1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
--- services/puppet.te 2010-08-03 15:11:07.000000000 +0200
+++ services/puppet.te 2011-07-11 22:40:28.700001278 +0200
@@ -17,6 +17,9 @@
type puppet_exec_t;
init_daemon_domain(puppet_t, puppet_exec_t)
+type puppet_initrc_notrans_t;
+role system_r types puppet_initrc_notrans_t;
+
type puppet_etc_t;
files_config_file(puppet_etc_t)
@@ -77,7 +80,9 @@
files_tmp_filetrans(puppet_t, puppet_tmp_t, { file dir })
kernel_dontaudit_search_sysctl(puppet_t)
-kernel_dontaudit_search_kernel_sysctl(puppet_t)
+#kernel_dontaudit_search_kernel_sysctl(puppet_t)
+kernel_read_kernel_sysctls(puppet_t)
+kernel_read_network_state(puppet_t)
kernel_read_system_state(puppet_t)
kernel_read_crypto_sysctls(puppet_t)
@@ -115,6 +120,9 @@
term_dontaudit_getattr_unallocated_ttys(puppet_t)
term_dontaudit_getattr_all_ttys(puppet_t)
+
+## system modules
+
init_all_labeled_script_domtrans(puppet_t)
init_domtrans_script(puppet_t)
init_read_utmp(puppet_t)
@@ -125,12 +133,26 @@
miscfiles_read_hwdata(puppet_t)
miscfiles_read_localization(puppet_t)
+mount_domtrans(puppet_t)
+
seutil_domtrans_setfiles(puppet_t)
seutil_domtrans_semanage(puppet_t)
sysnet_dns_name_resolve(puppet_t)
sysnet_run_ifconfig(puppet_t, system_r)
+## Other modules
+
+
+usermanage_domtrans_passwd(puppet_t)
+
+tunable_policy(`gentoo_try_dontaudit',`
+ dontaudit puppet_t self:capability dac_read_search;
+ kernel_dontaudit_read_system_state(puppet_initrc_notrans_t)
+ userdom_dontaudit_use_user_terminals(puppet_t)
+')
+
+
tunable_policy(`puppet_manage_all_files',`
auth_manage_all_files_except_shadow(puppet_t)
')
@@ -144,6 +166,16 @@
')
optional_policy(`
+ mta_send_mail(puppet_t)
+')
+
+optional_policy(`
+ gentoo_init_initrc_notrans(puppet_initrc_notrans_t, puppet_t)
+ portage_domtrans(puppet_t)
+ puppet_rw_tmp(puppet_initrc_notrans_t)
+')
+
+optional_policy(`
files_rw_var_files(puppet_t)
rpm_domtrans(puppet_t)
--- services/puppet.fc 2010-08-03 15:11:07.000000000 +0200
+++ services/puppet.fc 2011-07-11 14:06:20.907000356 +0200
@@ -3,7 +3,9 @@
/etc/rc\.d/init\.d/puppet -- gen_context(system_u:object_r:puppet_initrc_exec_t,s0)
/etc/rc\.d/init\.d/puppetmaster -- gen_context(system_u:object_r:puppetmaster_initrc_exec_t,s0)
+/usr/bin/puppetd -- gen_context(system_u:object_r:puppet_exec_t,s0)
/usr/sbin/puppetd -- gen_context(system_u:object_r:puppet_exec_t,s0)
+/usr/bin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t,s0)
/usr/sbin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t,s0)
/var/lib/puppet(/.*)? gen_context(system_u:object_r:puppet_var_lib_t,s0)
|
GitWeb