Same as the last one but with the directory names for the auto trans rules
removed. I think it's ready for merging.
Signed-off-by: Russell Coker <[email protected]>
Index: refpolicy-2.20220309/policy/modules/services/apache.if
===================================================================
--- refpolicy-2.20220309.orig/policy/modules/services/apache.if
+++ refpolicy-2.20220309/policy/modules/services/apache.if
@@ -238,6 +238,24 @@ interface(`apache_domtrans',`
########################################
## <summary>
+## Execute httpd
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to execute it.
+## </summary>
+## </param>
+#
+interface(`apache_exec',`
+ gen_require(`
+ type httpd_t, httpd_exec_t;
+ ')
+
+ can_exec($1, httpd_exec_t)
+')
+
+########################################
+## <summary>
## Execute httpd server in the httpd domain.
## </summary>
## <param name="domain">
@@ -1430,3 +1448,21 @@ interface(`apache_admin',`
apache_run_all_scripts($1, $2)
apache_run_helper($1, $2)
')
+
+########################################
+## <summary>
+## rw httpd_runtime_t files
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`apache_rw_runtime_files',`
+ gen_require(`
+ type httpd_runtime_t;
+ ')
+
+ allow $1 httpd_runtime_t:file rw_file_perms;
+')
Index: refpolicy-2.20220309/policy/modules/services/certbot.te
===================================================================
--- refpolicy-2.20220309.orig/policy/modules/services/certbot.te
+++ refpolicy-2.20220309/policy/modules/services/certbot.te
@@ -43,7 +43,7 @@ allow certbot_t self:udp_socket all_udp_
allow certbot_t self:tcp_socket all_tcp_socket_perms;
allow certbot_t self:netlink_route_socket create_netlink_socket_perms;
-files_search_var_lib(certbot_t)
+files_var_lib_filetrans(certbot_t, certbot_lib_t, dir)
manage_dirs_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
manage_files_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
@@ -62,7 +62,7 @@ allow certbot_t certbot_tmp_t:file mmap_
allow certbot_t certbot_tmpfs_t:file mmap_exec_file_perms;
allow certbot_t certbot_runtime_t:file mmap_exec_file_perms;
-logging_search_logs(certbot_t)
+logging_log_filetrans(certbot_t, certbot_log_t, dir)
allow certbot_t certbot_log_t:dir manage_dir_perms;
allow certbot_t certbot_log_t:file manage_file_perms;
@@ -80,11 +80,15 @@ corenet_tcp_connect_dns_port(certbot_t)
# bind to http port for standalone mode
corenet_tcp_bind_http_port(certbot_t)
+dev_read_urand(certbot_t)
+
domain_use_interactive_fds(certbot_t)
files_read_etc_files(certbot_t)
files_read_usr_files(certbot_t)
+# dontaudit for attempts to write python cache files
+libs_dontaudit_write_lib_dirs(certbot_t)
libs_exec_ldconfig(certbot_t)
# for /usr/lib/gcc/x86_64-linux-gnu/8/collect2
libs_exec_lib_files(certbot_t)
@@ -110,5 +114,17 @@ optional_policy(`
# for writing to webroot
apache_manage_sys_content(certbot_t)
- apache_search_config(certbot_t)
+ apache_append_log(certbot_t)
+ apache_exec(certbot_t)
+ apache_exec_modules(certbot_t)
+
+ # for certbot to create nginx config
+ apache_manage_config(certbot_t)
+
+ apache_rw_runtime_files(certbot_t)
+ apache_signal(certbot_t)
+')
+
+optional_policy(`
+ xdg_search_config_dirs(certbot_t)
')
On 3/24/22 10:34, Russell Coker wrote:
> Same as the last one but with the directory names for the auto trans rules
> removed. I think it's ready for merging.
>
> Signed-off-by: Russell Coker <[email protected]>
>
> Index: refpolicy-2.20220309/policy/modules/services/apache.if
> ===================================================================
> --- refpolicy-2.20220309.orig/policy/modules/services/apache.if
> +++ refpolicy-2.20220309/policy/modules/services/apache.if
> @@ -238,6 +238,24 @@ interface(`apache_domtrans',`
>
> ########################################
> ## <summary>
> +## Execute httpd
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed to execute it.
> +## </summary>
> +## </param>
> +#
> +interface(`apache_exec',`
> + gen_require(`
> + type httpd_t, httpd_exec_t;
> + ')
> +
> + can_exec($1, httpd_exec_t)
> +')
> +
> +########################################
> +## <summary>
> ## Execute httpd server in the httpd domain.
> ## </summary>
> ## <param name="domain">
> @@ -1430,3 +1448,21 @@ interface(`apache_admin',`
> apache_run_all_scripts($1, $2)
> apache_run_helper($1, $2)
> ')
> +
> +########################################
> +## <summary>
> +## rw httpd_runtime_t files
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`apache_rw_runtime_files',`
> + gen_require(`
> + type httpd_runtime_t;
> + ')
> +
> + allow $1 httpd_runtime_t:file rw_file_perms;
> +')
> Index: refpolicy-2.20220309/policy/modules/services/certbot.te
> ===================================================================
> --- refpolicy-2.20220309.orig/policy/modules/services/certbot.te
> +++ refpolicy-2.20220309/policy/modules/services/certbot.te
> @@ -43,7 +43,7 @@ allow certbot_t self:udp_socket all_udp_
> allow certbot_t self:tcp_socket all_tcp_socket_perms;
> allow certbot_t self:netlink_route_socket create_netlink_socket_perms;
>
> -files_search_var_lib(certbot_t)
> +files_var_lib_filetrans(certbot_t, certbot_lib_t, dir)
> manage_dirs_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
> manage_files_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
>
> @@ -62,7 +62,7 @@ allow certbot_t certbot_tmp_t:file mmap_
> allow certbot_t certbot_tmpfs_t:file mmap_exec_file_perms;
> allow certbot_t certbot_runtime_t:file mmap_exec_file_perms;
>
> -logging_search_logs(certbot_t)
> +logging_log_filetrans(certbot_t, certbot_log_t, dir)
> allow certbot_t certbot_log_t:dir manage_dir_perms;
> allow certbot_t certbot_log_t:file manage_file_perms;
>
> @@ -80,11 +80,15 @@ corenet_tcp_connect_dns_port(certbot_t)
> # bind to http port for standalone mode
> corenet_tcp_bind_http_port(certbot_t)
>
> +dev_read_urand(certbot_t)
> +
> domain_use_interactive_fds(certbot_t)
>
> files_read_etc_files(certbot_t)
> files_read_usr_files(certbot_t)
>
> +# dontaudit for attempts to write python cache files
> +libs_dontaudit_write_lib_dirs(certbot_t)
> libs_exec_ldconfig(certbot_t)
> # for /usr/lib/gcc/x86_64-linux-gnu/8/collect2
> libs_exec_lib_files(certbot_t)
> @@ -110,5 +114,17 @@ optional_policy(`
> # for writing to webroot
> apache_manage_sys_content(certbot_t)
>
> - apache_search_config(certbot_t)
> + apache_append_log(certbot_t)
> + apache_exec(certbot_t)
> + apache_exec_modules(certbot_t)
> +
> + # for certbot to create nginx config
> + apache_manage_config(certbot_t)
> +
> + apache_rw_runtime_files(certbot_t)
> + apache_signal(certbot_t)
> +')
> +
> +optional_policy(`
> + xdg_search_config_dirs(certbot_t)
> ')
Merged.
--
Chris PeBenito