1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
policy_module(rhgb, 1.7.1)
########################################
#
# Declarations
#
type rhgb_t;
type rhgb_exec_t;
init_daemon_domain(rhgb_t, rhgb_exec_t)
type rhgb_tmpfs_t;
files_tmpfs_file(rhgb_tmpfs_t)
type rhgb_devpts_t;
term_pty(rhgb_devpts_t)
########################################
#
# Local policy
#
allow rhgb_t self:capability { fsetid setgid setuid sys_admin sys_tty_config };
dontaudit rhgb_t self:capability sys_tty_config;
allow rhgb_t self:process { setpgid signal_perms };
allow rhgb_t self:shm create_shm_perms;
allow rhgb_t self:unix_stream_socket create_stream_socket_perms;
allow rhgb_t self:fifo_file rw_fifo_file_perms;
allow rhgb_t self:tcp_socket create_socket_perms;
allow rhgb_t self:udp_socket create_socket_perms;
allow rhgb_t self:netlink_route_socket r_netlink_socket_perms;
allow rhgb_t rhgb_devpts_t:chr_file { rw_chr_file_perms setattr };
term_create_pty(rhgb_t,rhgb_devpts_t)
manage_dirs_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
manage_files_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
manage_lnk_files_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
manage_fifo_files_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
manage_sock_files_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
fs_tmpfs_filetrans(rhgb_t, rhgb_tmpfs_t, { dir file lnk_file sock_file fifo_file })
kernel_read_kernel_sysctls(rhgb_t)
kernel_read_system_state(rhgb_t)
corecmd_exec_bin(rhgb_t)
corecmd_exec_shell(rhgb_t)
corenet_all_recvfrom_unlabeled(rhgb_t)
corenet_all_recvfrom_netlabel(rhgb_t)
corenet_tcp_sendrecv_generic_if(rhgb_t)
corenet_udp_sendrecv_generic_if(rhgb_t)
corenet_tcp_sendrecv_all_nodes(rhgb_t)
corenet_udp_sendrecv_all_nodes(rhgb_t)
corenet_tcp_sendrecv_all_ports(rhgb_t)
corenet_udp_sendrecv_all_ports(rhgb_t)
corenet_tcp_connect_all_ports(rhgb_t)
corenet_sendrecv_all_client_packets(rhgb_t)
dev_read_sysfs(rhgb_t)
dev_read_urand(rhgb_t)
domain_use_interactive_fds(rhgb_t)
files_read_etc_files(rhgb_t)
files_read_var_files(rhgb_t)
files_read_etc_runtime_files(rhgb_t)
files_search_tmp(rhgb_t)
files_read_usr_files(rhgb_t)
files_mounton_mnt(rhgb_t)
files_dontaudit_rw_root_dir(rhgb_t)
files_dontaudit_read_default_files(rhgb_t)
files_dontaudit_search_pids(rhgb_t)
# for nscd
files_dontaudit_search_var(rhgb_t)
fs_search_auto_mountpoints(rhgb_t)
fs_mount_ramfs(rhgb_t)
fs_unmount_ramfs(rhgb_t)
fs_getattr_tmpfs(rhgb_t)
# for ramfs file systems
fs_manage_ramfs_dirs(rhgb_t)
fs_manage_ramfs_files(rhgb_t)
fs_manage_ramfs_pipes(rhgb_t)
fs_manage_ramfs_sockets(rhgb_t)
selinux_dontaudit_read_fs(rhgb_t)
term_use_unallocated_ttys(rhgb_t)
term_use_ptmx(rhgb_t)
term_getattr_pty_fs(rhgb_t)
init_write_initctl(rhgb_t)
# for localization
libs_read_lib_files(rhgb_t)
logging_send_syslog_msg(rhgb_t)
miscfiles_read_localization(rhgb_t)
miscfiles_read_fonts(rhgb_t)
miscfiles_dontaudit_write_fonts(rhgb_t)
seutil_search_default_contexts(rhgb_t)
seutil_read_config(rhgb_t)
sysnet_read_config(rhgb_t)
sysnet_domtrans_ifconfig(rhgb_t)
userdom_dontaudit_use_unpriv_user_fds(rhgb_t)
userdom_dontaudit_search_user_home_content(rhgb_t)
xserver_read_tmp_files(rhgb_t)
xserver_kill(rhgb_t)
# for running setxkbmap
xserver_read_xkb_libs(rhgb_t)
xserver_domtrans(rhgb_t)
xserver_signal(rhgb_t)
xserver_read_xdm_tmp_files(rhgb_t)
xserver_stream_connect(rhgb_t)
optional_policy(`
consoletype_exec(rhgb_t)
')
optional_policy(`
nis_use_ypbind(rhgb_t)
')
optional_policy(`
seutil_sigchld_newrole(rhgb_t)
')
optional_policy(`
udev_read_db(rhgb_t)
')
ifdef(`TODO',`
#this seems a bit much
allow domain rhgb_devpts_t:chr_file { read write };
allow initrc_t rhgb_gph_t:fd use;
')
|
