1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
--- services/puppet.te 2010-08-03 15:11:07.000000000 +0200
+++ services/puppet.te 2011-07-21 11:15:55.552000371 +0200
@@ -17,6 +17,9 @@
type puppet_exec_t;
init_daemon_domain(puppet_t, puppet_exec_t)
+#type puppet_initrc_notrans_t;
+#role system_r types puppet_initrc_notrans_t;
+
type puppet_etc_t;
files_config_file(puppet_etc_t)
@@ -50,7 +53,7 @@
# Puppet personal policy
#
-allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_ptrace sys_tty_config };
+allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_ptrace sys_tty_config chown };
allow puppet_t self:process { signal signull getsched setsched };
allow puppet_t self:fifo_file rw_fifo_file_perms;
allow puppet_t self:netlink_route_socket create_netlink_socket_perms;
@@ -77,7 +80,9 @@
files_tmp_filetrans(puppet_t, puppet_tmp_t, { file dir })
kernel_dontaudit_search_sysctl(puppet_t)
-kernel_dontaudit_search_kernel_sysctl(puppet_t)
+#kernel_dontaudit_search_kernel_sysctl(puppet_t)
+kernel_read_kernel_sysctls(puppet_t)
+kernel_read_network_state(puppet_t)
kernel_read_system_state(puppet_t)
kernel_read_crypto_sysctls(puppet_t)
@@ -115,6 +120,9 @@
term_dontaudit_getattr_unallocated_ttys(puppet_t)
term_dontaudit_getattr_all_ttys(puppet_t)
+
+## system modules
+
init_all_labeled_script_domtrans(puppet_t)
init_domtrans_script(puppet_t)
init_read_utmp(puppet_t)
@@ -125,12 +133,26 @@
miscfiles_read_hwdata(puppet_t)
miscfiles_read_localization(puppet_t)
+mount_domtrans(puppet_t)
+
seutil_domtrans_setfiles(puppet_t)
seutil_domtrans_semanage(puppet_t)
sysnet_dns_name_resolve(puppet_t)
sysnet_run_ifconfig(puppet_t, system_r)
+## Other modules
+
+
+usermanage_domtrans_passwd(puppet_t)
+
+tunable_policy(`gentoo_try_dontaudit',`
+ dontaudit puppet_t self:capability dac_read_search;
+ #kernel_dontaudit_read_system_state(puppet_initrc_notrans_t)
+ userdom_dontaudit_use_user_terminals(puppet_t)
+')
+
+
tunable_policy(`puppet_manage_all_files',`
auth_manage_all_files_except_shadow(puppet_t)
')
@@ -144,6 +166,15 @@
')
optional_policy(`
+ mta_send_mail(puppet_t)
+')
+
+optional_policy(`
+ gentoo_init_rc_exec(puppet_t)
+ portage_domtrans(puppet_t)
+')
+
+optional_policy(`
files_rw_var_files(puppet_t)
rpm_domtrans(puppet_t)
--- services/puppet.fc 2010-08-03 15:11:07.000000000 +0200
+++ services/puppet.fc 2011-07-21 10:08:43.240000256 +0200
@@ -3,7 +3,9 @@
/etc/rc\.d/init\.d/puppet -- gen_context(system_u:object_r:puppet_initrc_exec_t,s0)
/etc/rc\.d/init\.d/puppetmaster -- gen_context(system_u:object_r:puppetmaster_initrc_exec_t,s0)
+/usr/bin/puppetd -- gen_context(system_u:object_r:puppet_exec_t,s0)
/usr/sbin/puppetd -- gen_context(system_u:object_r:puppet_exec_t,s0)
+/usr/bin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t,s0)
/usr/sbin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t,s0)
/var/lib/puppet(/.*)? gen_context(system_u:object_r:puppet_var_lib_t,s0)
|
GitWeb