summaryrefslogtreecommitdiffstats
path: root/base/selinux/src/pki.te
blob: e2ed4be103a57a791ae74ad190163af28b341c16 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
policy_module(pki,10.0.10)

type pki_log_t;
files_type(pki_log_t)

type pki_common_t;
files_type(pki_common_t)

type pki_common_dev_t;
files_type(pki_common_dev_t)

type pki_tomcat_etc_rw_t;
files_type(pki_tomcat_etc_rw_t)

tomcat_domain_template(pki_tomcat)

permissive pki_tomcat_t;

type pki_tomcat_lock_t;
files_lock_file(pki_tomcat_lock_t)

require {
        type pki_tomcat_var_lib_t;
        type pki_tomcat_t;
        type pki_tomcat_var_run_t;
        type pki_tomcat_log_t;
        type systemd_unit_file_t;
}

allow pki_tomcat_t self:capability { setuid chown setgid fowner audit_write dac_override sys_nice};
allow pki_tomcat_t self:netlink_audit_socket { nlmsg_relay create };

allow pki_tomcat_t self:key write;
allow pki_tomcat_t self:process { signal setsched signull execmem };
allow pki_tomcat_t self:tcp_socket { accept listen };
allow pki_tomcat_t self:unix_dgram_socket { create connect };
allow pki_tomcat_t self:process signal;

# allow writing to the kernel keyring
allow pki_tomcat_t self:key { write read };

manage_dirs_pattern(pki_tomcat_t, pki_tomcat_etc_rw_t, pki_tomcat_etc_rw_t)
manage_files_pattern(pki_tomcat_t, pki_tomcat_etc_rw_t, pki_tomcat_etc_rw_t)

manage_dirs_pattern(pki_tomcat_t,  pki_tomcat_lock_t,  pki_tomcat_lock_t)
manage_files_pattern(pki_tomcat_t,  pki_tomcat_lock_t,  pki_tomcat_lock_t)
manage_lnk_files_pattern(pki_tomcat_t,  pki_tomcat_lock_t,  pki_tomcat_lock_t)
files_lock_filetrans(pki_tomcat_t,  pki_tomcat_lock_t, { dir file lnk_file })

# allow java subsystems to talk to the ncipher hsm
allow pki_tomcat_t pki_common_dev_t:sock_file write;
allow pki_tomcat_t pki_common_dev_t:dir search;
allow pki_tomcat_t pki_common_t:dir create_dir_perms;
manage_files_pattern(pki_tomcat_t, pki_common_t, pki_common_t)
can_exec(pki_tomcat_t, pki_common_t)
init_stream_connect_script(pki_tomcat_t)

# init script checks and fixes links if needed
allow pki_tomcat_t pki_tomcat_var_lib_t:lnk_file { read getattr setattr };
allow pki_tomcat_t pki_tomcat_var_run_t:lnk_file { create getattr setattr };
allow pki_tomcat_t self:capability sys_nice;
allow pki_tomcat_t systemd_unit_file_t:lnk_file { read getattr setattr };
allow pki_tomcat_t systemd_unit_file_t:dir getattr;
allow pki_tomcat_t systemd_unit_file_t:file getattr;

allow pki_tomcat_t pki_log_t:dir getattr;
allow pki_tomcat_t pki_log_t:dir search;

kernel_read_kernel_sysctls(pki_tomcat_t)

corenet_tcp_connect_http_cache_port(pki_tomcat_t)
corenet_tcp_connect_ldap_port(pki_tomcat_t)
corenet_tcp_connect_smtp_port(pki_tomcat_t)

selinux_get_enforce_mode(pki_tomcat_t)

logging_send_audit_msgs(pki_tomcat_t)
logging_send_syslog_msg(pki_tomcat_t)

miscfiles_read_hwdata(pki_tomcat_t)

# forward proxy
# need to define ports to fix this
#corenet_tcp_connect_pki_tomcat_port(httpd_t)

# for crl publishing
allow pki_tomcat_t pki_tomcat_var_lib_t:lnk_file { rename create unlink };

# for ECC
auth_getattr_shadow(pki_tomcat_t)
optional_policy(`
        consoletype_exec(pki_tomcat_t)
')

optional_policy(`
        hostname_exec(pki_tomcat_t)
')

# old type aliases for migration
typealias pki_tomcat_t alias { pki_ca_t pki_kra_t pki_ocsp_t pki_tks_t };
typealias pki_tomcat_etc_rw_t alias { pki_ca_etc_rw_t pki_kra_etc_rw_t pki_ocsp_etc_rw_t pki_tks_etc_rw_t };
typealias pki_tomcat_var_lib_t alias { pki_ca_var_lib_t pki_kra_var_lib_t pki_ocsp_var_lib_t pki_tks_var_lib_t };
typealias pki_tomcat_var_run_t alias { pki_ca_var_run_t pki_kra_var_run_t pki_ocsp_var_run_t pki_tks_var_run_t };
typealias pki_tomcat_log_t alias { pki_ca_log_t pki_kra_log_t pki_ocsp_log_t pki_tks_log_t };
# typealias http_port_t alias { pki_ca_port_t pki_kra_port_t pki_ocsp_port_t pki_tks_port_t };

##########################
#  TPS policy
##########################

attribute pki_tps_config;
attribute pki_tps_executable;
attribute pki_tps_var_lib;
attribute pki_tps_var_log;
attribute pki_tps_var_run;
attribute pki_tps_pidfiles;
attribute pki_tps_script;
attribute pki_tps_process;

type pki_tps_tomcat_exec_t;
files_type(pki_tps_tomcat_exec_t)

pki_apache_template(pki_tps)

# used to serve cgi web pages under /var/lib/pki-tps, formatting, enrollment
allow pki_tps_t pki_tps_var_lib_t:file {execute execute_no_trans};

corenet_tcp_bind_pki_tps_port(pki_tps_t)

# customer may run an ldap server on 389
corenet_tcp_connect_ldap_port(pki_tps_t)

# connect to other subsystems
corenet_tcp_connect_pki_ca_port(pki_tps_t)
corenet_tcp_connect_pki_kra_port(pki_tps_t)
corenet_tcp_connect_pki_tks_port(pki_tps_t)

files_exec_usr_files(pki_tps_t)
files_read_usr_symlinks(pki_tps_t)
files_read_usr_files(pki_tps_t)

# why do I need to add this?
allow httpd_t httpd_config_t:file execute;
files_exec_usr_files(httpd_t)

##########################
# RA policy
#########################

attribute pki_ra_config;
attribute pki_ra_executable;
attribute pki_ra_var_lib;
attribute pki_ra_var_log;
attribute pki_ra_var_run;
attribute pki_ra_pidfiles;
attribute pki_ra_script;
attribute pki_ra_process;

type pki_ra_tomcat_exec_t;
files_type(pki_ra_tomcat_exec_t)

pki_apache_template(pki_ra)

#RA specific? talking to mysql?
allow pki_ra_t self:udp_socket { write read create connect };
allow pki_ra_t self:unix_dgram_socket { write create connect };

corenet_tcp_bind_pki_ra_port(pki_ra_t)

# talk to other subsystems
corenet_tcp_connect_pki_ca_port(pki_ra_t)

files_exec_usr_files(pki_ra_t)
fs_getattr_xattr_fs(pki_ra_t)

corenet_tcp_connect_smtp_port(pki_ra_t)
files_search_spool(pki_ra_t)

#
# Should be changed to mta_send_mail
#
mta_manage_spool(pki_ra_t)
mta_manage_queue(pki_ra_t)
mta_read_config(pki_ra_t)
mta_sendmail_exec(pki_ra_t)