generated from demus/selinux-rpm-template
Change domain to ntfy since that is the executable name
Build and provide rpm of ntfysh / rpmbuild (release) Successful in 1m1s
Build and provide rpm of ntfysh / rpmbuild (release) Successful in 1m1s
This commit is contained in:
@@ -1,4 +1,4 @@
|
||||
TARGET?=ntfysh
|
||||
TARGET?=ntfy
|
||||
MODULES?=${TARGET:=.pp.bz2}
|
||||
SHAREDIR?=/usr/share
|
||||
SELINUXTYPE?=targeted
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
/usr/bin/ntfy -- gen_context(system_u:object_r:ntfy_exec_t,s0)
|
||||
|
||||
/var/lib/ntfy(/.*)? gen_context(system_u:object_r:ntfy_var_lib_t,s0)
|
||||
+33
-33
@@ -1,8 +1,8 @@
|
||||
## <summary>policy for ntfysh</summary>
|
||||
## <summary>policy for ntfy</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute ntfysh_exec_t in the ntfysh domain.
|
||||
## Execute ntfy_exec_t in the ntfy domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -10,18 +10,18 @@
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ntfysh_domtrans',`
|
||||
interface(`ntfy_domtrans',`
|
||||
gen_require(`
|
||||
type ntfysh_t, ntfysh_exec_t;
|
||||
type ntfy_t, ntfy_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, ntfysh_exec_t, ntfysh_t)
|
||||
domtrans_pattern($1, ntfy_exec_t, ntfy_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Execute ntfysh in the caller domain.
|
||||
## Execute ntfy in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -29,18 +29,18 @@ interface(`ntfysh_domtrans',`
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ntfysh_exec',`
|
||||
interface(`ntfy_exec',`
|
||||
gen_require(`
|
||||
type ntfysh_exec_t;
|
||||
type ntfy_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, ntfysh_exec_t)
|
||||
can_exec($1, ntfy_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search ntfysh lib directories.
|
||||
## Search ntfy lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -48,18 +48,18 @@ interface(`ntfysh_exec',`
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ntfysh_search_lib',`
|
||||
interface(`ntfy_search_lib',`
|
||||
gen_require(`
|
||||
type ntfysh_var_lib_t;
|
||||
type ntfy_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 ntfysh_var_lib_t:dir search_dir_perms;
|
||||
allow $1 ntfy_var_lib_t:dir search_dir_perms;
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read ntfysh lib files.
|
||||
## Read ntfy lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -67,18 +67,18 @@ interface(`ntfysh_search_lib',`
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ntfysh_read_lib_files',`
|
||||
interface(`ntfy_read_lib_files',`
|
||||
gen_require(`
|
||||
type ntfysh_var_lib_t;
|
||||
type ntfy_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
read_files_pattern($1, ntfysh_var_lib_t, ntfysh_var_lib_t)
|
||||
read_files_pattern($1, ntfy_var_lib_t, ntfy_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage ntfysh lib files.
|
||||
## Manage ntfy lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -86,18 +86,18 @@ interface(`ntfysh_read_lib_files',`
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ntfysh_manage_lib_files',`
|
||||
interface(`ntfy_manage_lib_files',`
|
||||
gen_require(`
|
||||
type ntfysh_var_lib_t;
|
||||
type ntfy_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_files_pattern($1, ntfysh_var_lib_t, ntfysh_var_lib_t)
|
||||
manage_files_pattern($1, ntfy_var_lib_t, ntfy_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage ntfysh lib directories.
|
||||
## Manage ntfy lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -105,20 +105,20 @@ interface(`ntfysh_manage_lib_files',`
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ntfysh_manage_lib_dirs',`
|
||||
interface(`ntfy_manage_lib_dirs',`
|
||||
gen_require(`
|
||||
type ntfysh_var_lib_t;
|
||||
type ntfy_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_dirs_pattern($1, ntfysh_var_lib_t, ntfysh_var_lib_t)
|
||||
manage_dirs_pattern($1, ntfy_var_lib_t, ntfy_var_lib_t)
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an ntfysh environment
|
||||
## an ntfy environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -132,21 +132,21 @@ interface(`ntfysh_manage_lib_dirs',`
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`ntfysh_admin',`
|
||||
interface(`ntfy_admin',`
|
||||
gen_require(`
|
||||
type ntfysh_t;
|
||||
type ntfysh_var_lib_t;
|
||||
type ntfy_t;
|
||||
type ntfy_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 ntfysh_t:process { signal_perms };
|
||||
ps_process_pattern($1, ntfysh_t)
|
||||
allow $1 ntfy_t:process { signal_perms };
|
||||
ps_process_pattern($1, ntfy_t)
|
||||
|
||||
tunable_policy(`deny_ptrace',`',`
|
||||
allow $1 ntfysh_t:process ptrace;
|
||||
allow $1 ntfy_t:process ptrace;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
admin_pattern($1, ntfysh_var_lib_t)
|
||||
admin_pattern($1, ntfy_var_lib_t)
|
||||
optional_policy(`
|
||||
systemd_passwd_agent_exec($1)
|
||||
systemd_read_fifo_file_passwd_run($1)
|
||||
@@ -0,0 +1,71 @@
|
||||
policy_module(ntfy, 2.14.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type ntfy_t;
|
||||
type ntfy_exec_t;
|
||||
type ntfy_cache_t;
|
||||
inetd_service_domain(ntfy_t, ntfy_exec_t)
|
||||
|
||||
permissive ntfy_t;
|
||||
|
||||
type ntfy_var_lib_t;
|
||||
files_type(ntfy_var_lib_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# ntfy local policy
|
||||
#
|
||||
|
||||
|
||||
manage_dirs_pattern(ntfy_t, ntfy_var_lib_t, ntfy_var_lib_t)
|
||||
manage_files_pattern(ntfy_t, ntfy_var_lib_t, ntfy_var_lib_t)
|
||||
manage_lnk_files_pattern(ntfy_t, ntfy_var_lib_t, ntfy_var_lib_t)
|
||||
files_var_lib_filetrans(ntfy_t, ntfy_var_lib_t, { dir file lnk_file })
|
||||
|
||||
domain_use_interactive_fds(ntfy_t)
|
||||
|
||||
files_read_etc_files(ntfy_t)
|
||||
|
||||
miscfiles_read_localization(ntfy_t)
|
||||
|
||||
require {
|
||||
type ntfy_t;
|
||||
type httpd_t;
|
||||
type http_port_t;
|
||||
class tcp_socket { accept bind create getattr listen setopt };
|
||||
class udp_socket { connect create getattr setopt };
|
||||
class capability net_bind_service;
|
||||
}
|
||||
|
||||
#============= ntfy_t ==============
|
||||
allow ntfy_t self:capability { net_bind_service net_admin sys_module };
|
||||
allow ntfy_t self:tcp_socket { accept bind create getattr listen setopt read write };
|
||||
|
||||
allow ntfy_t self:udp_socket { connect create getattr setopt listen };
|
||||
allow ntfy_t auth_cache_t:file { create getattr open read unlink write };
|
||||
allow ntfy_t http_port_t:tcp_socket name_bind;
|
||||
allow ntfy_t init_t:unix_stream_socket write;
|
||||
allow ntfy_t ntfy_var_lib_t:sock_file { create setattr unlink };
|
||||
|
||||
corecmd_exec_bin(ntfy_t)
|
||||
corecmd_mmap_bin_files(ntfy_t)
|
||||
corenet_tcp_bind_generic_node(ntfy_t)
|
||||
corenet_tcp_bind_reserved_port(ntfy_t)
|
||||
dev_read_sysfs(ntfy_t)
|
||||
files_list_isid_type_dirs(ntfy_t)
|
||||
kernel_read_net_sysctls(ntfy_t)
|
||||
kernel_rw_unlabeled_files(ntfy_t)
|
||||
kernel_search_network_sysctl(ntfy_t)
|
||||
sysnet_read_config(ntfy_t)
|
||||
|
||||
auth_var_filetrans_cache(ntfy_t)
|
||||
files_manage_var_files(ntfy_t)
|
||||
auth_manage_cache(ntfy_t)
|
||||
|
||||
#============= httpd_t ==============
|
||||
allow httpd_t ntfy_t:unix_stream_socket connectto;
|
||||
allow httpd_t ntfy_var_lib_t:sock_file write;
|
||||
+5
-6
@@ -1,6 +1,6 @@
|
||||
# defining macros needed by SELinux
|
||||
%global selinuxtype targeted
|
||||
%global modulename ntfysh
|
||||
%global modulename ntfy
|
||||
|
||||
Name: ntfysh-selinux
|
||||
Version: 2.14.0
|
||||
@@ -8,9 +8,9 @@ Release: %autorelease
|
||||
License: GPLv3
|
||||
URL: https://git.demus.dk/demus/ntfysh-selinux-rpm
|
||||
Summary: SELinux policy for ntfysh
|
||||
Source0: ntfysh.fc
|
||||
Source1: ntfysh.if
|
||||
Source2: ntfysh.te
|
||||
Source0: %{modulename}.fc
|
||||
Source1: %{modulename}.if
|
||||
Source2: %{modulename}.te
|
||||
Source3: makefile
|
||||
Source4: LICENSE
|
||||
Source5: README.md
|
||||
@@ -19,8 +19,7 @@ Requires: selinux-policy-%{selinuxtype}
|
||||
Requires: ntfysh
|
||||
Requires(post): selinux-policy-%{selinuxtype}
|
||||
BuildRequires: selinux-policy-devel
|
||||
Obsoletes: ntfy_selinux <= %version
|
||||
Obsoletes: ntfysh_selinux <= %version
|
||||
Obsoletes: %{modulename}_selinux <= %version
|
||||
BuildArch: noarch
|
||||
%{?selinux_requires}
|
||||
%description
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
/usr/bin/ntfy -- gen_context(system_u:object_r:ntfysh_exec_t,s0)
|
||||
|
||||
/var/lib/ntfy(/.*)? gen_context(system_u:object_r:ntfysh_var_lib_t,s0)
|
||||
@@ -1,71 +0,0 @@
|
||||
policy_module(ntfysh, 2.14.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type ntfysh_t;
|
||||
type ntfysh_exec_t;
|
||||
type ntfysh_cache_t;
|
||||
inetd_service_domain(ntfysh_t, ntfysh_exec_t)
|
||||
|
||||
permissive ntfysh_t;
|
||||
|
||||
type ntfysh_var_lib_t;
|
||||
files_type(ntfysh_var_lib_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# ntfysh local policy
|
||||
#
|
||||
|
||||
|
||||
manage_dirs_pattern(ntfysh_t, ntfysh_var_lib_t, ntfysh_var_lib_t)
|
||||
manage_files_pattern(ntfysh_t, ntfysh_var_lib_t, ntfysh_var_lib_t)
|
||||
manage_lnk_files_pattern(ntfysh_t, ntfysh_var_lib_t, ntfysh_var_lib_t)
|
||||
files_var_lib_filetrans(ntfysh_t, ntfysh_var_lib_t, { dir file lnk_file })
|
||||
|
||||
domain_use_interactive_fds(ntfysh_t)
|
||||
|
||||
files_read_etc_files(ntfysh_t)
|
||||
|
||||
miscfiles_read_localization(ntfysh_t)
|
||||
|
||||
require {
|
||||
type ntfysh_t;
|
||||
type httpd_t;
|
||||
type http_port_t;
|
||||
class tcp_socket { accept bind create getattr listen setopt };
|
||||
class udp_socket { connect create getattr setopt };
|
||||
class capability net_bind_service;
|
||||
}
|
||||
|
||||
#============= ntfysh_t ==============
|
||||
allow ntfysh_t self:capability { net_bind_service net_admin sys_module };
|
||||
allow ntfysh_t self:tcp_socket { accept bind create getattr listen setopt read write };
|
||||
|
||||
allow ntfysh_t self:udp_socket { connect create getattr setopt listen };
|
||||
allow ntfysh_t auth_cache_t:file { create getattr open read unlink write };
|
||||
allow ntfysh_t http_port_t:tcp_socket name_bind;
|
||||
allow ntfysh_t init_t:unix_stream_socket write;
|
||||
allow ntfysh_t ntfysh_var_lib_t:sock_file { create setattr unlink };
|
||||
|
||||
corecmd_exec_bin(ntfysh_t)
|
||||
corecmd_mmap_bin_files(ntfysh_t)
|
||||
corenet_tcp_bind_generic_node(ntfysh_t)
|
||||
corenet_tcp_bind_reserved_port(ntfysh_t)
|
||||
dev_read_sysfs(ntfysh_t)
|
||||
files_list_isid_type_dirs(ntfysh_t)
|
||||
kernel_read_net_sysctls(ntfysh_t)
|
||||
kernel_rw_unlabeled_files(ntfysh_t)
|
||||
kernel_search_network_sysctl(ntfysh_t)
|
||||
sysnet_read_config(ntfysh_t)
|
||||
|
||||
auth_var_filetrans_cache(ntfysh_t)
|
||||
files_manage_var_files(ntfysh_t)
|
||||
auth_manage_cache(ntfysh_t)
|
||||
|
||||
#============= httpd_t ==============
|
||||
allow httpd_t ntfysh_t:unix_stream_socket connectto;
|
||||
allow httpd_t ntfysh_var_lib_t:sock_file write;
|
||||
Reference in New Issue
Block a user