From: Konstantin Ryabitsev <konstantin@linuxfoundation.org>
To: meta@public-inbox.org
Subject: [PATCH v2] Contribute SELinux policy for EL7
Date: Fri, 15 Jun 2018 15:11:23 -0400 [thread overview]
Message-ID: <20180615191123.GA6193@work> (raw)
In-Reply-To: <20180524190306.GA23233@work>
[-- Attachment #1: Type: text/plain, Size: 6323 bytes --]
This adds a SELinux policy suitable for RHEL/CentOS 7. It assumes the
following:
- public-inbox-httpd and public-inbox-nntpd are running via systemd
on sane ports (119 and 80/8080)
- /var/lib/public-inbox is the location for mainrepos
- /var/run/public-inbox is the location for PERL_INLINE_DIRECTORY
- /var/log/public-inbox is the location for logs
- mail delivery is done via postfix-pipe or public-inbox-watch via
the provided example systemd service
Signed-off-by: Konstantin Ryabitsev <konstantin@linuxfoundation.org>
---
contrib/selinux/el7/publicinbox.fc | 8 ++
contrib/selinux/el7/publicinbox.te | 113 +++++++++++++++++++++++++++++
2 files changed, 121 insertions(+)
create mode 100644 contrib/selinux/el7/publicinbox.fc
create mode 100644 contrib/selinux/el7/publicinbox.te
diff --git a/contrib/selinux/el7/publicinbox.fc b/contrib/selinux/el7/publicinbox.fc
new file mode 100644
index 0000000..c8ada2d
--- /dev/null
+++ b/contrib/selinux/el7/publicinbox.fc
@@ -0,0 +1,8 @@
+/usr/(local/)?bin/public-inbox-httpd -- gen_context(system_u:object_r:publicinbox_daemon_exec_t,s0)
+/usr/(local/)?bin/public-inbox-nntpd -- gen_context(system_u:object_r:publicinbox_daemon_exec_t,s0)
+/usr/(local/)?bin/public-inbox-watch -- gen_context(system_u:object_r:publicinbox_deliver_exec_t,s0)
+/usr/(local/)?bin/public-inbox-mda -- gen_context(system_u:object_r:publicinbox_deliver_exec_t,s0)
+
+/var/lib/public-inbox(/.*)? gen_context(system_u:object_r:publicinbox_var_lib_t,s0)
+/var/run/public-inbox(/.*)? gen_context(system_u:object_r:publicinbox_var_run_t,s0)
+/var/log/public-inbox(/.*)? gen_context(system_u:object_r:publicinbox_log_t,s0)
diff --git a/contrib/selinux/el7/publicinbox.te b/contrib/selinux/el7/publicinbox.te
new file mode 100644
index 0000000..023cf81
--- /dev/null
+++ b/contrib/selinux/el7/publicinbox.te
@@ -0,0 +1,113 @@
+##################
+# This policy allows running public-inbox-httpd and public-inbox-nntpd
+# on reasonable ports (119 for nntpd and 80/443/8080 for httpd)
+#
+# It also allows delivering mail via postfix-pipe to public-inbox-mda
+#
+# Author: Konstantin Ryabitsev <konstantin@linuxfoundation.org>
+#
+policy_module(publicinbox, 1.0.3)
+
+require {
+ type postfix_pipe_t;
+ type spamc_t;
+ type spamd_t;
+}
+
+##################
+# Declarations
+
+type publicinbox_daemon_t;
+type publicinbox_daemon_exec_t;
+init_daemon_domain(publicinbox_daemon_t, publicinbox_daemon_exec_t)
+
+type publicinbox_var_lib_t;
+files_type(publicinbox_var_lib_t)
+
+type publicinbox_log_t;
+logging_log_file(publicinbox_log_t)
+
+type publicinbox_var_run_t;
+files_tmp_file(publicinbox_var_run_t)
+
+type publicinbox_tmp_t;
+files_tmp_file(publicinbox_tmp_t)
+
+type publicinbox_deliver_t;
+type publicinbox_deliver_exec_t;
+init_daemon_domain(publicinbox_deliver_t, publicinbox_deliver_exec_t)
+
+# Uncomment to put these domains into permissive mode
+#permissive publicinbox_daemon_t;
+#permissive publicinbox_deliver_t;
+
+##################
+# Daemons policy
+
+domain_use_interactive_fds(publicinbox_daemon_t)
+files_read_etc_files(publicinbox_daemon_t)
+miscfiles_read_localization(publicinbox_daemon_t)
+allow publicinbox_daemon_t self:tcp_socket create_stream_socket_perms;
+allow publicinbox_daemon_t self:tcp_socket { accept listen };
+
+# Need to be able to manage and exec them for Inline::C
+manage_files_pattern(publicinbox_daemon_t, publicinbox_var_run_t, publicinbox_var_run_t)
+exec_files_pattern(publicinbox_daemon_t, publicinbox_var_run_t, publicinbox_var_run_t)
+
+# Logging
+append_files_pattern(publicinbox_daemon_t, publicinbox_log_t, publicinbox_log_t)
+create_files_pattern(publicinbox_daemon_t, publicinbox_log_t, publicinbox_log_t)
+setattr_files_pattern(publicinbox_daemon_t, publicinbox_log_t, publicinbox_log_t)
+logging_log_filetrans(publicinbox_daemon_t, publicinbox_log_t, { file dir })
+
+# Run on httpd and nntp ports (called innd_port_t)
+corenet_tcp_bind_generic_node(publicinbox_daemon_t)
+corenet_tcp_bind_http_port(publicinbox_daemon_t)
+corenet_tcp_bind_http_cache_port(publicinbox_daemon_t)
+corenet_tcp_bind_innd_port(publicinbox_daemon_t)
+
+# Allow reading anything publicinbox_var_lib_t
+list_dirs_pattern(publicinbox_daemon_t, publicinbox_var_lib_t, publicinbox_var_lib_t)
+read_files_pattern(publicinbox_daemon_t, publicinbox_var_lib_t, publicinbox_var_lib_t)
+
+# The daemon doesn't need to write to this dir
+dontaudit publicinbox_daemon_t publicinbox_var_lib_t:file write;
+
+# Allow executing bin (for git, mostly)
+corecmd_exec_bin(publicinbox_daemon_t)
+
+# Manage our tmp files
+manage_dirs_pattern(publicinbox_daemon_t, publicinbox_tmp_t, publicinbox_tmp_t)
+manage_files_pattern(publicinbox_daemon_t, publicinbox_tmp_t, publicinbox_tmp_t)
+files_tmp_filetrans(publicinbox_daemon_t, publicinbox_tmp_t, { file dir })
+
+##################
+# mda/watch policy
+#
+# Allow transitioning to deliver_t from postfix pipe
+domtrans_pattern(postfix_pipe_t, publicinbox_deliver_exec_t, publicinbox_deliver_t)
+postfix_rw_inherited_master_pipes(publicinbox_deliver_t)
+postfix_read_spool_files(publicinbox_deliver_t)
+
+files_read_etc_files(publicinbox_deliver_t)
+
+# Allow managing anything in publicinbox_var_lib_t
+manage_dirs_pattern(publicinbox_deliver_t, publicinbox_var_lib_t, publicinbox_var_lib_t)
+manage_files_pattern(publicinbox_deliver_t, publicinbox_var_lib_t, publicinbox_var_lib_t)
+
+# Allow executing bin (for git, mostly)
+corecmd_exec_bin(publicinbox_deliver_t)
+
+# git-fast-import wants to access system state and other bits
+kernel_dontaudit_read_system_state(publicinbox_deliver_t)
+
+# Allow using spamc
+spamassassin_domtrans_client(publicinbox_deliver_t)
+manage_files_pattern(spamc_t, publicinbox_var_lib_t, publicinbox_var_lib_t)
+read_files_pattern(spamd_t, publicinbox_var_lib_t, publicinbox_var_lib_t)
+
+# Manage our tmp files
+manage_dirs_pattern(publicinbox_deliver_t, publicinbox_tmp_t, publicinbox_tmp_t)
+manage_files_pattern(publicinbox_deliver_t, publicinbox_tmp_t, publicinbox_tmp_t)
+files_tmp_filetrans(publicinbox_deliver_t, publicinbox_tmp_t, { file dir })
+
--
2.17.1
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
next prev parent reply other threads:[~2018-06-15 19:11 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-24 19:03 [PATCH] Contribute SELinux policy for EL7 Konstantin Ryabitsev
2018-05-30 3:15 ` Eric Wong
2018-05-30 17:13 ` Konstantin Ryabitsev
2018-05-30 20:25 ` Eric Wong
2018-06-15 19:11 ` Konstantin Ryabitsev [this message]
2018-06-16 8:06 ` [PATCH v2] " Eric Wong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://public-inbox.org/README
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180615191123.GA6193@work \
--to=konstantin@linuxfoundation.org \
--cc=meta@public-inbox.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).