You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

212 lines
6.4 KiB

diff --git a/certmonger.te b/certmonger.te
index 0803529e4a..0585431e14 100644
--- a/certmonger.te
+++ b/certmonger.te
@@ -144,6 +144,7 @@ optional_policy(`
optional_policy(`
pki_rw_tomcat_cert(certmonger_t)
pki_read_tomcat_lib_files(certmonger_t)
+ pki_tomcat_systemctl(certmonger_t)
')
optional_policy(`
diff --git a/keepalived.te b/keepalived.te
index c4f0c3237b..4b5c0e4ecf 100644
--- a/keepalived.te
+++ b/keepalived.te
@@ -24,7 +24,7 @@ application_executable_file(keepalived_unconfined_script_exec_t)
#
allow keepalived_t self:capability { net_admin net_raw kill };
-allow keepalived_t self:process { signal_perms };
+allow keepalived_t self:process { signal_perms setpgid };
allow keepalived_t self:netlink_socket create_socket_perms;
allow keepalived_t self:netlink_generic_socket create_socket_perms;
allow keepalived_t self:netlink_netfilter_socket create_socket_perms;
diff --git a/lldpad.te b/lldpad.te
index 42e5578f22..3399d597a8 100644
--- a/lldpad.te
+++ b/lldpad.te
@@ -64,3 +64,7 @@ optional_policy(`
optional_policy(`
networkmanager_dgram_send(lldpad_t)
')
+
+optional_policy(`
+ virt_dgram_send(lldpad_t)
+')
diff --git a/openvswitch.te b/openvswitch.te
index d37f970208..1dc8a63a6b 100644
--- a/openvswitch.te
+++ b/openvswitch.te
@@ -32,7 +32,7 @@ systemd_unit_file(openvswitch_unit_file_t)
# openvswitch local policy
#
-allow openvswitch_t self:capability { net_admin ipc_lock sys_module sys_nice sys_rawio sys_resource chown setgid setpcap setuid };
+allow openvswitch_t self:capability { dac_override net_admin ipc_lock sys_module sys_nice sys_rawio sys_resource chown setgid setpcap setuid kill };
allow openvswitch_t self:capability2 block_suspend;
allow openvswitch_t self:process { fork setsched setrlimit signal setcap };
allow openvswitch_t self:fifo_file rw_fifo_file_perms;
@@ -41,6 +41,7 @@ allow openvswitch_t self:tcp_socket create_stream_socket_perms;
allow openvswitch_t self:netlink_socket create_socket_perms;
allow openvswitch_t self:netlink_route_socket rw_netlink_socket_perms;
allow openvswitch_t self:netlink_generic_socket create_socket_perms;
+allow openvswitch_t self:tun_socket { create_socket_perms relabelfrom relabelto };
can_exec(openvswitch_t, openvswitch_exec_t)
@@ -69,6 +70,7 @@ manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_
manage_lnk_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
files_pid_filetrans(openvswitch_t, openvswitch_var_run_t, { dir file lnk_file sock_file })
+kernel_load_module(openvswitch_t)
kernel_read_network_state(openvswitch_t)
kernel_read_system_state(openvswitch_t)
kernel_request_load_module(openvswitch_t)
@@ -87,6 +89,8 @@ corecmd_exec_shell(openvswitch_t)
dev_read_rand(openvswitch_t)
dev_read_urand(openvswitch_t)
dev_read_sysfs(openvswitch_t)
+dev_rw_vfio_dev(openvswitch_t)
+corenet_rw_tun_tap_dev(openvswitch_t)
domain_use_interactive_fds(openvswitch_t)
@@ -111,6 +115,10 @@ modutils_read_module_deps(openvswitch_t)
sysnet_dns_name_resolve(openvswitch_t)
+logging_send_audit_msgs(openvswitch_t)
+
+write_sock_files_pattern(init_t, openvswitch_var_run_t, openvswitch_var_run_t)
+
optional_policy(`
hostname_exec(openvswitch_t)
')
diff --git a/pki.if b/pki.if
index f18fcc68fc..f69ae02984 100644
--- a/pki.if
+++ b/pki.if
@@ -477,3 +477,27 @@ interface(`pki_stream_connect',`
files_search_pids($1)
stream_connect_pattern($1, pki_common_t, pki_common_t, pki_tomcat_t)
')
+
+########################################
+## <summary>
+## Execute pki in the pkit_tomcat_t domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`pki_tomcat_systemctl',`
+ gen_require(`
+ type pki_tomcat_t;
+ type pki_tomcat_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ systemd_read_fifo_file_passwd_run($1)
+ allow $1 pki_tomcat_unit_file_t:file read_file_perms;
+ allow $1 pki_tomcat_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, pki_tomcat_t)
+')
diff --git a/rhcs.if b/rhcs.if
index 59e5d7e3b7..145d67f2a0 100644
--- a/rhcs.if
+++ b/rhcs.if
@@ -957,3 +957,22 @@ interface(`rhcs_start_haproxy_services',`
systemd_exec_systemctl($1)
allow $1 haproxy_unit_file_t:service {status start};
')
+
+########################################
+## <summary>
+## Create log files with a named file
+## type transition.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`rhcs_named_filetrans_log_dir',`
+ gen_require(`
+ type var_log_t;
+ ')
+
+ logging_log_named_filetrans($1, var_log_t, dir, "bundles")
+')
diff --git a/rhcs.te b/rhcs.te
index a95c73dc7e..a5aec03a82 100644
--- a/rhcs.te
+++ b/rhcs.te
@@ -319,6 +319,10 @@ optional_policy(`
ricci_dontaudit_rw_modcluster_pipes(cluster_t)
')
+optional_policy(`
+ rhcs_named_filetrans_log_dir(cluster_t)
+')
+
optional_policy(`
rpc_systemctl_nfsd(cluster_t)
rpc_systemctl_rpcd(cluster_t)
diff --git a/tomcat.te b/tomcat.te
index 97bdd60c90..e35ae6b3d9 100644
--- a/tomcat.te
+++ b/tomcat.te
@@ -51,6 +51,9 @@ optional_policy(`
# tomcat domain policy
#
+allow tomcat_t self:capability { dac_override setuid kill };
+
+allow tomcat_t self:process { setcap signal signull };
allow tomcat_domain self:fifo_file rw_fifo_file_perms;
allow tomcat_domain self:unix_stream_socket create_stream_socket_perms;
@@ -82,6 +85,7 @@ corenet_tcp_connect_amqp_port(tomcat_domain)
corenet_tcp_connect_oracle_port(tomcat_domain)
corenet_tcp_connect_ibm_dt_2_port(tomcat_domain)
corenet_tcp_connect_unreserved_ports(tomcat_domain)
+corenet_tcp_connect_mssql_port(tomcat_domain)
dev_read_rand(tomcat_domain)
dev_read_urand(tomcat_domain)
diff --git a/virt.if b/virt.if
index 1d17889f38..c6792a5a37 100644
--- a/virt.if
+++ b/virt.if
@@ -1618,4 +1618,23 @@ interface(`virt_dontaudit_read_state',`
dontaudit $1 virtd_t:dir search_dir_perms;
dontaudit $1 virtd_t:file read_file_perms;
dontaudit $1 virtd_t:lnk_file read_lnk_file_perms;
+')
+
+#######################################
+## <summary>
+## Send to libvirt with a unix dgram socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`virt_dgram_send',`
+ gen_require(`
+ type virtd_t, virt_var_run_t;
+ ')
+
+ files_search_pids($1)
+ dgram_send_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
')
\ No newline at end of file