Miscellany
public text v1 · immutable[root@olmrs31 SOURCES]# cat serefpolicy-2.4.6/policy/modules/apps/jboss.fc
/var/run/jboss\.pid --
gen_context(system_u:object_r:jboss_var_run_t, s0)
/opt/jboss-4.2.2.GA/bin(/.*)?
gen_context(system_u:object_r:jboss_exec_t, s0)
/var/log/jboss(/.*)?
gen_context(system_u:object_r:jboss_log_t, s0)
/opt/jboss-4.2.2.GA(/.*)?
gen_context(system_u:object_r:jboss_opt_t, s0)
[root@olmrs31 SOURCES]#
[root@olmrs31 SOURCES]# cat serefpolicy-2.4.6/policy/modules/apps/jboss.if
## <summary>policy for jboss</summary>
########################################
## <summary>
## Execute a domain transition to run jboss.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`jboss_domtrans',`
gen_require(`
type jboss_t, jboss_exec_t;
')
domain_auto_trans($1,jboss_exec_t,jboss_t)
allow jboss_t $1:fd use;
allow jboss_t $1:fifo_file rw_file_perms;
allow jboss_t $1:process sigchld;
')
########################################
## <summary>
## Do not audit attempts to read,
## jboss tmp files
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`jboss_dontaudit_read_tmp_files',`
gen_require(`
type jboss_tmp_t;
')
dontaudit $1 jboss_tmp_t:file r_file_perms;
')
########################################
## <summary>
## Allow domain to read, jboss tmp files
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`jboss_read_tmp_files',`
gen_require(`
type jboss_tmp_t;
')
dontaudit $1 jboss_tmp_t:file r_file_perms;
')
########################################
## <summary>
## Search jboss rw directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`jboss_search_rw_dir',`
gen_require(`
type jboss_rw_t;
')
allow $1 jboss_rw_t:dir search_dir_perms;
files_search_rw($1)
')
########################################
## <summary>
## Read jboss rw files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`jboss_read_rw_files',`
gen_require(`
type jboss_rw_t;
')
allow $1 jboss_rw_t:file r_file_perms;
allow $1 jboss_rw_t:dir list_dir_perms;
files_search_rw($1)
')
########################################
## <summary>
## Create, read, write, and delete
## jboss rw files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`jboss_manage_rw_files',`
gen_require(`
type jboss_rw_t;
')
allow $1 jboss_rw_t:file manage_file_perms;
allow $1 jboss_rw_t:dir rw_dir_perms;
')
########################################
## <summary>
## Allow the specified domain to write jboss log files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <rolecap/>
#
interface(`jboss_write_log',`
gen_require(`
type jboss_log_t;
')
')
logging_search_logs($1)
allow $1 jboss_log_t:dir list_dir_perms;
#allow java_t jboss_log_t:file { write getattr };
allow $1 jboss_log_t:file rw_dir_perms;
allow $1 jboss_log_t:file read_file_perms;
write_files_pattern($1,jboss_log_t,jboss_log_t);
#allow java_t jboss_log_t:dir { getattr search };
allow $1 jboss_log_t:dir search_dir_perms;
allow $1 jboss_log_t:dir getattr_dir_perms;
# allow $1 jboss_log_t:file write_file_perms
')
[root@olmrs31 SOURCES]#
[root@olmrs31 SOURCES]# cat serefpolicy-2.4.6/policy/modules/apps/jboss.te
policy_module(jboss,1.1.0)
########################################
#
# Declarations
#
type jboss_t;
type jboss_exec_t;
domain_type(jboss_t)
init_daemon_domain(jboss_t, jboss_exec_t)
require {
type sysadm_javaplugin_t;
class lnk_file read;
class file write;
}
type jboss_log_t;
logging_log_file(jboss_log_t)
type jboss_tmp_t;
files_tmp_file(jboss_tmp_t)
type jboss_opt_t;
type jboss_var_run_t;
type jboss_rw_t;
files_type(jboss_rw_t)
########################################
#
# jboss local policy
#
# Init script handling
domain_use_interactive_fds(jboss_t)
## internal communication is often done using fifo and unix sockets.
allow jboss_t self:fifo_file rw_file_perms;
allow jboss_t self:unix_stream_socket create_stream_socket_perms;
#allow jboss_t jboss_tmp_t:file manage_file_perms;
#allow jboss_t jboss_tmp_t:dir create_dir_perms;
#files_pid_filetrans(jboss_t,jboss_tmp_t, { file dir })
allow jboss_t jboss_rw_t:file manage_file_perms;
allow jboss_t jboss_rw_t:dir create_dir_perms;
files_pid_filetrans(jboss_t,jboss_rw_t, { file dir })
sysnet_dns_name_resolve(jboss_t)
corenet_non_ipsec_sendrecv(jboss_t)
allow jboss_t self:tcp_socket create_stream_socket_perms;
corenet_tcp_sendrecv_all_if(jboss_t)
corenet_tcp_sendrecv_all_nodes(jboss_t)
corenet_tcp_sendrecv_all_ports(jboss_t)
corenet_tcp_bind_all_nodes(jboss_t)
corenet_tcp_bind_http_cache_port(jboss_t)
#============= sysadm_javaplugin_t ==============
allow sysadm_javaplugin_t jboss_log_t:file write;
[root@olmrs31 SOURCES]#
[root@olmrs31 SOURCES]# cat serefpolicy-2.4.6/policy/modules/apps/java.te
policy_module(java,1.2.1)
########################################
#
# Declarations
#
type java_t;
type java_exec_t;
init_system_domain(java_t,java_exec_t)
#Java needs access to jboss_log_t
jboss_write_log(java_t);
#Java needs access to libs
libs_read_lib_files(java_t)
########################################
#
# Local policy
#
ifdef(`targeted_policy',`
# execheap is needed for itanium/BEA jrocket
allow java_t self:process { execstack execmem execheap };
unconfined_domain_noaudit(java_t)
role system_r types java_t;
unconfined_dbus_chat(java_t)
init_dbus_chat_script(java_t)
')
[root@olmrs31 SOURCES]#