From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Mon, 15 Sep 2008 13:02:32 -0400
Subject: [refpolicy] Latest bind policy differences.
In-Reply-To: <48BE9EC7.8010000@redhat.com>
References: <20080902130444.GA30953@bobek.pm.i.cz>
	<1220451076.28287.30.camel@gorn>  <48BE9EC7.8010000@redhat.com>
Message-ID: <1221498152.24369.62.camel@gorn>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Wed, 2008-09-03 at 10:27 -0400, Daniel J Walsh wrote:
> named_t needs getcap
> 
> ndc_t needs to tcp bind all nodes.
> 
> Script and _admin handling.

Merged, except I need a patch for your admin_pattern() support macro.

> plain text document attachment (services_bind.patch)
> --- nsaserefpolicy/policy/modules/services/bind.fc	2008-09-03 10:17:00.000000000 -0400
> +++ serefpolicy-3.5.6/policy/modules/services/bind.fc	2008-09-03 08:33:21.000000000 -0400
> @@ -51,3 +49,5 @@
>  /var/named/chroot/var/log/named.*	--	gen_context(system_u:object_r:named_log_t,s0)
>  /var/named/dynamic(/.*)?		gen_context(system_u:object_r:named_cache_t,s0)
>  ')
> +
> +/etc/rc.d/init.d/named	--	gen_context(system_u:object_r:named_script_exec_t,s0)
> --- nsaserefpolicy/policy/modules/services/bind.if	2008-08-07 11:15:11.000000000 -0400
> +++ serefpolicy-3.5.6/policy/modules/services/bind.if	2008-09-03 10:22:49.000000000 -0400
> @@ -254,3 +254,87 @@
>  interface(`bind_udp_chat_named',`
>  	refpolicywarn(`$0($*) has been deprecated.')
>  ')
> +
> +########################################
> +## <summary>
> +##	Execute bind server in the bind domain.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	The type of the process performing this action.
> +##	</summary>
> +## </param>
> +#
> +#
> +interface(`bind_script_domtrans',`
> +	gen_require(`
> +		type bind_script_exec_t;
> +	')
> +
> +	init_script_domtrans_spec($1, bind_script_exec_t)
> +')
> +
> +########################################
> +## <summary>
> +##	All of the rules required to administrate 
> +##	an bind environment
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +## <param name="role">
> +##	<summary>
> +##	The role to be allowed to manage the bind domain.
> +##	</summary>
> +## </param>
> +## <param name="terminal">
> +##	<summary>
> +##	The type of the user terminal.
> +##	</summary>
> +## </param>
> +## <rolecap/>
> +#
> +interface(`bind_admin',`
> +	gen_require(`
> +		type named_t, named_tmp_t, named_log_t;
> +		type named_conf_t, named_var_lib_t, named_var_run_t;
> +		type named_cache_t, named_zone_t;
> +		type dnssec_t, ndc_t;
> +		type named_script_exec_t;
> +	')
> +
> +	allow $1 named_t:process { ptrace signal_perms };
> +	ps_process_pattern($1, named_t)
> +	        
> +	allow $1 ndc_t:process { ptrace signal_perms };
> +	ps_process_pattern($1, ndc_t)
> +	        
> +	bind_run_ndc($1, $2, $3)
> +
> +	# Allow named_t to restart the apache service
> +	bind_script_domtrans($1)
> +	domain_system_change_exemption($1)
> +	role_transition $2 named_script_exec_t system_r;
> +	allow $2 system_r;
> +
> +	files_list_tmp($1)
> +        admin_pattern($1, named_tmp_t)
> +
> +	logging_list_logs($1)
> +        admin_pattern($1, named_log_t)
> +
> +	files_list_etc($1)
> +	admin_pattern($1, named_conf_t)
> +
> +	admin_pattern($1, named_cache_t)
> +	admin_pattern($1, named_zone_t)
> +	admin_pattern($1, dnssec_t)
> +
> +	files_list_var_lib($1)
> +        admin_pattern($1, named_var_lib_t)
> +
> +	files_list_pids($1)
> +        admin_pattern($1, named_var_run_t)
> +')
> --- nsaserefpolicy/policy/modules/services/bind.te	2008-09-03 10:17:00.000000000 -0400
> +++ serefpolicy-3.5.6/policy/modules/services/bind.te	2008-09-03 08:33:21.000000000 -0400
> @@ -53,6 +53,9 @@
>  init_system_domain(ndc_t, ndc_exec_t)
>  role system_r types ndc_t;
>  
> +type named_script_exec_t;
> +init_script_file(named_script_exec_t)
> +
>  ########################################
>  #
>  # Named local policy
> @@ -60,7 +63,7 @@
>  
>  allow named_t self:capability { chown dac_override fowner setgid setuid sys_chroot sys_nice sys_resource };
>  dontaudit named_t self:capability sys_tty_config;
> -allow named_t self:process { setsched setcap setrlimit signal_perms };
> +allow named_t self:process { setsched getcap setcap setrlimit signal_perms };
>  allow named_t self:fifo_file rw_fifo_file_perms;
>  allow named_t self:unix_stream_socket create_stream_socket_perms;
>  allow named_t self:unix_dgram_socket create_socket_perms;
> @@ -223,6 +225,7 @@
>  corenet_tcp_sendrecv_all_nodes(ndc_t)
>  corenet_tcp_sendrecv_all_ports(ndc_t)
>  corenet_tcp_connect_rndc_port(ndc_t)
> +corenet_tcp_bind_all_nodes(ndc_t)
>  corenet_sendrecv_rndc_client_packets(ndc_t)
>  
>  domain_use_interactive_fds(ndc_t)
-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150