|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
dc1920b |
policy_module(apache, 1.10.1)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
# NOTES:
|
|
Chris PeBenito |
a996bdf |
# This policy will work with SUEXEC enabled as part of the Apache
|
|
Chris PeBenito |
a996bdf |
# configuration. However, the user CGI scripts will run under the
|
|
Chris PeBenito |
a996bdf |
# system_u:system_r:httpd_$1_script_t domain where $1 is the domain of the
|
|
Chris PeBenito |
a996bdf |
# of the creating user.
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
# The user CGI scripts must be labeled with the httpd_$1_script_exec_t
|
|
Chris PeBenito |
a996bdf |
# type, and the directory containing the scripts should also be labeled
|
|
Chris PeBenito |
a996bdf |
# with these types. This policy allows user_r role to perform that
|
|
Chris PeBenito |
a996bdf |
# relabeling. If it is desired that only sysadm_r should be able to relabel
|
|
Chris PeBenito |
a996bdf |
# the user CGI scripts, then relabel rule for user_r should be removed.
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
########################################
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
# Declarations
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## Allow Apache to modify public files
|
|
Chris PeBenito |
dd9e1de |
## used for public file transfer services. Directories/Files must
|
|
Chris PeBenito |
dd9e1de |
## be labeled public_content_rw_t.
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(allow_httpd_anon_write, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## Allow Apache to use mod_auth_pam
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(allow_httpd_mod_auth_pam, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## Allow httpd to use built in scripting (usually php)
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(httpd_builtin_scripting, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
dd9e1de |
## Allow HTTPD scripts and modules to connect to the network using TCP.
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(httpd_can_network_connect, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
dd9e1de |
## Allow HTTPD scripts and modules to connect to databases over the network.
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
56e1b3d |
gen_tunable(httpd_can_network_connect_db, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## Allow httpd to act as a relay
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
56e1b3d |
gen_tunable(httpd_can_network_relay, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## Allow httpd cgi support
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(httpd_enable_cgi, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## Allow httpd to act as a FTP server by
|
|
Chris PeBenito |
56e1b3d |
## listening on the ftp port.
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(httpd_enable_ftp_server, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## Allow httpd to read home directories
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(httpd_enable_homedirs, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
dd9e1de |
## Allow HTTPD to run SSI executables in the same domain as system CGI scripts.
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(httpd_ssi_exec, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
dd9e1de |
## Unify HTTPD to communicate with the terminal.
|
|
Chris PeBenito |
dd9e1de |
## Needed for entering the passphrase for certificates at
|
|
Chris PeBenito |
dd9e1de |
## the terminal.
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(httpd_tty_comm, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
56e1b3d |
## <desc>
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
dd9e1de |
## Unify HTTPD handling of all content files.
|
|
Chris PeBenito |
56e1b3d |
##
|
|
Chris PeBenito |
56e1b3d |
## </desc>
|
|
Chris PeBenito |
0bfccda |
gen_tunable(httpd_unified, false)
|
|
Chris PeBenito |
56e1b3d |
|
|
Chris PeBenito |
a996bdf |
attribute httpdcontent;
|
|
Chris PeBenito |
a334d29 |
attribute httpd_user_content_type;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
e749cd1 |
# domains that can exec all users scripts
|
|
Chris PeBenito |
e749cd1 |
attribute httpd_exec_scripts;
|
|
Chris PeBenito |
e749cd1 |
|
|
Chris PeBenito |
123a990 |
attribute httpd_script_exec_type;
|
|
Chris PeBenito |
a334d29 |
attribute httpd_user_script_exec_type;
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
e749cd1 |
# user script domains
|
|
Chris PeBenito |
e749cd1 |
attribute httpd_script_domains;
|
|
Chris PeBenito |
e749cd1 |
|
|
Chris PeBenito |
a996bdf |
type httpd_t;
|
|
Chris PeBenito |
a996bdf |
type httpd_exec_t;
|
|
Chris PeBenito |
0bfccda |
init_daemon_domain(httpd_t, httpd_exec_t)
|
|
Chris PeBenito |
e749cd1 |
role system_r types httpd_t;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# httpd_cache_t is the type given to the /var/cache/httpd
|
|
Chris PeBenito |
a996bdf |
# directory and the files under that directory
|
|
Chris PeBenito |
a996bdf |
type httpd_cache_t;
|
|
Chris PeBenito |
a996bdf |
files_type(httpd_cache_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# httpd_config_t is the type given to the configuration files
|
|
Chris PeBenito |
a996bdf |
type httpd_config_t;
|
|
Chris PeBenito |
a996bdf |
files_type(httpd_config_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
type httpd_helper_t;
|
|
Chris PeBenito |
a996bdf |
type httpd_helper_exec_t;
|
|
Chris PeBenito |
e749cd1 |
domain_type(httpd_helper_t)
|
|
Chris PeBenito |
0bfccda |
domain_entry_file(httpd_helper_t, httpd_helper_exec_t)
|
|
Chris PeBenito |
e749cd1 |
role system_r types httpd_helper_t;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
type httpd_lock_t;
|
|
Chris PeBenito |
a996bdf |
files_lock_file(httpd_lock_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
type httpd_log_t;
|
|
Chris PeBenito |
a996bdf |
logging_log_file(httpd_log_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# httpd_modules_t is the type given to module files (libraries)
|
|
Chris PeBenito |
a996bdf |
# that come with Apache /etc/httpd/modules and /usr/lib/apache
|
|
Chris PeBenito |
a996bdf |
type httpd_modules_t;
|
|
Chris PeBenito |
a996bdf |
files_type(httpd_modules_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
type httpd_php_t;
|
|
Chris PeBenito |
a996bdf |
type httpd_php_exec_t;
|
|
Chris PeBenito |
e749cd1 |
domain_type(httpd_php_t)
|
|
Chris PeBenito |
0bfccda |
domain_entry_file(httpd_php_t, httpd_php_exec_t)
|
|
Chris PeBenito |
e749cd1 |
role system_r types httpd_php_t;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
type httpd_php_tmp_t;
|
|
Chris PeBenito |
a996bdf |
files_tmp_file(httpd_php_tmp_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
123a990 |
type httpd_rotatelogs_t;
|
|
Chris PeBenito |
123a990 |
type httpd_rotatelogs_exec_t;
|
|
Chris PeBenito |
123a990 |
init_daemon_domain(httpd_rotatelogs_t, httpd_rotatelogs_exec_t)
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
a996bdf |
type httpd_squirrelmail_t;
|
|
Chris PeBenito |
a996bdf |
files_type(httpd_squirrelmail_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# SUEXEC runs user scripts as their own user ID
|
|
Chris PeBenito |
a996bdf |
type httpd_suexec_t; #, daemon;
|
|
Chris PeBenito |
a996bdf |
type httpd_suexec_exec_t;
|
|
Chris PeBenito |
e749cd1 |
domain_type(httpd_suexec_t)
|
|
Chris PeBenito |
0bfccda |
domain_entry_file(httpd_suexec_t, httpd_suexec_exec_t)
|
|
Chris PeBenito |
e749cd1 |
role system_r types httpd_suexec_t;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
type httpd_suexec_tmp_t;
|
|
Chris PeBenito |
a996bdf |
files_tmp_file(httpd_suexec_tmp_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
c2b18fa |
# setup the system domain for system CGI scripts
|
|
Chris PeBenito |
c2b18fa |
apache_content_template(sys)
|
|
Chris PeBenito |
c2b18fa |
|
|
Chris PeBenito |
a996bdf |
type httpd_tmp_t;
|
|
Chris PeBenito |
a996bdf |
files_tmp_file(httpd_tmp_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
type httpd_tmpfs_t;
|
|
Chris PeBenito |
a996bdf |
files_tmpfs_file(httpd_tmpfs_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# for apache2 memory mapped files
|
|
Chris PeBenito |
a996bdf |
type httpd_var_lib_t;
|
|
Chris PeBenito |
a996bdf |
files_type(httpd_var_lib_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
type httpd_var_run_t;
|
|
Chris PeBenito |
a996bdf |
files_pid_file(httpd_var_run_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# File Type of squirrelmail attachments
|
|
Chris PeBenito |
a996bdf |
type squirrelmail_spool_t;
|
|
Chris PeBenito |
a996bdf |
files_tmp_file(squirrelmail_spool_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
2c24358 |
prelink_object_file(httpd_modules_t)
|
|
Chris PeBenito |
2c24358 |
')
|
|
Chris PeBenito |
2c24358 |
|
|
Chris PeBenito |
a996bdf |
########################################
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
# Apache server local policy
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
allow httpd_t self:capability { chown dac_override kill setgid setuid sys_tty_config };
|
|
Chris PeBenito |
a996bdf |
dontaudit httpd_t self:capability { net_admin sys_tty_config };
|
|
Chris PeBenito |
a996bdf |
allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
|
|
Chris PeBenito |
a996bdf |
allow httpd_t self:fd use;
|
|
Chris PeBenito |
c0868a7 |
allow httpd_t self:sock_file read_sock_file_perms;
|
|
Chris PeBenito |
c0868a7 |
allow httpd_t self:fifo_file rw_fifo_file_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_t self:shm create_shm_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_t self:sem create_sem_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_t self:msgq create_msgq_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_t self:msg { send receive };
|
|
Chris PeBenito |
e9a4084 |
allow httpd_t self:unix_dgram_socket { create_socket_perms sendto };
|
|
Chris PeBenito |
e9a4084 |
allow httpd_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
|
Chris PeBenito |
33c7e6b |
allow httpd_t self:tcp_socket create_stream_socket_perms;
|
|
Chris PeBenito |
e9a4084 |
allow httpd_t self:udp_socket create_socket_perms;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# Allow httpd_t to put files in /var/cache/httpd etc
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
|
|
Chris PeBenito |
0bfccda |
manage_lnk_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# Allow the httpd_t to read the web servers config files
|
|
Chris PeBenito |
c0868a7 |
allow httpd_t httpd_config_t:dir list_dir_perms;
|
|
Chris PeBenito |
0bfccda |
read_files_pattern(httpd_t, httpd_config_t, httpd_config_t)
|
|
Chris PeBenito |
0bfccda |
read_lnk_files_pattern(httpd_t, httpd_config_t, httpd_config_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
can_exec(httpd_t, httpd_exec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
c0868a7 |
allow httpd_t httpd_lock_t:file manage_file_perms;
|
|
Chris PeBenito |
0bfccda |
files_lock_filetrans(httpd_t, httpd_lock_t, file)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
c0868a7 |
allow httpd_t httpd_log_t:dir setattr;
|
|
Chris PeBenito |
0bfccda |
create_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
|
|
Chris PeBenito |
0bfccda |
append_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
|
|
Chris PeBenito |
0bfccda |
read_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
|
|
Chris PeBenito |
0bfccda |
read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
|
|
Chris PeBenito |
c2b18fa |
# cjp: need to refine create interfaces to
|
|
Chris PeBenito |
c2b18fa |
# cut this back to add_name only
|
|
Chris PeBenito |
0bfccda |
logging_log_filetrans(httpd_t, httpd_log_t, file)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
c0868a7 |
allow httpd_t httpd_modules_t:dir list_dir_perms;
|
|
Chris PeBenito |
0bfccda |
mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
|
|
Chris PeBenito |
0bfccda |
read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
d6d16b9 |
apache_domtrans_rotatelogs(httpd_t)
|
|
Chris PeBenito |
d6d16b9 |
# Apache-httpd needs to be able to send signals to the log rotate procs.
|
|
Chris PeBenito |
d6d16b9 |
allow httpd_t httpd_rotatelogs_t:process signal_perms;
|
|
Chris PeBenito |
d6d16b9 |
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
|
|
Chris PeBenito |
0bfccda |
manage_lnk_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
725926c |
allow httpd_t httpd_suexec_exec_t:file { getattr read };
|
|
Chris PeBenito |
725926c |
|
|
Chris PeBenito |
c0868a7 |
allow httpd_t httpd_sys_content_t:dir list_dir_perms;
|
|
Chris PeBenito |
0bfccda |
read_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
|
|
Chris PeBenito |
0bfccda |
read_lnk_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
|
|
Don Miner |
3d37bca |
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
|
|
Chris PeBenito |
103fe28 |
files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir })
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
|
|
Chris PeBenito |
0bfccda |
manage_lnk_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
|
|
Chris PeBenito |
0bfccda |
manage_fifo_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
|
|
Chris PeBenito |
0bfccda |
manage_sock_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
|
|
Chris PeBenito |
0bfccda |
fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
|
|
Chris PeBenito |
0bfccda |
files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
|
|
Chris PeBenito |
0bfccda |
manage_sock_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
|
|
Chris PeBenito |
0bfccda |
files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file })
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
|
|
Chris PeBenito |
0bfccda |
manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
445522d |
kernel_read_kernel_sysctls(httpd_t)
|
|
Chris PeBenito |
a996bdf |
# for modules that want to access /proc/meminfo
|
|
Chris PeBenito |
a996bdf |
kernel_read_system_state(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
1900668 |
corenet_all_recvfrom_unlabeled(httpd_t)
|
|
Chris PeBenito |
1900668 |
corenet_all_recvfrom_netlabel(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_sendrecv_all_if(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_udp_sendrecv_all_if(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_sendrecv_all_nodes(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_udp_sendrecv_all_nodes(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_sendrecv_all_ports(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_udp_sendrecv_all_ports(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_bind_all_nodes(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_bind_http_port(httpd_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_bind_http_cache_port(httpd_t)
|
|
Chris PeBenito |
968ace9 |
corenet_sendrecv_http_server_packets(httpd_t)
|
|
Chris PeBenito |
d6d16b9 |
# Signal self for shutdown
|
|
Chris PeBenito |
d6d16b9 |
corenet_tcp_connect_http_port(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
dev_read_sysfs(httpd_t)
|
|
Chris PeBenito |
a996bdf |
dev_read_rand(httpd_t)
|
|
Chris PeBenito |
a996bdf |
dev_read_urand(httpd_t)
|
|
Chris PeBenito |
c2b18fa |
dev_rw_crypto(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
fs_getattr_all_fs(httpd_t)
|
|
Chris PeBenito |
a996bdf |
fs_search_auto_mountpoints(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
77f6e2c |
auth_use_nsswitch(httpd_t)
|
|
Chris PeBenito |
77f6e2c |
|
|
Chris PeBenito |
a996bdf |
# execute perl
|
|
Chris PeBenito |
a996bdf |
corecmd_exec_bin(httpd_t)
|
|
Chris PeBenito |
d6d16b9 |
corecmd_exec_shell(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
15722ec |
domain_use_interactive_fds(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
files_read_usr_files(httpd_t)
|
|
Chris PeBenito |
a996bdf |
files_list_mnt(httpd_t)
|
|
Chris PeBenito |
a996bdf |
files_search_spool(httpd_t)
|
|
Chris PeBenito |
a996bdf |
files_read_var_lib_files(httpd_t)
|
|
Chris PeBenito |
a996bdf |
files_search_home(httpd_t)
|
|
Chris PeBenito |
a996bdf |
files_getattr_home_dir(httpd_t)
|
|
Chris PeBenito |
a996bdf |
# for modules that want to access /etc/mtab
|
|
Chris PeBenito |
a996bdf |
files_read_etc_runtime_files(httpd_t)
|
|
Chris PeBenito |
a996bdf |
# Allow httpd_t to have access to files such as nisswitch.conf
|
|
Chris PeBenito |
a996bdf |
files_read_etc_files(httpd_t)
|
|
Chris PeBenito |
6e99a6c |
# for tomcat
|
|
Chris PeBenito |
6e99a6c |
files_read_var_lib_symlinks(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
d6d16b9 |
fs_search_auto_mountpoints(httpd_sys_script_t)
|
|
Chris PeBenito |
d6d16b9 |
|
|
Chris PeBenito |
a996bdf |
libs_use_ld_so(httpd_t)
|
|
Chris PeBenito |
a996bdf |
libs_use_shared_libs(httpd_t)
|
|
Chris PeBenito |
1815bad |
libs_read_lib_files(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
logging_send_syslog_msg(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
miscfiles_read_localization(httpd_t)
|
|
Chris PeBenito |
a996bdf |
miscfiles_read_fonts(httpd_t)
|
|
Chris PeBenito |
6e99a6c |
miscfiles_read_public_files(httpd_t)
|
|
Chris PeBenito |
6e99a6c |
miscfiles_read_certs(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
seutil_dontaudit_search_config(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
103fe28 |
userdom_use_unpriv_users_fds(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
mta_send_mail(httpd_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
6e99a6c |
tunable_policy(`allow_httpd_anon_write',`
|
|
Chris PeBenito |
6e99a6c |
miscfiles_manage_public_files(httpd_t)
|
|
Chris PeBenito |
6e99a6c |
')
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
123a990 |
ifdef(`TODO', `
|
|
Chris PeBenito |
123a990 |
#
|
|
Chris PeBenito |
123a990 |
# We need optionals to be able to be within booleans to make this work
|
|
Chris PeBenito |
123a990 |
#
|
|
Chris PeBenito |
123a990 |
tunable_policy(`allow_httpd_mod_auth_pam',`
|
|
Chris PeBenito |
123a990 |
auth_domtrans_chk_passwd(httpd_t)
|
|
Chris PeBenito |
123a990 |
')
|
|
Chris PeBenito |
123a990 |
')
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
6e99a6c |
tunable_policy(`httpd_can_network_connect',`
|
|
Chris PeBenito |
6e99a6c |
corenet_tcp_connect_all_ports(httpd_t)
|
|
Chris PeBenito |
6e99a6c |
')
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
bb43724 |
tunable_policy(`httpd_can_network_relay',`
|
|
Chris PeBenito |
bb43724 |
# allow httpd to work as a relay
|
|
Chris PeBenito |
bb43724 |
corenet_tcp_connect_gopher_port(httpd_t)
|
|
Chris PeBenito |
bb43724 |
corenet_tcp_connect_ftp_port(httpd_t)
|
|
Chris PeBenito |
bb43724 |
corenet_tcp_connect_http_port(httpd_t)
|
|
Chris PeBenito |
bb43724 |
corenet_tcp_connect_http_cache_port(httpd_t)
|
|
Chris PeBenito |
141cffd |
corenet_sendrecv_gopher_client_packets(httpd_t)
|
|
Chris PeBenito |
141cffd |
corenet_sendrecv_ftp_client_packets(httpd_t)
|
|
Chris PeBenito |
141cffd |
corenet_sendrecv_http_client_packets(httpd_t)
|
|
Chris PeBenito |
141cffd |
corenet_sendrecv_http_cache_client_packets(httpd_t)
|
|
Chris PeBenito |
bb43724 |
')
|
|
Chris PeBenito |
bb43724 |
|
|
Chris PeBenito |
6e99a6c |
tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
|
|
Chris PeBenito |
c0868a7 |
domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_t, httpdcontent, httpdcontent)
|
|
Chris PeBenito |
0bfccda |
manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent)
|
|
Chris PeBenito |
6e99a6c |
')
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
bea7b45 |
tunable_policy(`httpd_enable_ftp_server',`
|
|
Chris PeBenito |
bea7b45 |
corenet_tcp_bind_ftp_port(httpd_t)
|
|
Chris PeBenito |
bea7b45 |
')
|
|
Chris PeBenito |
bea7b45 |
|
|
Chris PeBenito |
e311e23 |
tunable_policy(`httpd_enable_homedirs',`
|
|
Chris PeBenito |
e311e23 |
userdom_read_unpriv_users_home_content_files(httpd_t)
|
|
Chris PeBenito |
e311e23 |
')
|
|
Chris PeBenito |
e311e23 |
|
|
Chris PeBenito |
a996bdf |
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
|
|
Chris PeBenito |
a996bdf |
fs_read_nfs_files(httpd_t)
|
|
Chris PeBenito |
a996bdf |
fs_read_nfs_symlinks(httpd_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
|
Chris PeBenito |
a996bdf |
fs_read_cifs_files(httpd_t)
|
|
Chris PeBenito |
a996bdf |
fs_read_cifs_symlinks(httpd_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
e749cd1 |
tunable_policy(`httpd_ssi_exec',`
|
|
Chris PeBenito |
e749cd1 |
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
|
|
Chris PeBenito |
e749cd1 |
allow httpd_sys_script_t httpd_t:fd use;
|
|
Chris PeBenito |
e749cd1 |
allow httpd_sys_script_t httpd_t:fifo_file rw_file_perms;
|
|
Chris PeBenito |
e749cd1 |
allow httpd_sys_script_t httpd_t:process sigchld;
|
|
Chris PeBenito |
e749cd1 |
')
|
|
Chris PeBenito |
e749cd1 |
|
|
Chris PeBenito |
6e99a6c |
# When the admin starts the server, the server wants to access
|
|
Chris PeBenito |
6e99a6c |
# the TTY or PTY associated with the session. The httpd appears
|
|
Chris PeBenito |
6e99a6c |
# to run correctly without this permission, so the permission
|
|
Chris PeBenito |
6e99a6c |
# are dontaudited here.
|
|
Chris PeBenito |
6e99a6c |
tunable_policy(`httpd_tty_comm',`
|
|
Chris PeBenito |
9ca7e78 |
# cjp: this is redundant:
|
|
Chris PeBenito |
9ca7e78 |
term_use_controlling_term(httpd_t)
|
|
Chris PeBenito |
9ca7e78 |
|
|
Chris PeBenito |
e9c6cda |
sysadm_use_terms(httpd_t)
|
|
Chris PeBenito |
6e99a6c |
',`
|
|
Chris PeBenito |
e9c6cda |
sysadm_dontaudit_use_terms(httpd_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
99c902f |
calamaris_read_www_files(httpd_t)
|
|
Chris PeBenito |
99c902f |
')
|
|
Chris PeBenito |
99c902f |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
350b6ab |
cron_system_entry(httpd_t, httpd_exec_t)
|
|
Chris PeBenito |
350b6ab |
')
|
|
Chris PeBenito |
350b6ab |
|
|
Chris PeBenito |
350b6ab |
optional_policy(`
|
|
Chris PeBenito |
44d5d93 |
daemontools_service_domain(httpd_t, httpd_exec_t)
|
|
Chris PeBenito |
44d5d93 |
')
|
|
Chris PeBenito |
44d5d93 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
a996bdf |
kerberos_use(httpd_t)
|
|
Chris PeBenito |
ebc1e8b |
kerberos_read_kdc_config(httpd_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
799a0b4 |
mailman_signal_cgi(httpd_t)
|
|
Chris PeBenito |
799a0b4 |
mailman_domtrans_cgi(httpd_t)
|
|
Chris PeBenito |
799a0b4 |
# should have separate types for public and private archives
|
|
Chris PeBenito |
0500e01 |
mailman_search_data(httpd_t)
|
|
Chris PeBenito |
799a0b4 |
mailman_read_archive(httpd_t)
|
|
Chris PeBenito |
799a0b4 |
')
|
|
Chris PeBenito |
799a0b4 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
0b6acad |
# Allow httpd to work with mysql
|
|
Chris PeBenito |
a996bdf |
mysql_stream_connect(httpd_t)
|
|
Chris PeBenito |
1815bad |
mysql_rw_db_sockets(httpd_t)
|
|
Chris PeBenito |
0b6acad |
|
|
Chris PeBenito |
0b6acad |
tunable_policy(`httpd_can_network_connect_db',`
|
|
Chris PeBenito |
dc1920b |
mysql_tcp_connect(httpd_t)
|
|
Chris PeBenito |
0b6acad |
')
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
f1e604b |
nagios_read_config(httpd_t)
|
|
Chris PeBenito |
f1e604b |
nagios_domtrans_cgi(httpd_t)
|
|
Chris PeBenito |
f1e604b |
')
|
|
Chris PeBenito |
f1e604b |
|
|
Chris PeBenito |
f1e604b |
optional_policy(`
|
|
Chris PeBenito |
5bd9fd7 |
openca_domtrans(httpd_t)
|
|
Chris PeBenito |
5bd9fd7 |
openca_signal(httpd_t)
|
|
Chris PeBenito |
5bd9fd7 |
openca_sigstop(httpd_t)
|
|
Chris PeBenito |
5bd9fd7 |
openca_kill(httpd_t)
|
|
Chris PeBenito |
5bd9fd7 |
')
|
|
Chris PeBenito |
5bd9fd7 |
|
|
Chris PeBenito |
5bd9fd7 |
optional_policy(`
|
|
Chris PeBenito |
725926c |
# Allow httpd to work with postgresql
|
|
Chris PeBenito |
1815bad |
postgresql_stream_connect(httpd_t)
|
|
Chris PeBenito |
e8cb08a |
postgresql_unpriv_client(httpd_t)
|
|
Chris PeBenito |
0b6acad |
|
|
Chris PeBenito |
0b6acad |
tunable_policy(`httpd_can_network_connect_db',`
|
|
Chris PeBenito |
0b6acad |
postgresql_tcp_connect(httpd_t)
|
|
Chris PeBenito |
0b6acad |
')
|
|
Chris PeBenito |
725926c |
')
|
|
Chris PeBenito |
725926c |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
a996bdf |
seutil_sigchld_newrole(httpd_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
6b19be3 |
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
|
|
Chris PeBenito |
6b19be3 |
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
|
|
Chris PeBenito |
6b19be3 |
')
|
|
Chris PeBenito |
6b19be3 |
|
|
Chris PeBenito |
6b19be3 |
optional_policy(`
|
|
Chris PeBenito |
a996bdf |
udev_read_db(httpd_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
f30e6ea |
optional_policy(`
|
|
Chris PeBenito |
f30e6ea |
yam_read_content(httpd_t)
|
|
Chris PeBenito |
f30e6ea |
')
|
|
Chris PeBenito |
f30e6ea |
|
|
Chris PeBenito |
a996bdf |
########################################
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
# Apache helper local policy
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
c0868a7 |
domtrans_pattern(httpd_t, httpd_helper_exec_t, httpd_helper_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
allow httpd_helper_t httpd_config_t:file { getattr read };
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
allow httpd_helper_t httpd_log_t:file append;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
libs_use_ld_so(httpd_helper_t)
|
|
Chris PeBenito |
a996bdf |
libs_use_shared_libs(httpd_helper_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
e749cd1 |
logging_send_syslog_msg(httpd_helper_t)
|
|
Chris PeBenito |
e749cd1 |
|
|
Chris PeBenito |
aba9c7a |
tunable_policy(`httpd_tty_comm',`
|
|
Chris PeBenito |
e9c6cda |
sysadm_use_terms(httpd_helper_t)
|
|
Chris PeBenito |
aba9c7a |
')
|
|
Chris PeBenito |
aba9c7a |
|
|
Chris PeBenito |
a996bdf |
########################################
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
# Apache PHP script local policy
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:fd use;
|
|
Chris PeBenito |
c0868a7 |
allow httpd_php_t self:fifo_file rw_fifo_file_perms;
|
|
Chris PeBenito |
c0868a7 |
allow httpd_php_t self:sock_file read_sock_file_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:unix_dgram_socket create_socket_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:unix_stream_socket create_stream_socket_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:unix_dgram_socket sendto;
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:unix_stream_socket connectto;
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:shm create_shm_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:sem create_sem_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:msgq create_msgq_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_php_t self:msg { send receive };
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
c0868a7 |
domtrans_pattern(httpd_t, httpd_php_exec_t, httpd_php_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# allow php to read and append to apache logfiles
|
|
Chris PeBenito |
c0868a7 |
allow httpd_php_t httpd_log_t:file { read_file_perms append_file_perms };
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(httpd_php_t, httpd_php_tmp_t, httpd_php_tmp_t)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_php_t, httpd_php_tmp_t, httpd_php_tmp_t)
|
|
Chris PeBenito |
103fe28 |
files_tmp_filetrans(httpd_php_t, httpd_php_tmp_t, { file dir })
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
fs_search_auto_mountpoints(httpd_php_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
libs_exec_lib_files(httpd_php_t)
|
|
Chris PeBenito |
a996bdf |
libs_use_ld_so(httpd_php_t)
|
|
Chris PeBenito |
a996bdf |
libs_use_shared_libs(httpd_php_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
103fe28 |
userdom_use_unpriv_users_fds(httpd_php_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
a996bdf |
mysql_stream_connect(httpd_php_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
a996bdf |
nis_use_ypbind(httpd_php_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
5fe7de9 |
optional_policy(`
|
|
Chris PeBenito |
5fe7de9 |
postgresql_stream_connect(httpd_php_t)
|
|
Chris PeBenito |
5fe7de9 |
')
|
|
Chris PeBenito |
5fe7de9 |
|
|
Chris PeBenito |
a996bdf |
########################################
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
# Apache suexec local policy
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
allow httpd_suexec_t self:capability { setuid setgid };
|
|
Chris PeBenito |
a996bdf |
allow httpd_suexec_t self:process signal_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
56e1b3d |
domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
0bfccda |
create_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
|
|
Chris PeBenito |
0bfccda |
append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
|
|
Chris PeBenito |
0bfccda |
read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
|
|
Chris PeBenito |
c0868a7 |
|
|
Chris PeBenito |
a996bdf |
allow httpd_suexec_t httpd_t:fifo_file getattr;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
|
|
Chris PeBenito |
103fe28 |
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
445522d |
kernel_read_kernel_sysctls(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
kernel_list_proc(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
kernel_read_proc_symlinks(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
dev_read_urand(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
fs_search_auto_mountpoints(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
# for shell scripts
|
|
Chris PeBenito |
a996bdf |
corecmd_exec_bin(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
corecmd_exec_shell(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
files_read_etc_files(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
files_read_usr_files(httpd_suexec_t)
|
|
Chris PeBenito |
6e99a6c |
files_dontaudit_search_pids(httpd_suexec_t)
|
|
Chris PeBenito |
725926c |
files_search_home(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
c0cf6e0 |
auth_use_nsswitch(httpd_suexec_t)
|
|
Chris PeBenito |
c0cf6e0 |
|
|
Chris PeBenito |
a996bdf |
libs_use_ld_so(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
libs_use_shared_libs(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
logging_search_logs(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
logging_send_syslog_msg(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
miscfiles_read_localization(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
tunable_policy(`httpd_can_network_connect',`
|
|
Chris PeBenito |
a996bdf |
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
|
|
Chris PeBenito |
a996bdf |
allow httpd_suexec_t self:udp_socket create_socket_perms;
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
1900668 |
corenet_all_recvfrom_unlabeled(httpd_suexec_t)
|
|
Chris PeBenito |
1900668 |
corenet_all_recvfrom_netlabel(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_sendrecv_all_if(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
corenet_udp_sendrecv_all_if(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_sendrecv_all_nodes(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
corenet_udp_sendrecv_all_nodes(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_sendrecv_all_ports(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
corenet_udp_sendrecv_all_ports(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
corenet_tcp_connect_all_ports(httpd_suexec_t)
|
|
Chris PeBenito |
141cffd |
corenet_sendrecv_all_client_packets(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
6e99a6c |
tunable_policy(`httpd_enable_cgi && httpd_unified',`
|
|
Chris PeBenito |
c0868a7 |
domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
|
|
Chris PeBenito |
6e99a6c |
')
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
e311e23 |
tunable_policy(`httpd_enable_homedirs',`
|
|
Chris PeBenito |
e311e23 |
userdom_read_unpriv_users_home_content_files(httpd_suexec_t)
|
|
Chris PeBenito |
e311e23 |
')
|
|
Chris PeBenito |
e311e23 |
|
|
Chris PeBenito |
a996bdf |
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
|
|
Chris PeBenito |
a996bdf |
fs_read_nfs_files(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
fs_read_nfs_symlinks(httpd_suexec_t)
|
|
Chris PeBenito |
4d851fe |
fs_exec_nfs_files(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
a996bdf |
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
|
Chris PeBenito |
a996bdf |
fs_read_cifs_files(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
fs_read_cifs_symlinks(httpd_suexec_t)
|
|
Chris PeBenito |
4d851fe |
fs_exec_cifs_files(httpd_suexec_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
799a0b4 |
mailman_domtrans_cgi(httpd_suexec_t)
|
|
Chris PeBenito |
799a0b4 |
')
|
|
Chris PeBenito |
799a0b4 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
725926c |
mta_stub(httpd_suexec_t)
|
|
Chris PeBenito |
725926c |
|
|
Chris PeBenito |
725926c |
# apache should set close-on-exec
|
|
Chris PeBenito |
725926c |
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
|
|
Chris PeBenito |
725926c |
')
|
|
Chris PeBenito |
725926c |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
f1e604b |
nagios_domtrans_cgi(httpd_suexec_t)
|
|
Chris PeBenito |
f1e604b |
')
|
|
Chris PeBenito |
f1e604b |
|
|
Chris PeBenito |
a996bdf |
########################################
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
# Apache system script local policy
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
6e99a6c |
allow httpd_sys_script_t httpd_t:tcp_socket { read write };
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
6e99a6c |
dontaudit httpd_sys_script_t httpd_config_t:dir search;
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
6e99a6c |
allow httpd_sys_script_t httpd_squirrelmail_t:file { append read };
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
c0868a7 |
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
|
|
Chris PeBenito |
0bfccda |
read_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
|
|
Chris PeBenito |
0bfccda |
read_lnk_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
445522d |
kernel_read_kernel_sysctls(httpd_sys_script_t)
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
6e99a6c |
files_search_var_lib(httpd_sys_script_t)
|
|
Chris PeBenito |
6e99a6c |
files_search_spool(httpd_sys_script_t)
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
123a990 |
# Should we add a boolean?
|
|
Chris PeBenito |
123a990 |
apache_domtrans_rotatelogs(httpd_sys_script_t)
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
6e99a6c |
ifdef(`distro_redhat',`
|
|
Chris PeBenito |
6e99a6c |
allow httpd_sys_script_t httpd_log_t:file { getattr append };
|
|
Chris PeBenito |
6e99a6c |
')
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
e311e23 |
tunable_policy(`httpd_enable_homedirs',`
|
|
Chris PeBenito |
e311e23 |
userdom_read_unpriv_users_home_content_files(httpd_sys_script_t)
|
|
Chris PeBenito |
e311e23 |
')
|
|
Chris PeBenito |
e311e23 |
|
|
Chris PeBenito |
d6d16b9 |
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
|
|
Chris PeBenito |
d6d16b9 |
fs_read_nfs_files(httpd_sys_script_t)
|
|
Chris PeBenito |
d6d16b9 |
fs_read_nfs_symlinks(httpd_sys_script_t)
|
|
Chris PeBenito |
d6d16b9 |
')
|
|
Chris PeBenito |
d6d16b9 |
|
|
Chris PeBenito |
d6d16b9 |
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
|
Chris PeBenito |
d6d16b9 |
fs_read_cifs_files(httpd_sys_script_t)
|
|
Chris PeBenito |
d6d16b9 |
fs_read_cifs_symlinks(httpd_sys_script_t)
|
|
Chris PeBenito |
d6d16b9 |
')
|
|
Chris PeBenito |
d6d16b9 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
165b42d |
clamav_domtrans_clamscan(httpd_sys_script_t)
|
|
Chris PeBenito |
165b42d |
')
|
|
Chris PeBenito |
165b42d |
|
|
Chris PeBenito |
165b42d |
optional_policy(`
|
|
Chris PeBenito |
6e99a6c |
mysql_stream_connect(httpd_sys_script_t)
|
|
Chris PeBenito |
1815bad |
mysql_rw_db_sockets(httpd_sys_script_t)
|
|
Chris PeBenito |
6e99a6c |
')
|
|
Chris PeBenito |
6e99a6c |
|
|
Chris PeBenito |
5fe7de9 |
optional_policy(`
|
|
Chris PeBenito |
5fe7de9 |
postgresql_stream_connect(httpd_sys_script_t)
|
|
Chris PeBenito |
5fe7de9 |
')
|
|
Chris PeBenito |
5fe7de9 |
|
|
Chris PeBenito |
a996bdf |
########################################
|
|
Chris PeBenito |
a996bdf |
#
|
|
Chris PeBenito |
123a990 |
# httpd_rotatelogs local policy
|
|
Chris PeBenito |
123a990 |
#
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
123a990 |
kernel_read_kernel_sysctls(httpd_rotatelogs_t)
|
|
Chris PeBenito |
123a990 |
kernel_dontaudit_list_proc(httpd_rotatelogs_t)
|
|
Chris PeBenito |
123a990 |
kernel_dontaudit_read_proc_symlinks(httpd_rotatelogs_t)
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
123a990 |
files_read_etc_files(httpd_rotatelogs_t)
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
123a990 |
libs_use_ld_so(httpd_rotatelogs_t)
|
|
Chris PeBenito |
123a990 |
libs_use_shared_libs(httpd_rotatelogs_t)
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
d6d16b9 |
logging_search_logs(httpd_rotatelogs_t)
|
|
Chris PeBenito |
d6d16b9 |
|
|
Chris PeBenito |
123a990 |
miscfiles_read_localization(httpd_rotatelogs_t)
|