Use the tomcat selinux domain for the Java processes

2 files changed, 97 insertions, 321 deletions

diff --git a/base/selinux/src/pki.if b/base/selinux/src/pki.if
index 4272bd0c5..5264271eb 100644
--- a/base/selinux/src/pki.if
+++ b/base/selinux/src/pki.if
@@ -3,295 +3,6 @@
 
 ########################################
 ## <summary>
-##	Create a set of derived types for apache
-##	web content.
-## </summary>
-## <param name="prefix">
-##	<summary>
-##	The prefix to be used for deriving type names.
-##	</summary>
-## </param>
-#
-template(`pki_tomcat_template',`
-	gen_require(`
-		attribute pki_tomcat_process;
-		attribute pki_tomcat_config, pki_tomcat_var_lib, pki_tomcat_var_run;
-		attribute pki_tomcat_executable, pki_tomcat_script, pki_tomcat_var_log;
-		type pki_tomcat_tomcat_exec_t;
-                type tomcat_exec_t;
-                type rpm_var_lib_t;
-                type rpm_exec_t;
-		type setfiles_t;
-                type load_policy_t;
-                type mxi_port_t;
-                type http_cache_port_t;
-                type http_port_t;
-                type dns_port_t;
-	')
-	########################################
-	#
-	# Declarations
-	#
-
-        type $1_t, pki_tomcat_process;
-        type $1_exec_t, pki_tomcat_executable;
-        domain_type($1_t)
-        init_daemon_domain($1_t, $1_exec_t)
-
-        type $1_script_t;
-        domain_type($1_script_t)
-        gen_require(`
-                type java_exec_t;
-                type initrc_t;
-        ')
-        domtrans_pattern($1_script_t, java_exec_t, $1_t)
-
-        role system_r types $1_script_t;
-        allow $1_t java_exec_t:file entrypoint;
-        allow initrc_t $1_script_t:process transition;
-
-	type $1_etc_rw_t, pki_tomcat_config;
-	files_type($1_etc_rw_t)
-
-	type $1_var_run_t, pki_tomcat_var_run;
-	files_pid_file($1_var_run_t)
-
-	type $1_var_lib_t, pki_tomcat_var_lib;
-	files_type($1_var_lib_t)
-
-	type $1_log_t, pki_tomcat_var_log;
-	logging_log_file($1_log_t)
-
-	########################################
-	#
-	# $1 local policy
-	#
-
-	# Execstack/execmem caused by java app.
-	allow $1_t self:process { execstack execmem getsched setsched signal};
-	allow initrc_t self:process execstack;
-
-	## internal communication is often done using fifo and unix sockets.
-	allow $1_t self:fifo_file rw_file_perms;
-	allow $1_t self:unix_stream_socket create_stream_socket_perms;
-	allow $1_t self:tcp_socket create_stream_socket_perms;
-	allow $1_t self:process signull;
-
-        ## ports (these will be in the tomcat domain)
-        allow $1_t mxi_port_t : tcp_socket { name_bind name_connect };
-        allow $1_t http_cache_port_t : tcp_socket name_bind;
-        allow $1_t http_port_t : tcp_socket { name_bind name_connect };
-        allow $1_t dns_port_t : tcp_socket { recv_msg send_msg name_connect };
-
-        # use rpm to look at velocity version in dtomcat-foo
-        allow $1_t rpm_exec_t:file exec_file_perms;
-
-	corenet_all_recvfrom_unlabeled($1_t)
-	corenet_tcp_sendrecv_all_if($1_t)
-	corenet_tcp_sendrecv_all_nodes($1_t)
-	corenet_tcp_sendrecv_all_ports($1_t)
-
-	corenet_tcp_bind_all_nodes($1_t)
-	corenet_tcp_bind_ocsp_port($1_t)
-	corenet_tcp_connect_ocsp_port($1_t)
-        corenet_tcp_connect_generic_port($1_t)
-
-        # for file signing
-        corenet_tcp_connect_http_port($1_t)
-
-	# This is for /etc/$1/tomcat.conf:
-	can_exec($1_t, $1_tomcat_exec_t)
-        allow $1_t $1_tomcat_exec_t:file {getattr read};
-
-        #installation requires this for access to /var/lib/tomcat5/common/lib/jdtcore.jar 
-        rpm_read_db($1_t)
-
-	# Init script handling
-	domain_use_interactive_fds($1_t)
-
-	files_read_etc_files($1_t)
-
-	manage_dirs_pattern($1_t, $1_etc_rw_t, $1_etc_rw_t)
-	manage_files_pattern($1_t, $1_etc_rw_t, $1_etc_rw_t)
-	files_etc_filetrans($1_t,$1_etc_rw_t, { file dir })
-
-	# start/stop using pki-cad, pki-krad, pki-ocspd, or pki-tksd
-	allow setfiles_t $1_etc_rw_t:file read;
-
-	manage_dirs_pattern($1_t, $1_var_run_t,  $1_var_run_t)
-	manage_files_pattern($1_t, $1_var_run_t,  $1_var_run_t)
-	files_pid_filetrans($1_t,$1_var_run_t, { file dir })
-
-	manage_dirs_pattern($1_t, $1_var_lib_t,  $1_var_lib_t)
-	manage_files_pattern($1_t, $1_var_lib_t,  $1_var_lib_t)
-	read_lnk_files_pattern($1_t, $1_var_lib_t, $1_var_lib_t)
-	files_var_lib_filetrans($1_t, $1_var_lib_t, { file dir } )
-        allow $1_t rpm_var_lib_t:lnk_file { read getattr };
-
-	manage_dirs_pattern($1_t, $1_log_t,  $1_log_t)
-	manage_files_pattern($1_t, $1_log_t,  $1_log_t)
-	logging_log_filetrans($1_t, $1_log_t, { file dir } )
-
-	corecmd_exec_bin($1_t)
-	corecmd_read_bin_symlinks($1_t)
-	corecmd_exec_shell($1_t)
-        corecmd_search_bin($1_t)
-
-	dev_list_sysfs($1_t)
-        dev_read_sysfs($1_t)
-	dev_read_rand($1_t)
-	dev_read_urand($1_t)
-
-	# Java is looking in /tmp for some reason...:
-	files_manage_generic_tmp_dirs($1_t)
-	files_manage_generic_tmp_files($1_t)
-	files_read_usr_files($1_t)
-	files_read_usr_symlinks($1_t)
-	# These are used to read tomcat class files in /var/lib/tomcat
-	files_read_var_lib_files($1_t)
-	files_read_var_lib_symlinks($1_t)
-        
-        #needed in tps key archival in kra
-        files_list_var($1_t)
-
-	kernel_read_network_state($1_t)
-	kernel_read_system_state($1_t)
-	kernel_search_network_state($1_t)
-        kernel_signull_unlabeled($1_t)
-
-	auth_use_nsswitch($1_t)
-
-	init_dontaudit_write_utmp($1_t)
-
-	libs_use_ld_so($1_t)
-	libs_use_shared_libs($1_t)
-
-	miscfiles_read_localization($1_t)
-        miscfiles_read_hwdata($1_t)
-        miscfiles_manage_generic_cert_dirs($1_t)
-        miscfiles_manage_generic_cert_files($1_t)
-
-	logging_send_syslog_msg($1_t)
-
-	ifdef(`targeted_policy',`
-		term_dontaudit_use_unallocated_ttys($1_t)
-		term_dontaudit_use_generic_ptys($1_t)
-	')
-
-        # allow java subsystems to talk to the ncipher hsm
-        allow $1_t pki_common_dev_t:sock_file write;
-        allow $1_t pki_common_dev_t:dir search;
-        allow $1_t pki_common_t:dir create_dir_perms;
-        manage_files_pattern($1_t, pki_common_t, pki_common_t)
-        can_exec($1_t, pki_common_t)
-        init_stream_connect_script($1_t)
-
-        #allow java subsystems to talk to lunasa hsm
-
-        #allow sending mail
-        corenet_tcp_connect_smtp_port($1_t)
-
-        # allow rpm -q in init scripts
-        rpm_exec($1_t)
-        
-        # allow writing to the kernel keyring
-        allow $1_t self:key { write read };
-
-        #reverse proxy
-        corenet_tcp_connect_dogtag_port($1_t)
-
-        #connect to ldap
-        corenet_tcp_connect_ldap_port($1_t)
-
-        # tomcat connects to ephemeral ports on shutdown
-        corenet_tcp_connect_all_unreserved_ports($1_t)
-
-        # new tomcat perms for dogtag 10
-        allow $1_t pki_tomcat_var_run_t:lnk_file read;
-        can_exec($1_t, tomcat_exec_t)
-        consoletype_exec($1_t)
-        fs_getattr_xattr_fs($1_t)
-        fs_read_hugetlbfs_files($1_t)
-        hostname_exec($1_t)
-        allow $1_t self:capability { setuid chown setgid fowner audit_write dac_override };
-        allow $1_t self:netlink_audit_socket { nlmsg_relay create write read};
-        kernel_read_kernel_sysctls($1_t)
-        selinux_get_enforce_mode($1_t)
-        dirsrv_manage_var_lib($1_t)
-        tomcat_search_cache($1_t)
-
-        # write to /var/log/pki for spawn and destroy
-        allow $1_t pki_log_t:dir {getattr search};
-        allow load_policy_t pki_log_t:file write;
-        allow setfiles_t pki_log_t:file write;
-
-        optional_policy(`
-            #This is broken in selinux-policy we need java_exec defined, Will add to policy
-            gen_require(`
-                type java_exec_t;
-            ')
-            can_exec($1_t, java_exec_t)
-        ')
-
-        optional_policy(`
-            unconfined_domain($1_script_t)
-        ')
-')
-
-########################################
-## <summary>
-##	All of the rules required to administrate 
-##	an pki_tomcat environment
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <param name="role">
-##	<summary>
-##	The role to be allowed to manage the syslog domain.
-##	</summary>
-## </param>
-## <param name="terminal">
-##	<summary>
-##	The type of the user terminal.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`pki_tomcat_admin',`
-	gen_require(`
-		type pki_tomcat_tomcat_exec_t;
-		attribute pki_tomcat_process;
-		attribute pki_tomcat_config;
-		attribute pki_tomcat_executable;
-		attribute pki_tomcat_var_lib;
-		attribute pki_tomcat_var_log;
-		attribute pki_tomcat_var_run;
-		attribute pki_tomcat_pidfiles;
-		attribute pki_tomcat_script;
-	')
-
-	allow $1 pki_tomcat_process:process { ptrace signal_perms };
-	ps_process_pattern($1, pki_tomcat_t)
-
-	# Allow pki_tomcat_t to restart the service
-	pki_tomcat_script_domtrans($1)
-	domain_system_change_exemption($1)
-	role_transition $2 pki_tomcat_script system_r;
-	allow $2 system_r;
-
-	manage_all_pattern($1, pki_tomcat_config)
-	manage_all_pattern($1, pki_tomcat_var_run)
-	manage_all_pattern($1, pki_tomcat_var_lib)
-	manage_all_pattern($1, pki_tomcat_var_log)
-	manage_all_pattern($1, pki_tomcat_config)
-	manage_all_pattern($1, pki_tomcat_tomcat_exec_t)
-')
-
-########################################
-## <summary>
 ##	Execute pki_ra server in the pki_ra domain.
 ## </summary>
 ## <param name="domain">
diff --git a/base/selinux/src/pki.te b/base/selinux/src/pki.te
index cce797d7e..a13344338 100644
--- a/base/selinux/src/pki.te
+++ b/base/selinux/src/pki.te
@@ -1,13 +1,4 @@
-policy_module(pki,10.0.6)
-
-attribute pki_tomcat_config;
-attribute pki_tomcat_executable;
-attribute pki_tomcat_var_lib;
-attribute pki_tomcat_var_log;
-attribute pki_tomcat_var_run;
-attribute pki_tomcat_pidfiles;
-attribute pki_tomcat_script;
-attribute pki_tomcat_process;
+policy_module(pki,10.0.10)
 
 type pki_log_t;
 files_type(pki_log_t)
@@ -18,10 +9,75 @@ files_type(pki_common_t)
 type pki_common_dev_t;
 files_type(pki_common_dev_t)
 
-type pki_tomcat_tomcat_exec_t;
-files_type(pki_tomcat_tomcat_exec_t)
+type pki_tomcat_etc_rw_t;
+files_type(pki_tomcat_etc_rw_t)
+
+tomcat_domain_template(pki_tomcat)
+
+permissive pki_tomcat_t;
+
+type pki_tomcat_lock_t;
+files_lock_file(pki_tomcat_lock_t)
+
+require {
+        type pki_tomcat_var_lib_t;
+        type pki_tomcat_t;
+        type pki_tomcat_var_run_t;
+        type pki_tomcat_log_t;
+        type systemd_unit_file_t;
+}
+
+allow pki_tomcat_t self:capability { setuid chown setgid fowner audit_write dac_override sys_nice};
+allow pki_tomcat_t self:netlink_audit_socket { nlmsg_relay create };
+
+allow pki_tomcat_t self:key write;
+allow pki_tomcat_t self:process { signal setsched signull execmem };
+allow pki_tomcat_t self:tcp_socket { accept listen };
+allow pki_tomcat_t self:unix_dgram_socket { create connect };
+allow pki_tomcat_t self:process signal;
+
+# allow writing to the kernel keyring
+allow pki_tomcat_t self:key { write read };
+
+manage_dirs_pattern(pki_tomcat_t, pki_tomcat_etc_rw_t, pki_tomcat_etc_rw_t)
+manage_files_pattern(pki_tomcat_t, pki_tomcat_etc_rw_t, pki_tomcat_etc_rw_t)
+
+manage_dirs_pattern(pki_tomcat_t,  pki_tomcat_lock_t,  pki_tomcat_lock_t)
+manage_files_pattern(pki_tomcat_t,  pki_tomcat_lock_t,  pki_tomcat_lock_t)
+manage_lnk_files_pattern(pki_tomcat_t,  pki_tomcat_lock_t,  pki_tomcat_lock_t)
+files_lock_filetrans(pki_tomcat_t,  pki_tomcat_lock_t, { dir file lnk_file })
+
+# allow java subsystems to talk to the ncipher hsm
+allow pki_tomcat_t pki_common_dev_t:sock_file write;
+allow pki_tomcat_t pki_common_dev_t:dir search;
+allow pki_tomcat_t pki_common_t:dir create_dir_perms;
+manage_files_pattern(pki_tomcat_t, pki_common_t, pki_common_t)
+can_exec(pki_tomcat_t, pki_common_t)
+init_stream_connect_script(pki_tomcat_t)
+
+# init script checks and fixes links if needed
+allow pki_tomcat_t pki_tomcat_var_lib_t:lnk_file { read getattr setattr };
+allow pki_tomcat_t pki_tomcat_var_run_t:lnk_file { create getattr setattr };
+allow pki_tomcat_t self:capability sys_nice;
+allow pki_tomcat_t systemd_unit_file_t:lnk_file { read getattr setattr };
+allow pki_tomcat_t systemd_unit_file_t:dir getattr;
+allow pki_tomcat_t systemd_unit_file_t:file getattr;
 
-pki_tomcat_template(pki_tomcat)
+allow pki_tomcat_t pki_log_t:dir getattr;
+allow pki_tomcat_t pki_log_t:dir search;
+
+kernel_read_kernel_sysctls(pki_tomcat_t)
+
+corenet_tcp_connect_http_cache_port(pki_tomcat_t)
+corenet_tcp_connect_ldap_port(pki_tomcat_t)
+corenet_tcp_connect_smtp_port(pki_tomcat_t)
+
+selinux_get_enforce_mode(pki_tomcat_t)
+
+logging_send_audit_msgs(pki_tomcat_t)
+logging_send_syslog_msg(pki_tomcat_t)
+
+miscfiles_read_hwdata(pki_tomcat_t)
 
 # forward proxy
 # need to define ports to fix this
@@ -32,6 +88,13 @@ allow pki_tomcat_t pki_tomcat_var_lib_t:lnk_file { rename create unlink };
 
 # for ECC
 auth_getattr_shadow(pki_tomcat_t)
+optional_policy(`
+        consoletype_exec(pki_tomcat_t)
+')
+
+optional_policy(`
+        hostname_exec(pki_tomcat_t)
+')
 
 # old type aliases for migration
 typealias pki_tomcat_t alias { pki_ca_t pki_kra_t pki_ocsp_t pki_tks_t };
@@ -40,22 +103,10 @@ typealias pki_tomcat_var_lib_t alias { pki_ca_var_lib_t pki_kra_var_lib_t pki_oc
 typealias pki_tomcat_var_run_t alias { pki_ca_var_run_t pki_kra_var_run_t pki_ocsp_var_run_t pki_tks_var_run_t };
 typealias pki_tomcat_log_t alias { pki_ca_log_t pki_kra_log_t pki_ocsp_log_t pki_tks_log_t };
 # typealias http_port_t alias { pki_ca_port_t pki_kra_port_t pki_ocsp_port_t pki_tks_port_t };
-attribute pki_ra_config;
-attribute pki_ra_executable;
-attribute pki_ra_var_lib;
-attribute pki_ra_var_log;
-attribute pki_ra_var_run;
-attribute pki_ra_pidfiles;
-attribute pki_ra_script;
-attribute pki_ra_process;
-
-type pki_ra_tomcat_exec_t;
-files_type(pki_ra_tomcat_exec_t)
-
-pki_ra_template(pki_ra)
 
-# needed for token enrollment, list /var/cache/tomcat5/temp
-files_list_var(pki_tomcat_t)
+##########################
+#  TPS policy
+##########################
 
 attribute pki_tps_config;
 attribute pki_tps_executable;
@@ -81,6 +132,7 @@ can_exec(pki_tps_t, httpd_suexec_exec_t)
 apache_exec_modules(pki_tps_t)
 apache_list_modules(pki_tps_t)
 apache_read_config(pki_tps_t)
+apache_exec(pki_tps_t)
 
 allow pki_tps_t lib_t:file execute_no_trans;
 
@@ -166,9 +218,23 @@ rpm_exec(pki_tps_t)
 # allow writing to the kernel keyring
 allow pki_tps_t self:key { write read };
 
-# new for f14
-apache_exec(pki_tps_t)
+##########################
+# RA policy
+#########################
+
+attribute pki_ra_config;
+attribute pki_ra_executable;
+attribute pki_ra_var_lib;
+attribute pki_ra_var_log;
+attribute pki_ra_var_run;
+attribute pki_ra_pidfiles;
+attribute pki_ra_script;
+attribute pki_ra_process;
 
+type pki_ra_tomcat_exec_t;
+files_type(pki_ra_tomcat_exec_t)
+
+pki_ra_template(pki_ra)
  # start up httpd in pki_ra_t mode
 allow pki_ra_t httpd_config_t:file { read getattr execute };
 allow pki_ra_t httpd_exec_t:file entrypoint;
@@ -179,6 +245,7 @@ allow pki_ra_t httpd_suexec_exec_t:file { getattr read execute };
 apache_read_config(pki_ra_t)
 apache_exec_modules(pki_ra_t)
 apache_list_modules(pki_ra_t)
+apache_exec(pki_ra_t)
 
 allow pki_ra_t lib_t:file execute_no_trans;
 
@@ -263,5 +330,3 @@ rpm_exec(pki_ra_t)
 # allow writing to the kernel keyring
 allow pki_ra_t self:key { write read };
 
-# new for f14
-apache_exec(pki_ra_t)