rendered paste body--- prelude.orig/prelude.fc +++ prelude/prelude.fc @@ -10,5 +10,11 @@ /var/run/prelude-manager(/.*)? gen_context(system_u:object_r:prelude_var_run_t,s0) /var/spool/prelude-manager(/.*)? gen_context(system_u:object_r:prelude_spool_t,s0) /var/spool/prelude(/.*)? gen_context(system_u:object_r:prelude_spool_t,s0)-/usr/share/prewikka/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_prewikka_script_exec_t,s0) +/etc/prewikka/prewikka.conf -- gen_context(system_u:object_r:prewikka_etc_t,s0)+/usr/share/prewikka/cgi-bin/prewikka.cgi -- gen_context(system_u:object_r:prewikka_exec_t,s0)++/usr/bin/prelude-lml -- gen_context(system_u:object_r:prelude_lml_exec_t,s0)+/var/run/prelude-lml.pid -- gen_context(system_u:object_r:prelude_lml_var_run_t,s0)++--- prelude.orig/prelude.te +++ prelude/prelude.te @@ -145,17 +145,170 @@ # optional_policy(`- apache_content_template(prewikka)- files_read_etc_files(httpd_prewikka_script_t)-- optional_policy(`- mysql_search_db(httpd_prewikka_script_t)- mysql_stream_connect(httpd_prewikka_script_t)- ')-- optional_policy(`- postgresql_stream_connect(httpd_prewikka_script_t)+ type prewikka_t;+ type prewikka_exec_t;+ apache_cgi_domain(prewikka_t, prewikka_exec_t)+ role system_r types prewikka_t;++ type prewikka_etc_t;+ files_config_file(prewikka_etc_t)++ ########################################+ #+ # prewikka_cgi private policy+ #+ allow prewikka_t self:unix_stream_socket { write setopt shutdown read create connect };++ # Fix me+ allow prewikka_t self:fifo_file rw_fifo_file_perms;+ allow prewikka_t self:dir search;+ allow prewikka_t self:file { getattr read };++ allow prewikka_t prewikka_etc_t:file read_file_perms;+ allow prewikka_t prewikka_exec_t:file { read_file_perms entrypoint };++ corecmd_search_bin(prewikka_t)++ dev_read_urand(prewikka_t)++ files_list_root(prewikka_t)+ files_read_etc_files(prewikka_t)+ files_read_usr_files(prewikka_t)++ files_search_etc(prewikka_t)+ files_search_pids(prewikka_t)+ files_search_usr(prewikka_t)+ files_search_var(prewikka_t)+ files_search_var_lib(prewikka_t)++ kernel_read_system_state(prewikka_t)++ libs_exec_lib_files(prewikka_t)+ libs_read_lib_files(prewikka_t)++ libs_use_ld_so(prewikka_t)+ libs_use_shared_libs(prewikka_t)++ miscfiles_read_localization(prewikka_t)++ fs_getattr_xattr_fs(prewikka_t)++ optional_policy(`+ selinux_dontaudit_getattr_fs(prewikka_t)+ selinux_dontaudit_read_fs(prewikka_t)+ ')++ optional_policy(`+ seutil_dontaudit_read_config(prewikka_t)+ ')++ optional_policy(`+ nscd_read_pid(prewikka_t)+ ')++ optional_policy(`+ tunable_policy(`httpd_enable_cgi && allow_ypbind',`+ nis_use_ypbind_uncond(prewikka_t)+ ')+ ')++ optional_policy(`+ mysql_search_db(prewikka_t)+ mysql_stream_connect(prewikka_t)+ ')++ optional_policy(`+ postgresql_stream_connect(prewikka_t) ') ') -+########################################+#+# prelude_lml private declarations+#+optional_policy(`+ type prelude_lml_t;+ type prelude_lml_exec_t;+ domain_type(prelude_lml_t)+ init_daemon_domain(prelude_lml_t, prelude_lml_exec_t)++ type prelude_lml_var_run_t;+ files_pid_file(prelude_lml_var_run_t)++ type prelude_lml_tmp_t;+ files_tmp_file(prelude_lml_tmp_t)++ ########################################+ #+ # prelude_lml private policy + #++ allow prelude_lml_t self:netlink_route_socket { write getattr read bind create nlmsg_read };+ allow prelude_lml_t self:tcp_socket { write getattr setopt read create connect };+ allow prelude_lml_t self:unix_dgram_socket { write create connect };+ allow prelude_lml_t self:fifo_file rw_fifo_file_perms;+ allow prelude_lml_t self:unix_stream_socket connectto;++ manage_dirs_pattern(prelude_lml_t,prelude_lml_tmp_t,prelude_lml_tmp_t)+ manage_files_pattern(prelude_lml_t,prelude_lml_tmp_t,prelude_lml_tmp_t)+ files_tmp_filetrans(prelude_lml_t, prelude_lml_tmp_t, { file dir })+ files_list_tmp(prelude_lml_t)++ files_search_spool(prelude_lml_t)+ manage_dirs_pattern(prelude_lml_t,prelude_spool_t,prelude_spool_t)+ manage_files_pattern(prelude_lml_t,prelude_spool_t,prelude_spool_t)++ files_search_var_lib(prelude_lml_t)+ manage_dirs_pattern(prelude_lml_t,prelude_var_lib_t,prelude_var_lib_t)+ manage_files_pattern(prelude_lml_t,prelude_var_lib_t,prelude_var_lib_t)++ manage_files_pattern(prelude_lml_t, prelude_lml_var_run_t, prelude_lml_var_run_t)+ files_pid_filetrans(prelude_lml_t, prelude_lml_var_run_t, file)++ libs_use_ld_so(prelude_lml_t)+ libs_use_shared_libs(prelude_lml_t)++ logging_send_syslog_msg(prelude_lml_t)++ miscfiles_read_localization(prelude_lml_t)++ corecmd_search_bin(prelude_lml_t)++ corenet_tcp_sendrecv_generic_if(prelude_lml_t)+ corenet_tcp_sendrecv_all_nodes(prelude_lml_t)++ corenet_tcp_recvfrom_netlabel(prelude_lml_t)+ corenet_tcp_recvfrom_unlabeled(prelude_lml_t)+ corenet_sendrecv_unlabeled_packets(prelude_lml_t)++ corenet_tcp_connect_prelude_port(prelude_lml_t)++ dev_read_rand(prelude_lml_t)+ dev_read_urand(prelude_lml_t)++ files_list_etc(prelude_lml_t)+ files_read_etc_files(prelude_lml_t)+ files_read_etc_runtime_files(prelude_lml_t)++ files_search_spool(prelude_lml_t)+ files_search_usr(prelude_lml_t)+ files_search_var_lib(prelude_lml_t)++ fs_list_inotifyfs(prelude_lml_t)++ libs_exec_lib_files(prelude_lml_t)+ libs_read_lib_files(prelude_lml_t)++ logging_read_generic_logs(prelude_lml_t)+ logging_search_logs(prelude_lml_t)++ optional_policy(`+ apache_read_log(prelude_lml_t)+ ')++ optional_policy(`+ gamin_stream_connect(prelude_lml_t)+ gamin_domtrans(prelude_lml_t)+ ')+')+