|
Chris PeBenito |
17de1b7 |
## <summary>MIT Kerberos admin and KDC</summary>
|
|
Chris PeBenito |
17de1b7 |
## <desc>
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
## This policy supports:
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
## Servers:
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
## kadmind
|
|
Chris PeBenito |
17de1b7 |
## krb5kdc
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
## Clients:
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
## kinit
|
|
Chris PeBenito |
17de1b7 |
## kdestroy
|
|
Chris PeBenito |
17de1b7 |
## klist
|
|
Chris PeBenito |
17de1b7 |
## ksu (incomplete)
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
##
|
|
Chris PeBenito |
17de1b7 |
## </desc>
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
########################################
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Use kerberos services
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## <param name="domain">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
17de1b7 |
#
|
|
Chris PeBenito |
17de1b7 |
interface(`kerberos_use',`
|
|
Chris PeBenito |
17de1b7 |
gen_require(`
|
|
Chris PeBenito |
17de1b7 |
type krb5_conf_t;
|
|
Chris PeBenito |
8708d9b |
type krb5kdc_conf_t;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
files_search_etc($1)
|
|
Chris PeBenito |
17de1b7 |
allow $1 krb5_conf_t:file { getattr read };
|
|
Chris PeBenito |
17de1b7 |
dontaudit $1 krb5_conf_t:file write;
|
|
Chris PeBenito |
8708d9b |
dontaudit $1 krb5kdc_conf_t:dir r_dir_perms;
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
tunable_policy(`allow_kerberos',`
|
|
Chris PeBenito |
17de1b7 |
allow $1 self:tcp_socket create_socket_perms;
|
|
Chris PeBenito |
17de1b7 |
allow $1 self:udp_socket create_socket_perms;
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
corenet_non_ipsec_sendrecv($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_tcp_sendrecv_all_if($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_udp_sendrecv_all_if($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_tcp_sendrecv_all_nodes($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_udp_sendrecv_all_nodes($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_tcp_sendrecv_kerberos_port($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_udp_sendrecv_kerberos_port($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_tcp_bind_all_nodes($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_udp_bind_all_nodes($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_tcp_connect_kerberos_port($1)
|
|
Chris PeBenito |
17de1b7 |
corenet_sendrecv_kerberos_client_packets($1)
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
sysnet_read_config($1)
|
|
Chris PeBenito |
17de1b7 |
sysnet_dns_name_resolve($1)
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
########################################
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Read the kerberos configuration file (/etc/krb5.conf).
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## <param name="domain">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
bbcd3c9 |
## <rolecap/>
|
|
Chris PeBenito |
17de1b7 |
#
|
|
Chris PeBenito |
17de1b7 |
interface(`kerberos_read_config',`
|
|
Chris PeBenito |
17de1b7 |
gen_require(`
|
|
Chris PeBenito |
17de1b7 |
type krb5_conf_t;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
files_search_etc($1)
|
|
Chris PeBenito |
17de1b7 |
allow $1 krb5_conf_t:file r_file_perms;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
########################################
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Do not audit attempts to write the kerberos
|
|
Chris PeBenito |
17de1b7 |
## configuration file (/etc/krb5.conf).
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## <param name="domain">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Domain to not audit.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
17de1b7 |
#
|
|
Chris PeBenito |
17de1b7 |
interface(`kerberos_dontaudit_write_config',`
|
|
Chris PeBenito |
17de1b7 |
gen_require(`
|
|
Chris PeBenito |
17de1b7 |
type krb5_conf_t;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
dontaudit $1 krb5_conf_t:file write;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
########################################
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Read and write the kerberos configuration file (/etc/krb5.conf).
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## <param name="domain">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
bbcd3c9 |
## <rolecap/>
|
|
Chris PeBenito |
17de1b7 |
#
|
|
Chris PeBenito |
17de1b7 |
interface(`kerberos_rw_config',`
|
|
Chris PeBenito |
17de1b7 |
gen_require(`
|
|
Chris PeBenito |
17de1b7 |
type krb5_conf_t;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
files_search_etc($1)
|
|
Chris PeBenito |
17de1b7 |
allow $1 krb5_conf_t:file rw_file_perms;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
########################################
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Read the kerberos key table.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## <param name="domain">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
bbcd3c9 |
## <rolecap/>
|
|
Chris PeBenito |
17de1b7 |
#
|
|
Chris PeBenito |
17de1b7 |
interface(`kerberos_read_keytab',`
|
|
Chris PeBenito |
17de1b7 |
gen_require(`
|
|
Chris PeBenito |
17de1b7 |
type krb5_keytab_t;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
files_search_etc($1)
|
|
Chris PeBenito |
17de1b7 |
allow $1 krb5_keytab_t:file r_file_perms;
|
|
Chris PeBenito |
17de1b7 |
')
|