Move the compile and execute logic to standalone scripts
[gruntmaster-daemon.git] / selinux / gruntmasterd.te
CommitLineData
fe185d88
MG
1policy_module(gruntmasterd, 1.0)
2
da905f9e
MG
3define(`read_file_perms', `{ getattr ioctl read lock open }')
4define(`read_dir_perms', `{ getattr ioctl read lock open search}')
5define(`everything_file_perms', `{ getattr ioctl read lock open unlink setattr append write create rename link }')
6define(`everything_dir_perms', `{ getattr ioctl read lock open search unlink setattr write create rename link rmdir remove_name reparent add_name }')
7define(`domain_read_files', `allow $1 $2 : dir read_dir_perms; allow $1 $2 : file read_file_perms; allow $1 $2 : lnk_file read_file_perms;')
8define(`domain_everything_files', `allow $1 $2 : dir everything_dir_perms; allow $1 $2 : file everything_file_perms; allow $1 $2 : lnk_file everything_file_perms;')
9define(`gruntmaster_read', `domain_read_files(gruntmasterd_t, $1)')
10define(`gruntmaster_everything', `domain_everything_files(gruntmasterd_t, $1)')
fe185d88
MG
11
12require{
13 type bin_t;
14 type httpd_sys_content_rw_t;
15 type httpd_sys_content_t;
16 type httpd_t;
17 type httpd_tmp_t;
18 type proc_t;
19 type urandom_device_t;
20}
5c5cd38a 21
da905f9e 22# Types
5c5cd38a
MG
23type gruntmasterd_t;
24type gruntmasterd_exec_t;
5c5cd38a 25type gruntmasterd_log_t;
5c5cd38a
MG
26type gruntmaster_job_t;
27type gruntmaster_job_exec_t;
da905f9e
MG
28type gruntmaster_compile_t;
29type gruntmaster_compile_exec_t;
30
31domain_type(gruntmaster_job_t)
32domain_entry_file(gruntmaster_job_t, gruntmaster_job_exec_t)
33role system_r types gruntmaster_job_t;
fe185d88 34type_transition gruntmasterd_t gruntmaster_job_exec_t : process gruntmaster_job_t;
fe185d88 35
da905f9e
MG
36domain_type(gruntmaster_compile_t)
37domain_entry_file(gruntmaster_compile_t, gruntmaster_compile_exec_t)
38role system_r types gruntmaster_compile_t;
39type_transition gruntmasterd_t gruntmaster_compile_exec_t : process gruntmaster_compile_t;
40type_transition gruntmaster_compile_t httpd_tmp_t : file gruntmaster_job_exec_t;
fe185d88 41
da905f9e
MG
42init_daemon_domain(gruntmasterd_t, gruntmasterd_exec_t)
43logging_log_file(gruntmasterd_log_t)
44logging_log_filetrans(gruntmasterd_t, gruntmasterd_log_t, file)
45logging_search_logs(gruntmasterd_t)
46
47# Daemon permissions
48allow gruntmasterd_t { gruntmaster_compile_t gruntmaster_job_t } : process { sigkill siginh rlimitinh transition };
49allow gruntmasterd_t bin_t : file { execute execute_no_trans };
50allow gruntmasterd_t self : process fork;
51allow gruntmasterd_t self:fifo_file everything_file_perms;
52allow gruntmasterd_t urandom_device_t:chr_file read_file_perms;
53allow gruntmasterd_t { gruntmaster_compile_exec_t gruntmaster_job_exec_t } : file execute;
54dontaudit gruntmasterd_t { gruntmaster_compile_t gruntmaster_job_t } : process noatsecure;
5c5cd38a 55
fe185d88 56gruntmaster_read(bin_t)
da905f9e
MG
57gruntmaster_read(gruntmaster_compile_exec_t)
58gruntmaster_read(httpd_sys_content_t)
fe185d88 59gruntmaster_read(lib_t)
da905f9e 60gruntmaster_read(proc_t)
fe185d88 61gruntmaster_read(usr_t)
fe185d88 62
fe185d88 63gruntmaster_everything(gruntmaster_job_exec_t)
da905f9e 64gruntmaster_everything(gruntmasterd_log_t)
fe185d88
MG
65gruntmaster_everything(httpd_sys_content_rw_t)
66gruntmaster_everything(httpd_tmp_t)
67gruntmaster_everything(tmp_t)
68
da905f9e
MG
69files_read_etc_files(gruntmasterd_t)
70files_search_etc(gruntmasterd_t)
71libs_use_ld_so(gruntmasterd_t)
72libs_use_shared_libs(gruntmasterd_t)
73miscfiles_read_localization(gruntmasterd_t)
5c5cd38a 74
da905f9e
MG
75# Executor and job permissions
76domain_read_files(gruntmaster_job_t, bin_t)
77domain_read_files(gruntmaster_job_t, usr_t)
78allow gruntmaster_job_t gruntmaster_job_exec_t : file { execute execute_no_trans };
79allow gruntmaster_job_t gruntmasterd_t:fd use;
80allow gruntmaster_job_t gruntmasterd_t:process sigchld;
81allow gruntmaster_job_t httpd_tmp_t : dir read_dir_perms;
82allow gruntmaster_job_t httpd_tmp_t : file { getattr ioctl read write };
83allow gruntmaster_job_t init_t:fd use;
84allow gruntmaster_job_t self:process setrlimit;
85allow gruntmaster_job_t urandom_device_t:chr_file read_file_perms;
5c5cd38a 86
fe185d88 87libs_use_ld_so(gruntmaster_job_t)
fe185d88 88libs_use_shared_libs(gruntmaster_job_t)
fe185d88
MG
89miscfiles_read_localization(gruntmaster_job_t)
90
da905f9e
MG
91# Compile permissions
92domain_everything_files(gruntmaster_compile_t, gruntmaster_job_exec_t)
93domain_everything_files(gruntmaster_compile_t, tmp_t)
94domain_read_files(gruntmaster_compile_t, bin_t)
95domain_read_files(gruntmaster_compile_t, httpd_sys_content_rw_t)
96domain_read_files(gruntmaster_compile_t, httpd_tmp_t)
97domain_read_files(gruntmaster_compile_t, lib_t)
98domain_read_files(gruntmaster_compile_t, proc_t)
99domain_read_files(gruntmaster_compile_t, proc_t)
100domain_read_files(gruntmaster_compile_t, usr_t)
101allow gruntmaster_compile_t gruntmasterd_t : fifo_file { read write ioctl };
102allow gruntmaster_compile_t gruntmasterd_t:fd use;
103allow gruntmaster_compile_t gruntmasterd_t:process sigchld;
104allow gruntmaster_compile_t httpd_tmp_t:dir { write add_name };
105allow gruntmaster_compile_t self : fifo_file { read write ioctl };
106allow gruntmaster_compile_t self:process signal;
107allow gruntmaster_compile_t urandom_device_t:chr_file read_file_perms;
108allow gruntmaster_compile_t { bin_t lib_t } : file { execute execute_no_trans };
109
110libs_use_ld_so(gruntmaster_compile_t)
111libs_use_shared_libs(gruntmaster_compile_t)
112miscfiles_read_localization(gruntmaster_compile_t)
This page took 0.018833 seconds and 4 git commands to generate.