diff options
| -rw-r--r-- | base/selinux/CMakeLists.txt | 11 | ||||
| -rw-r--r-- | base/selinux/LICENSE | 291 | ||||
| -rw-r--r-- | base/selinux/src/CMakeLists.txt | 28 | ||||
| -rw-r--r-- | base/selinux/src/Makefile | 18 | ||||
| -rw-r--r-- | base/selinux/src/pki.fc | 51 | ||||
| -rw-r--r-- | base/selinux/src/pki.if | 293 | ||||
| -rwxr-xr-x | base/selinux/src/pki.sh | 41 | ||||
| -rw-r--r-- | base/selinux/src/pki.te | 221 | ||||
| -rw-r--r-- | patches/README | 8 | ||||
| -rw-r--r-- | patches/pki-core-selinux-f16.patch | 23 | ||||
| -rw-r--r-- | patches/pki-core-selinux-f17-1.patch | 36 | ||||
| -rw-r--r-- | patches/pki-core-selinux-f17.patch | 35 | ||||
| -rwxr-xr-x | scripts/build_dogtag_pki | 3 | ||||
| -rwxr-xr-x | scripts/pki_patch_maker | 2 |
14 files changed, 10 insertions, 1051 deletions
diff --git a/base/selinux/CMakeLists.txt b/base/selinux/CMakeLists.txt deleted file mode 100644 index a9ef0707f..000000000 --- a/base/selinux/CMakeLists.txt +++ /dev/null @@ -1,11 +0,0 @@ -project(selinux) - -add_subdirectory(src) - -# install empty directories -install( - DIRECTORY - DESTINATION - ${SHARE_INSTALL_PREFIX}/selinux/modules -) - diff --git a/base/selinux/LICENSE b/base/selinux/LICENSE deleted file mode 100644 index e281f4362..000000000 --- a/base/selinux/LICENSE +++ /dev/null @@ -1,291 +0,0 @@ -This Program is free software; you can redistribute it and/or modify -it under the terms of the GNU General Public License as published -by the Free Software Foundation; version 2 of the License. - -This Program is distributed in the hope that it will be useful, but -WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -for more details. - -You should have received a copy of the GNU General Public License -along with this Program; if not, write to the Free Software -Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. - - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Lesser General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. diff --git a/base/selinux/src/CMakeLists.txt b/base/selinux/src/CMakeLists.txt deleted file mode 100644 index 146ab1348..000000000 --- a/base/selinux/src/CMakeLists.txt +++ /dev/null @@ -1,28 +0,0 @@ -set(POLICY_MAKEFILE /usr/share/selinux/devel/Makefile) - -set(policy_SRCS - pki.fc - pki.if - pki.te -) - -if (LINUX) - if (EXISTS ${POLICY_MAKEFILE}) - foreach(_POLICY ${policy_SRCS}) - macro_copy_file(${CMAKE_CURRENT_SOURCE_DIR}/${_POLICY} ${CMAKE_CURRENT_BINARY_DIR}/${_POLICY}) - endforeach(_POLICY ${policy_SRCS}) - - # FIXME This should be done by cmake - add_custom_target(selinux ALL - COMMAND ${CMAKE_BUILD_TOOL} -f ${POLICY_MAKEFILE} - WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} - ) - - install( - FILES - ${CMAKE_CURRENT_BINARY_DIR}/pki.pp - DESTINATION - ${SHARE_INSTALL_PREFIX}/selinux/modules - ) - endif (EXISTS ${POLICY_MAKEFILE}) -endif (LINUX) diff --git a/base/selinux/src/Makefile b/base/selinux/src/Makefile deleted file mode 100644 index 201a448a9..000000000 --- a/base/selinux/src/Makefile +++ /dev/null @@ -1,18 +0,0 @@ -POLICY_MAKEFILE = /usr/share/selinux/devel/Makefile -POLICY_DIR = $(DESTDIR)/usr/share/selinux/targeted - -all: - if [ ! -e $(POLICY_MAKEFILE) ]; then echo "You need to install the SELinux development tools (selinux-policy-devel)" && exit 1; fi - $(MAKE) -f $(POLICY_MAKEFILE) || exit 1; - -clean: - rm -rf tmp - rm pki.pp - -install: all - install -d $(POLICY_DIR) - install -m 644 pki.pp $(POLICY_DIR) - -load: - /usr/sbin/semodule -i pki.pp - diff --git a/base/selinux/src/pki.fc b/base/selinux/src/pki.fc deleted file mode 100644 index 20d2c79a5..000000000 --- a/base/selinux/src/pki.fc +++ /dev/null @@ -1,51 +0,0 @@ -/etc/pki/pki-tomcat(/.*)? gen_context(system_u:object_r:pki_tomcat_etc_rw_t,s0) -/var/lib/pki/pki-tomcat(/.*)? gen_context(system_u:object_r:pki_tomcat_var_lib_t,s0) -/var/run/pki/tomcat(/.*)? gen_context(system_u:object_r:pki_tomcat_var_run_t,s0) -/var/log/pki/pki-tomcat(/.*)? gen_context(system_u:object_r:pki_tomcat_log_t,s0) -/etc/sysconfig/pki/tomcat(/.*)? gen_context(system_u:object_r:pki_tomcat_etc_rw_t,s0) -/var/log/pki gen_context(system_u:object_r:pki_log_t,s0) -/usr/bin/pkidaemon gen_context(system_u:object_r:pki_tomcat_exec_t,s0) -/etc/pki/pki-tomcat/alias(/.*)? gen_context(system_u:object_r:pki_tomcat_cert_t,s0) - -/etc/pki-ra(/.*)? gen_context(system_u:object_r:pki_ra_etc_rw_t,s0) -/var/lib/pki-ra(/.*)? gen_context(system_u:object_r:pki_ra_var_lib_t,s0) -/var/log/pki-ra(/.*)? gen_context(system_u:object_r:pki_ra_log_t,s0) -/var/run/pki/ra(/.*)? gen_context(system_u:object_r:pki_ra_var_run_t,s0) -/etc/sysconfig/pki/ra(/.*)? gen_context(system_u:object_r:pki_ra_etc_rw_t,s0) -/var/lib/pki-ra/pki-ra gen_context(system_u:object_r:pki_ra_exec_t,s0) - -/etc/pki-tps(/.*)? gen_context(system_u:object_r:pki_tps_etc_rw_t,s0) -/var/lib/pki-tps(/.*)? gen_context(system_u:object_r:pki_tps_var_lib_t,s0) -/var/log/pki-tps(/.*)? gen_context(system_u:object_r:pki_tps_log_t,s0) -/var/run/pki/tps(/.*)? gen_context(system_u:object_r:pki_tps_var_run_t,s0) -/etc/sysconfig/pki/tps(/.*)? gen_context(system_u:object_r:pki_tps_etc_rw_t,s0) -/var/lib/pki-tps/pki-tps gen_context(system_u:object_r:pki_tps_exec_t,s0) - -# default labeling for nCipher -/opt/nfast/scripts/init.d/(.*) gen_context(system_u:object_r:initrc_exec_t, s0) -/opt/nfast/sbin/init.d-ncipher gen_context(system_u:object_r:initrc_exec_t, s0) -/opt/nfast(/.*)? gen_context(system_u:object_r:pki_common_t, s0) -/dev/nfast(/.*)? gen_context(system_u:object_r:pki_common_dev_t, s0) - -# old paths (for migration) -/etc/pki-ca(/.*)? gen_context(system_u:object_r:pki_tomcat_etc_rw_t,s0) -/var/lib/pki-ca(/.*)? gen_context(system_u:object_r:pki_tomcat_var_lib_t,s0) -/var/run/pki-ca.pid gen_context(system_u:object_r:pki_tomcat_var_run_t,s0) -/var/log/pki-ca(/.*)? gen_context(system_u:object_r:pki_tomcat_log_t,s0) -/var/lib/pki-ca/alias(/.*)? gen_context(system_u:object_r:pki_tomcat_cert_t,s0) -/etc/pki-kra(/.*)? gen_context(system_u:object_r:pki_tomcat_etc_rw_t,s0) -/var/lib/pki-kra(/.*)? gen_context(system_u:object_r:pki_tomcat_var_lib_t,s0) -/var/run/pki-kra.pid gen_context(system_u:object_r:pki_tomcat_var_run_t,s0) -/var/log/pki-kra(/.*)? gen_context(system_u:object_r:pki_tomcat_log_t,s0) -/var/lib/pki-kra/alias(/.*)? gen_context(system_u:object_r:pki_tomcat_cert_t,s0) -/etc/pki-ocsp(/.*)? gen_context(system_u:object_r:pki_tomcat_etc_rw_t,s0) -/var/lib/pki-ocsp(/.*)? gen_context(system_u:object_r:pki_tomcat_var_lib_t,s0) -/var/run/pki-ocsp.pid gen_context(system_u:object_r:pki_tomcat_var_run_t,s0) -/var/log/pki-ocsp(/.*)? gen_context(system_u:object_r:pki_tomcat_log_t,s0) -/var/lib/pki-ocsp/alias(/.*)? gen_context(system_u:object_r:pki_tomcat_cert_t,s0) -/etc/pki-tks(/.*)? gen_context(system_u:object_r:pki_tomcat_etc_rw_t,s0) -/var/lib/pki-tks(/.*)? gen_context(system_u:object_r:pki_tomcat_var_lib_t,s0) -/var/run/pki-tks.pid gen_context(system_u:object_r:pki_tomcat_var_run_t,s0) -/var/log/pki-tks(/.*)? gen_context(system_u:object_r:pki_tomcat_log_t,s0) -/var/lib/pki-tks/alias(/.*)? gen_context(system_u:object_r:pki_tomcat_cert_t,s0) - diff --git a/base/selinux/src/pki.if b/base/selinux/src/pki.if deleted file mode 100644 index 423546d1f..000000000 --- a/base/selinux/src/pki.if +++ /dev/null @@ -1,293 +0,0 @@ - -## <summary>policy for pki</summary> -######################################## -## <summary> -## Allow read and write pki cert files. -## </summary> -## <param name="domain"> -## <summary> -## Domain allowed access. -## </summary> -## </param> -# -interface(`pki_rw_tomcat_cert',` - gen_require(` - type pki_tomcat_cert_t; - ') - - rw_files_pattern($1, pki_tomcat_cert_t, pki_tomcat_cert_t) -') - -######################################## -## <summary> -## Allow read and write pki cert files. -## </summary> -## <param name="domain"> -## <summary> -## Domain allowed access. -## </summary> -## </param> -# -interface(`pki_search_tomcat_etc_rw',` - gen_require(` - type pki_tomcat_etc_rw_t; - ') - - search_dirs_pattern($1, pki_tomcat_etc_rw_t, pki_tomcat_etc_rw_t) -') - -######################################## -## <summary> -## Create a set of derived types for apache -## web content. -## </summary> -## <param name="prefix"> -## <summary> -## The prefix to be used for deriving type names. -## </summary> -## </param> -# -template(`pki_apache_template',` - gen_require(` - attribute $1_process; - attribute $1_config, $1_var_lib, $1_var_run; - attribute $1_executable, $1_script, $1_var_log; - type pki_common_t, pki_common_dev_t; - type httpd_config_t; - ') - ######################################## - # - # Declarations - # - - type $1_t, $1_process; - type $1_exec_t, $1_executable; - domain_type($1_t) - init_daemon_domain($1_t, $1_exec_t) - - type $1_script_exec_t, $1_script; - init_script_file($1_script_exec_t) - - type $1_etc_rw_t, $1_config; - files_type($1_etc_rw_t) - - type $1_var_run_t, $1_var_run; - files_pid_file($1_var_run_t) - - type $1_var_lib_t, $1_var_lib; - files_type($1_var_lib_t) - - type $1_log_t, $1_var_log; - logging_log_file($1_log_t) - - ######################################## - # - # $1 local policy - # - - allow $1_t lib_t:file execute_no_trans; - allow $1_t self:capability { setuid sys_nice setgid dac_override fowner fsetid kill chown}; - allow $1_t self:process { setsched signal getsched signull execstack execmem sigkill}; - allow $1_t self:sem all_sem_perms; - allow $1_t self:tcp_socket create_stream_socket_perms; - allow $1_t self:netlink_route_socket { write getattr read bind create nlmsg_read }; - - # allow writing to the kernel keyring - allow $1_t self:key { write read }; - - ## internal communication is often done using fifo and unix sockets. - allow $1_t self:fifo_file rw_file_perms; - allow $1_t self:unix_stream_socket create_stream_socket_perms; - - # Init script handling - domain_use_interactive_fds($1_t) - - files_read_etc_files($1_t) - allow $1_t $1_etc_rw_t:lnk_file read; - - manage_dirs_pattern($1_t, $1_etc_rw_t, $1_etc_rw_t) - manage_files_pattern($1_t, $1_etc_rw_t, $1_etc_rw_t) - files_etc_filetrans($1_t,$1_etc_rw_t, { file dir }) - - manage_dirs_pattern($1_t, $1_var_run_t, $1_var_run_t) - manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t) - files_pid_filetrans($1_t,$1_var_run_t, { file dir }) - - manage_dirs_pattern($1_t, $1_var_lib_t, $1_var_lib_t) - manage_files_pattern($1_t, $1_var_lib_t, $1_var_lib_t) - read_lnk_files_pattern($1_t, $1_var_lib_t, $1_var_lib_t) - files_var_lib_filetrans($1_t, $1_var_lib_t, { file dir } ) - - manage_dirs_pattern($1_t, $1_log_t, $1_log_t) - manage_files_pattern($1_t, $1_log_t, $1_log_t) - logging_log_filetrans($1_t, $1_log_t, { file dir } ) - - # lock files - files_create_lock_dirs($1_t) - files_manage_generic_locks($1_t) - files_delete_generic_locks($1_t) - files_rw_lock_dirs($1_t) - - seutil_exec_setfiles($1_t) - - init_dontaudit_write_utmp($1_t) - - libs_use_ld_so($1_t) - libs_use_shared_libs($1_t) - libs_exec_ld_so($1_t) - - fs_search_cgroup_dirs($1_t) - - miscfiles_read_localization($1_t) - - optional_policy(` - # apache permissions - apache_exec_modules($1_t) - apache_list_modules($1_t) - apache_read_config($1_t) - apache_exec($1_t) - - # should be started using a script which will execute httpd - # start up httpd in $1_t mode - can_exec($1_t, httpd_config_t) - allow $1_t httpd_exec_t:file entrypoint; - allow $1_t httpd_modules_t:lnk_file read; - can_exec($1_t, httpd_suexec_exec_t) - ') - - corecmd_exec_bin($1_t) - corecmd_exec_shell($1_t) - corecmd_read_bin_symlinks($1_t) - corecmd_search_bin($1_t) - - corenet_sendrecv_unlabeled_packets($1_t) - corenet_tcp_bind_all_nodes($1_t) - corenet_tcp_sendrecv_all_if($1_t) - corenet_tcp_sendrecv_all_nodes($1_t) - corenet_tcp_sendrecv_all_ports($1_t) - corenet_all_recvfrom_unlabeled($1_t) - corenet_tcp_connect_generic_port($1_t) - - # talk to the hsm - allow $1_t pki_common_dev_t:sock_file write; - allow $1_t pki_common_dev_t:dir search; - allow $1_t pki_common_t:dir create_dir_perms; - manage_files_pattern($1_t, pki_common_t, pki_common_t) - can_exec($1_t, pki_common_t) - init_stream_connect_script($1_t) - - #talk to lunasa hsm - logging_send_syslog_msg($1_t) - - # allow rpm -q in init scripts - rpm_exec($1_t) - - #installation and debug uses /tmp - files_manage_generic_tmp_dirs($1_t) - files_manage_generic_tmp_files($1_t) - - kernel_read_kernel_sysctls($1_t) - kernel_read_system_state($1_t) - - # need to resolve addresses? - auth_use_nsswitch($1_t) - - sysnet_read_config($1_t) - dev_read_urand($1_t) - dev_read_rand($1_t) - - # shutdown script uses ps - domain_dontaudit_read_all_domains_state($1_t) - ps_process_pattern($1_t, $1_t) - - ifdef(`targeted_policy',` - term_dontaudit_use_unallocated_ttys($1_t) - term_dontaudit_use_generic_ptys($1_t) - ') - - gen_require(` - type httpd_t; - type httpd_exec_t; - type httpd_suexec_exec_t; - ') - - #============= httpd_t ============== - allow httpd_t $1_var_run_t:dir search; - allow httpd_t $1_var_run_t:file read_file_perms; - allow httpd_t $1_etc_rw_t:dir search; - allow httpd_t $1_etc_rw_t:file rw_file_perms; - allow httpd_t $1_log_t:dir rw_dir_perms; - allow httpd_t $1_log_t:file manage_file_perms; - allow httpd_t $1_t:process { signal signull }; - allow httpd_t $1_var_lib_t:dir { getattr search }; - allow httpd_t $1_var_lib_t:lnk_file read; - allow httpd_t $1_var_lib_t:file read_file_perms; -') - -######################################## -## <summary> -## Execute pki_apache server in the pki_apache domain. -## </summary> -## <param name="domain"> -## <summary> -## The type of the process performing this action. -## </summary> -## </param> -# -interface(`pki_apache_script_domtrans',` - gen_require(` - attribute $1_script; - ') - - init_script_domtrans_spec($1, $1_script) -') - - -######################################## -## <summary> -## All of the rules required to administrate -## an pki_apache environment -## </summary> -## <param name="domain"> -## <summary> -## Domain allowed access. -## </summary> -## </param> -## <param name="role"> -## <summary> -## The role to be allowed to manage the syslog domain. -## </summary> -## </param> -## <param name="terminal"> -## <summary> -## The type of the user terminal. -## </summary> -## </param> -## <rolecap/> -# -interface(`pki_apache_admin',` - gen_require(` - attribute $1_process; - attribute $1_config; - attribute $1_executable; - attribute $1_var_lib; - attribute $1_var_log; - attribute $1_var_run; - attribute $1_script; - ') - - allow $1 $1_process:process { ptrace signal_perms }; - ps_process_pattern($1, $1_t) - - # Allow pki_apache_t to restart the service - $1_script_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 $1_script system_r; - allow $2 system_r; - - manage_all_pattern($1, $1_config) - manage_all_pattern($1, $1_var_run) - manage_all_pattern($1, $1_var_lib) - manage_all_pattern($1, $1_var_log) - manage_all_pattern($1, $1_config) -') diff --git a/base/selinux/src/pki.sh b/base/selinux/src/pki.sh deleted file mode 100755 index bf95ba98c..000000000 --- a/base/selinux/src/pki.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/sh - -USAGE="$0 [ --update ]" - -if [ ! -f /usr/share/selinux/devel/Makefile ]; then -echo 'selinux-policy-devel not installed, package required for building policy' -echo '# yum install selinux-policy-devel' -exit 1 -fi - -if [ $# -eq 1 ]; then - if [ "$1" = "--update" ] ; then - time=`ls -l --time-style="+%x %X" pki_ca.te | awk '{ printf "%s %s", $6, $7 }'` - rules=`ausearch --start $time -m avc --raw -se pki_ca` - if [ x"$rules" != "x" ] ; then - echo "Found avc's to update policy with" - echo -e "$rules" | audit2allow -R - echo "Do you want these changes added to policy [y/n]?" - read ANS - if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then - echo "Updating policy" - echo -e "$rules" | audit2allow -R >> pki_ca.te - # Fall though and rebuild policy - else - exit 0 - fi - else - echo "No new avcs found" - exit 0 - fi - else - echo -e $USAGE - exit 1 - fi -elif [ $# -ge 2 ] ; then - echo -e $USAGE - exit 1 -fi - -echo "Building and Loading Policy" -make -f /usr/share/selinux/devel/Makefile diff --git a/base/selinux/src/pki.te b/base/selinux/src/pki.te deleted file mode 100644 index aefcd03c8..000000000 --- a/base/selinux/src/pki.te +++ /dev/null @@ -1,221 +0,0 @@ -policy_module(pki,10.0.13) - -type pki_log_t; -files_type(pki_log_t) - -type pki_common_t; -files_type(pki_common_t) - -type pki_common_dev_t; -files_type(pki_common_dev_t) - -type pki_tomcat_etc_rw_t; -files_type(pki_tomcat_etc_rw_t) - -type pki_tomcat_cert_t; -files_type(pki_tomcat_cert_t) - -tomcat_domain_template(pki_tomcat) - -permissive pki_tomcat_t; - -type pki_tomcat_lock_t; -files_lock_file(pki_tomcat_lock_t) - -require { - type systemd_unit_file_t; - type setfiles_t; - type load_policy_t; - type certmonger_t; -} - -allow pki_tomcat_t self:capability { setuid chown setgid fowner audit_write dac_override sys_nice fsetid}; -allow pki_tomcat_t self:netlink_audit_socket { nlmsg_relay create }; - -allow pki_tomcat_t self:key write; -allow pki_tomcat_t self:process { signal setsched signull execmem }; -allow pki_tomcat_t self:tcp_socket { accept listen }; -allow pki_tomcat_t self:unix_dgram_socket { create connect }; -allow pki_tomcat_t self:process signal; - -# allow writing to the kernel keyring -allow pki_tomcat_t self:key { write read }; - -manage_dirs_pattern(pki_tomcat_t, pki_tomcat_etc_rw_t, pki_tomcat_etc_rw_t) -manage_files_pattern(pki_tomcat_t, pki_tomcat_etc_rw_t, pki_tomcat_etc_rw_t) - -manage_dirs_pattern(pki_tomcat_t, pki_tomcat_cert_t, pki_tomcat_cert_t) -manage_files_pattern(pki_tomcat_t, pki_tomcat_cert_t, pki_tomcat_cert_t) - -manage_dirs_pattern(pki_tomcat_t, pki_tomcat_lock_t, pki_tomcat_lock_t) -manage_files_pattern(pki_tomcat_t, pki_tomcat_lock_t, pki_tomcat_lock_t) -manage_lnk_files_pattern(pki_tomcat_t, pki_tomcat_lock_t, pki_tomcat_lock_t) -files_lock_filetrans(pki_tomcat_t, pki_tomcat_lock_t, { dir file lnk_file }) - -# allow java subsystems to talk to the ncipher hsm -allow pki_tomcat_t pki_common_dev_t:sock_file write; -allow pki_tomcat_t pki_common_dev_t:dir search; -allow pki_tomcat_t pki_common_t:dir create_dir_perms; -manage_files_pattern(pki_tomcat_t, pki_common_t, pki_common_t) -can_exec(pki_tomcat_t, pki_common_t) -init_stream_connect_script(pki_tomcat_t) - -# init script checks and fixes links if needed -allow pki_tomcat_t pki_tomcat_var_lib_t:lnk_file { read getattr setattr }; -allow pki_tomcat_t pki_tomcat_var_run_t:lnk_file { create getattr setattr }; - -allow pki_tomcat_t systemd_unit_file_t:lnk_file { read getattr setattr }; -allow pki_tomcat_t systemd_unit_file_t:dir getattr; -allow pki_tomcat_t systemd_unit_file_t:file getattr; - -allow pki_tomcat_t pki_log_t:dir getattr; -allow pki_tomcat_t pki_log_t:dir search; - -kernel_read_kernel_sysctls(pki_tomcat_t) - -corenet_tcp_connect_http_cache_port(pki_tomcat_t) -corenet_tcp_connect_ldap_port(pki_tomcat_t) -corenet_tcp_connect_smtp_port(pki_tomcat_t) - -selinux_get_enforce_mode(pki_tomcat_t) - -logging_send_audit_msgs(pki_tomcat_t) -logging_send_syslog_msg(pki_tomcat_t) - -miscfiles_read_hwdata(pki_tomcat_t) -miscfiles_read_localization(pki_tomcat_t) -files_manage_generic_tmp_files(pki_tomcat_t) -userdom_manage_user_tmp_dirs(pki_tomcat_t) -userdom_manage_user_tmp_files(pki_tomcat_t) - -# forward proxy -# need to define ports to fix this -#corenet_tcp_connect_pki_tomcat_port(httpd_t) - -# for crl publishing -allow pki_tomcat_t pki_tomcat_var_lib_t:lnk_file { rename create unlink }; - -# for ECC -auth_getattr_shadow(pki_tomcat_t) -optional_policy(` - consoletype_exec(pki_tomcat_t) -') - -optional_policy(` - hostname_exec(pki_tomcat_t) -') - -# old type aliases for migration -typealias pki_tomcat_t alias { pki_ca_t pki_kra_t pki_ocsp_t pki_tks_t }; -typealias pki_tomcat_etc_rw_t alias { pki_ca_etc_rw_t pki_kra_etc_rw_t pki_ocsp_etc_rw_t pki_tks_etc_rw_t }; -typealias pki_tomcat_var_lib_t alias { pki_ca_var_lib_t pki_kra_var_lib_t pki_ocsp_var_lib_t pki_tks_var_lib_t }; -typealias pki_tomcat_var_run_t alias { pki_ca_var_run_t pki_kra_var_run_t pki_ocsp_var_run_t pki_tks_var_run_t }; -typealias pki_tomcat_log_t alias { pki_ca_log_t pki_kra_log_t pki_ocsp_log_t pki_tks_log_t }; -# typealias http_port_t alias { pki_ca_port_t pki_kra_port_t pki_ocsp_port_t pki_tks_port_t }; - -# install/ uninstall instance -allow load_policy_t pki_log_t:file write; -dirsrv_manage_var_lib(pki_tomcat_t) -allow setfiles_t pki_log_t:file write; - -# allow certmonger to read certdb files -pki_rw_tomcat_cert(certmonger_t) -pki_search_tomcat_etc_rw(certmonger_t) - -# needed for dogtag 9 style instances -type pki_tomcat_script_t; -domain_type(pki_tomcat_script_t) -gen_require(` - type java_exec_t; - type initrc_t; -') -domtrans_pattern(pki_tomcat_script_t, java_exec_t, pki_tomcat_t) - -role system_r types pki_tomcat_script_t; -allow pki_tomcat_t java_exec_t:file entrypoint; -allow initrc_t pki_tomcat_script_t:process transition; - -optional_policy(` - unconfined_domain(pki_tomcat_script_t) -') - -########################## -# TPS policy -########################## - -attribute pki_tps_config; -attribute pki_tps_executable; -attribute pki_tps_var_lib; -attribute pki_tps_var_log; -attribute pki_tps_var_run; -attribute pki_tps_pidfiles; -attribute pki_tps_script; -attribute pki_tps_process; - -type pki_tps_tomcat_exec_t; -files_type(pki_tps_tomcat_exec_t) - -pki_apache_template(pki_tps) - -# used to serve cgi web pages under /var/lib/pki-tps, formatting, enrollment -allow pki_tps_t pki_tps_var_lib_t:file {execute execute_no_trans}; - -corenet_tcp_bind_pki_tps_port(pki_tps_t) - -# customer may run an ldap server on 389 -corenet_tcp_connect_ldap_port(pki_tps_t) - -# connect to other subsystems -corenet_tcp_connect_pki_ca_port(pki_tps_t) -corenet_tcp_connect_pki_kra_port(pki_tps_t) -corenet_tcp_connect_pki_tks_port(pki_tps_t) - -files_exec_usr_files(pki_tps_t) -files_read_usr_symlinks(pki_tps_t) -files_read_usr_files(pki_tps_t) - -# why do I need to add this? -allow httpd_t httpd_config_t:file execute; -files_exec_usr_files(httpd_t) - -########################## -# RA policy -######################### - -attribute pki_ra_config; -attribute pki_ra_executable; -attribute pki_ra_var_lib; -attribute pki_ra_var_log; -attribute pki_ra_var_run; -attribute pki_ra_pidfiles; -attribute pki_ra_script; -attribute pki_ra_process; - -type pki_ra_tomcat_exec_t; -files_type(pki_ra_tomcat_exec_t) - -pki_apache_template(pki_ra) - -#RA specific? talking to mysql? -allow pki_ra_t self:udp_socket { write read create connect }; -allow pki_ra_t self:unix_dgram_socket { write create connect }; - -corenet_tcp_bind_pki_ra_port(pki_ra_t) - -# talk to other subsystems -corenet_tcp_connect_pki_ca_port(pki_ra_t) - -files_exec_usr_files(pki_ra_t) -fs_getattr_xattr_fs(pki_ra_t) - -corenet_tcp_connect_smtp_port(pki_ra_t) -files_search_spool(pki_ra_t) - -# -# Should be changed to mta_send_mail -# -mta_manage_spool(pki_ra_t) -mta_manage_queue(pki_ra_t) -mta_read_config(pki_ra_t) -mta_sendmail_exec(pki_ra_t) - diff --git a/patches/README b/patches/README new file mode 100644 index 000000000..5e5fb4e77 --- /dev/null +++ b/patches/README @@ -0,0 +1,8 @@ +Patches for use by hybrid builds of the compose scripts located in the +'pki/scripts' directory. + +Sample Naming Formats: + + patches/pki-core-selinux-f16.patch + patches/pki-core-selinux-f17-1.patch + patches/pki-core-selinux-f17.patch diff --git a/patches/pki-core-selinux-f16.patch b/patches/pki-core-selinux-f16.patch deleted file mode 100644 index 6866033dc..000000000 --- a/patches/pki-core-selinux-f16.patch +++ /dev/null @@ -1,23 +0,0 @@ -diff --git a/pki/base/selinux/src/pki.if b/pki/base/selinux/src/pki.if -index 0709176..9a35184 100644 ---- a/pki/base/selinux/src/pki.if -+++ b/pki/base/selinux/src/pki.if -@@ -193,7 +193,7 @@ template(`pki_ca_template',` - corenet_tcp_connect_ldap_port($1_t) - - # tomcat connects to ephemeral ports on shutdown -- corenet_tcp_connect_all_unreserved_ports($1_t) -+ corenet_tcp_connect_all_ephemeral_ports($1_t) - - optional_policy(` - #This is broken in selinux-policy we need java_exec defined, Will add to policy -diff --git a/pki/base/selinux/src/pki.te b/pki/base/selinux/src/pki.te -index 7f6e657..dab02d4 100644 ---- a/pki/base/selinux/src/pki.te -+++ b/pki/base/selinux/src/pki.te -@@ -1,4 +1,4 @@ --policy_module(pki,10.0.2) -+policy_module(pki,10.0.3) - - attribute pki_ca_config; - attribute pki_ca_executable; diff --git a/patches/pki-core-selinux-f17-1.patch b/patches/pki-core-selinux-f17-1.patch deleted file mode 100644 index 3ee106400..000000000 --- a/patches/pki-core-selinux-f17-1.patch +++ /dev/null @@ -1,36 +0,0 @@ -diff --git a/pki/base/selinux/src/pki.if b/pki/base/selinux/src/pki.if -index 0709176..20dfc17 100644 ---- a/pki/base/selinux/src/pki.if -+++ b/pki/base/selinux/src/pki.if -@@ -206,6 +206,21 @@ template(`pki_ca_template',` - optional_policy(` - unconfined_domain($1_script_t) - ') -+ -+ # tomcat6 init scripts do runuser and touch lockfile -+ allow $1_t self:capability { setuid chown setgid fowner audit_write dac_override }; -+ allow $1_t self:netlink_audit_socket { nlmsg_relay create read write }; -+ consoletype_exec($1_t) -+ fs_read_hugetlbfs_files($1_t) -+ hostname_exec($1_t) -+ kernel_read_kernel_sysctls($1_t) -+ fs_getattr_xattr_fs($1_t) -+ -+ # java (mislabeled as lib_t?) calls build_classpath -+ libs_exec_lib_files($1_t) -+ -+ selinux_get_enforce_mode($1_t) -+ - ') - - ######################################## -diff --git a/pki/base/selinux/src/pki.te b/pki/base/selinux/src/pki.te -index 7f6e657..dab02d4 100644 ---- a/pki/base/selinux/src/pki.te -+++ b/pki/base/selinux/src/pki.te -@@ -1,4 +1,4 @@ --policy_module(pki,10.0.2) -+policy_module(pki,10.0.4) - - attribute pki_ca_config; - attribute pki_ca_executable; diff --git a/patches/pki-core-selinux-f17.patch b/patches/pki-core-selinux-f17.patch deleted file mode 100644 index 465c95fe2..000000000 --- a/patches/pki-core-selinux-f17.patch +++ /dev/null @@ -1,35 +0,0 @@ -diff --git a/pki/base/selinux/src/pki.if b/pki/base/selinux/src/pki.if -index 0709176..20dfc17 100644 ---- a/pki/base/selinux/src/pki.if -+++ b/pki/base/selinux/src/pki.if -@@ -206,6 +206,20 @@ template(`pki_ca_template',` - optional_policy(` - unconfined_domain($1_script_t) - ') -+ -+ # tomcat6 init scripts do runuser and touch lockfile -+ allow $1_t self:capability { setuid chown setgid fowner audit_write dac_override }; -+ allow $1_t self:netlink_audit_socket { nlmsg_relay create read write }; -+ consoletype_exec($1_t) -+ fs_read_hugetlbfs_files($1_t) -+ hostname_exec($1_t) -+ kernel_read_kernel_sysctls($1_t) -+ -+ # java (mislabeled as lib_t?) calls build_classpath -+ libs_exec_lib_files($1_t) -+ -+ selinux_get_enforce_mode($1_t) -+ - ') - - ######################################## -diff --git a/pki/base/selinux/src/pki.te b/pki/base/selinux/src/pki.te -index 7f6e657..dab02d4 100644 ---- a/pki/base/selinux/src/pki.te -+++ b/pki/base/selinux/src/pki.te -@@ -1,4 +1,4 @@ --policy_module(pki,10.0.2) -+policy_module(pki,10.0.3) - - attribute pki_ca_config; - attribute pki_ca_executable; diff --git a/scripts/build_dogtag_pki b/scripts/build_dogtag_pki index 058abc931..653b9f2fe 100755 --- a/scripts/build_dogtag_pki +++ b/scripts/build_dogtag_pki @@ -125,7 +125,6 @@ PKI_BASE=pki-base${RPM_EXT} PKI_JAVADOC=pki-javadoc${RPM_EXT} PKI_TOOLS=pki-tools${RPM_EXT} PKI_SERVER=pki-server${RPM_EXT} -PKI_SELINUX=pki-selinux${RPM_EXT} PKI_CA=pki-ca${RPM_EXT} PKI_KRA=pki-kra${RPM_EXT} PKI_OCSP=pki-ocsp${RPM_EXT} @@ -159,7 +158,7 @@ cd ${PKI_CORE_PACKAGES_DIR}/${RPM_DIR} mkdir -p ${PKI_CORE_PACKAGES_DIR}/${RPM_DIR}/${COMBINED} cp -p ${NOARCH}/*.rpm ${PKI_ARCH}/*.rpm ${PKI_CORE_PACKAGES_DIR}/${RPM_DIR}/${COMBINED} cd ${PKI_CORE_PACKAGES_DIR}/${RPM_DIR}/${COMBINED} -${PKI_SUDO} ${YUM_EXE} ${YUM_EXE_OPTIONS} ${PKI_SYMKEY} ${PKI_BASE} ${PKI_JAVADOC} ${PKI_TOOLS} ${PKI_SERVER} ${PKI_SELINUX} ${PKI_CA} ${PKI_KRA} ${PKI_OCSP} ${PKI_TKS} +${PKI_SUDO} ${YUM_EXE} ${YUM_EXE_OPTIONS} ${PKI_SYMKEY} ${PKI_BASE} ${PKI_JAVADOC} ${PKI_TOOLS} ${PKI_SERVER} ${PKI_CA} ${PKI_KRA} ${PKI_OCSP} ${PKI_TKS} # Compose and install 'pki-tps' packages cd ${PKI_PWD} diff --git a/scripts/pki_patch_maker b/scripts/pki_patch_maker index dcd5b5eeb..2803d26fb 100755 --- a/scripts/pki_patch_maker +++ b/scripts/pki_patch_maker @@ -35,7 +35,7 @@ Usage() ## ## Identify source associated with srpm ## -PKI_CORE="base/ca base/common base/java-tools base/native-tools base/selinux base/setup base/symkey base/util" +PKI_CORE="base/ca base/common base/java-tools base/native-tools base/setup base/symkey base/util" ## |