',`
> corecmd_search_bin($1)
> domtrans_pattern($1, clvmd_exec_t, clvmd_t)
> ')
> +
> +######################################
> +## <summary>
> +## All of the rules required to
> +## administrate an lvm environment.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## Role allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`lvm_admin',`
> + gen_require(`
> + type clvmd_t, clvmd_exec_t, clvmd_initrc_exec_t;
> + type lvm_etc_t, lvm_lock_t, lvm_metadata_t;
> + type lvm_var_lib_t, lvm_var_run_t, clvmd_var_run_t, lvm_tmp_t;
> + ')
> +
> + allow $1 clvmd_t:process { ptrace signal_perms };
> + ps_process_pattern($1, clvmd_t)
> +
> + init_startstop_service($1, $2, clvmd_t, clvmd_initrc_exec_t)
> +
> + files_search_etc($1)
> + admin_pattern($1, lvm_etc_t)
> +
> + files_search_locks($1)
> + admin_pattern($1, lvm_lock_t)
> +
> + files_search_var_lib($1)
> + admin_pattern($1, lvm_var_lib_t)
> +
> + files_search_pids($1)
> + admin_pattern($1, { lvm_var_run_t clvmd_var_run_t })
> +
> + files_search_tmp($1)
> + admin_pattern($1, lvm_tmp_t)
> +')
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* [refpolicy] [PATCH 2/4] Introduce ipsec_admin interface
2015-07-11 9:15 ` [refpolicy] [PATCH 2/4] Introduce ipsec_admin interface Jason Zaman
@ 2015-07-14 15:17 ` Christopher J. PeBenito
0 siblings, 0 replies; 8+ messages in thread
From: Christopher J. PeBenito @ 2015-07-14 15:17 UTC (permalink / raw)
To: refpolicy
On 7/11/2015 5:15 AM, Jason Zaman wrote:
> ---
> policy/modules/roles/sysadm.te | 8 +------
> policy/modules/system/ipsec.if | 51 ++++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 52 insertions(+), 7 deletions(-)
>
> diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
> index 0a6b4b2..253f6ba 100644
> --- a/policy/modules/roles/sysadm.te
> +++ b/policy/modules/roles/sysadm.te
> @@ -473,13 +473,7 @@ optional_policy(`
> ')
>
> optional_policy(`
> - # allow system administrator to use the ipsec script to look
> - # at things (e.g., ipsec auto --status)
> - # probably should create an ipsec_admin role for this kind of thing
> - ipsec_exec_mgmt(sysadm_t)
> - ipsec_stream_connect(sysadm_t)
> - # for lsof
> - ipsec_getattr_key_sockets(sysadm_t)
> + ipsec_admin(sysadm_t, sysadm_r)
> ')
>
> optional_policy(`
> diff --git a/policy/modules/system/ipsec.if b/policy/modules/system/ipsec.if
> index 0d4c8d3..3d64054 100644
> --- a/policy/modules/system/ipsec.if
> +++ b/policy/modules/system/ipsec.if
> @@ -369,3 +369,54 @@ interface(`ipsec_run_setkey',`
> ipsec_domtrans_setkey($1)
> role $2 types setkey_t;
> ')
> +
> +########################################
> +## <summary>
> +## All of the rules required to
> +## administrate an ipsec environment.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## Role allowed access.
> +## </summary>
> +## </param>
> +## <rolecap/>
> +#
> +interface(`ipsec_admin',`
> + gen_require(`
> + type ipsec_t, ipsec_initrc_exec_t, ipsec_conf_file_t;
> + type ipsec_key_file_t, ipsec_log_t, ipsec_tmp_t;
> + type ipsec_var_run_t, ipsec_mgmt_lock_t;
> + type ipsec_mgmt_var_run_t, racoon_tmp_t;
> + ')
> +
> + allow $1 ipsec_t:process { ptrace signal_perms };
> + ps_process_pattern($1, ipsec_t)
> +
> + init_startstop_service($1, $2, ipsec_t, ipsec_initrc_exec_t)
> +
> + ipsec_exec_mgmt($1)
> + ipsec_stream_connect($1)
> + # for lsof
> + ipsec_getattr_key_sockets($1)
> +
> + files_search_etc($1)
> + admin_pattern($1, { ipsec_conf_file_t ipsec_key_file_t })
> +
> + files_search_tmp($1)
> + admin_pattern($1, { ipsec_tmp_t racoon_tmp_t })
> +
> + files_search_pids($1)
> + admin_pattern($1, { ipsec_var_run_t ipsec_mgmt_var_run_t })
> +
> + files_search_locks($1)
> + admin_pattern($1, ipsec_mgmt_lock_t)
> +
> + logging_search_logs($1)
> + admin_pattern($1, ipsec_log_t)
> +')
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* [refpolicy] [PATCH 3/4] Introduce setrans_admin interface
2015-07-11 9:15 ` [refpolicy] [PATCH 3/4] Introduce setrans_admin interface Jason Zaman
@ 2015-07-14 15:18 ` Christopher J. PeBenito
0 siblings, 0 replies; 8+ messages in thread
From: Christopher J. PeBenito @ 2015-07-14 15:18 UTC (permalink / raw)
To: refpolicy
On 7/11/2015 5:15 AM, Jason Zaman wrote:
> ---
> policy/modules/roles/sysadm.te | 4 ++++
> policy/modules/system/setrans.if | 31 +++++++++++++++++++++++++++++++
> 2 files changed, 35 insertions(+)
>
> diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
> index 253f6ba..db7b54f 100644
> --- a/policy/modules/roles/sysadm.te
> +++ b/policy/modules/roles/sysadm.te
> @@ -952,6 +952,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + setrans_admin(sysadm_t, sysadm_r)
> +')
> +
> +optional_policy(`
> setroubleshoot_admin(sysadm_t, sysadm_r)
> ')
>
> diff --git a/policy/modules/system/setrans.if b/policy/modules/system/setrans.if
> index efa9c27..2a8ecaa 100644
> --- a/policy/modules/system/setrans.if
> +++ b/policy/modules/system/setrans.if
> @@ -40,3 +40,34 @@ interface(`setrans_translate_context',`
> stream_connect_pattern($1, setrans_var_run_t, setrans_var_run_t, setrans_t)
> files_list_pids($1)
> ')
> +
> +######################################
> +## <summary>
> +## All of the rules required to
> +## administrate an setrans environment.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## Role allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`setrans_admin',`
> + gen_require(`
> + type setrans_t, setrans_initrc_exec_t;
> + type setrans_var_run_t;
> + ')
> +
> + allow $1 setrans_t:process { ptrace signal_perms };
> + ps_process_pattern($1, setrans_t)
> +
> + init_startstop_service($1, $2, setrans_t, setrans_initrc_exec_t)
> +
> + files_search_pids($1)
> + admin_pattern($1, setrans_var_run_t)
> +')
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* [refpolicy] [PATCH 4/4] add new cron_admin interface to sysadm
2015-07-11 9:15 ` [refpolicy] [PATCH 4/4] add new cron_admin interface to sysadm Jason Zaman
@ 2015-07-17 13:30 ` Christopher J. PeBenito
0 siblings, 0 replies; 8+ messages in thread
From: Christopher J. PeBenito @ 2015-07-17 13:30 UTC (permalink / raw)
To: refpolicy
On 7/11/2015 5:15 AM, Jason Zaman wrote:
> ---
> policy/modules/roles/sysadm.te | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
> index db7b54f..f61075d 100644
> --- a/policy/modules/roles/sysadm.te
> +++ b/policy/modules/roles/sysadm.te
> @@ -274,6 +274,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + cron_admin(sysadm_t, sysadm_r)
> +')
> +
> +optional_policy(`
> ctdb_admin(sysadm_t, sysadm_r)
> ')
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2015-07-17 13:30 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-07-11 9:15 [refpolicy] [PATCH 1/4] Introduce lvm_admin interface Jason Zaman
2015-07-11 9:15 ` [refpolicy] [PATCH 2/4] Introduce ipsec_admin interface Jason Zaman
2015-07-14 15:17 ` Christopher J. PeBenito
2015-07-11 9:15 ` [refpolicy] [PATCH 3/4] Introduce setrans_admin interface Jason Zaman
2015-07-14 15:18 ` Christopher J. PeBenito
2015-07-11 9:15 ` [refpolicy] [PATCH 4/4] add new cron_admin interface to sysadm Jason Zaman
2015-07-17 13:30 ` Christopher J. PeBenito
2015-07-14 15:17 ` [refpolicy] [PATCH 1/4] Introduce lvm_admin interface Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.