Skip to content

Commit bf06e93

Browse files
wrabcakwrabcak
committed
Introduce new bolean httpd_use_opencryptoki
1 parent 00ee9cf commit bf06e93

File tree

3 files changed

+168
-0
lines changed

3 files changed

+168
-0
lines changed

‎apache.te‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,13 @@ gen_tunable(httpd_use_sasl, false)
301301
## </desc>
302302
gen_tunable(httpd_use_nfs, false)
303303

304+
## <desc>
305+
## <p>
306+
## Allow httpd to use opencryptoki
307+
## </p>
308+
## </desc>
309+
gen_tunable(httpd_use_opencryptoki, false)
310+
304311
## <desc>
305312
## <p>
306313
## Allow apache scripts to write to public content, directories/files must be labeled public_rw_content_t.
@@ -1820,3 +1827,11 @@ optional_policy(`
18201827
')
18211828
')
18221829

1830+
optional_policy(`
1831+
tunable_policy(`httpd_use_opencryptoki',`
1832+
dev_rw_crypto(httpd_passwd_t)
1833+
pkcs_manage_lock(httpd_passwd_t)
1834+
1835+
pkcs_use_opencryptoki(httpd_t)
1836+
')
1837+
')

‎pkcs.if‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,154 @@
11
## <summary>Implementations of the Cryptoki specification.</summary>
22

3+
########################################
4+
## <summary>
5+
## Read pkcs lock files.
6+
## </summary>
7+
## <param name="domain">
8+
## <summary>
9+
## Domain allowed access.
10+
## </summary>
11+
## </param>
12+
#
13+
interface(`pkcs_read_lock',`
14+
gen_require(`
15+
type pkcs_slotd_lock_t;
16+
')
17+
18+
files_search_locks($1)
19+
list_dirs_pattern($1, pkcs_slotd_lock_t, pkcs_slotd_lock_t)
20+
read_files_pattern($1, pkcs_slotd_lock_t, pkcs_slotd_lock_t)
21+
')
22+
23+
########################################
24+
## <summary>
25+
## Create, read, write, and delete
26+
## pkcs lock files.
27+
## </summary>
28+
## <param name="domain">
29+
## <summary>
30+
## Domain allowed access.
31+
## </summary>
32+
## </param>
33+
#
34+
interface(`pkcs_manage_lock',`
35+
gen_require(`
36+
type pkcs_slotd_lock_t;
37+
')
38+
39+
files_search_locks($1)
40+
manage_files_pattern($1, pkcs_slotd_lock_t, pkcs_slotd_lock_t)
41+
manage_dirs_pattern($1, pkcs_slotd_lock_t, pkcs_slotd_lock_t)
42+
')
43+
44+
########################################
45+
## <summary>
46+
## Read and write pkcs Shared
47+
## memory segments.
48+
## </summary>
49+
## <param name="domain">
50+
## <summary>
51+
## Domain allowed access.
52+
## </summary>
53+
## </param>
54+
#
55+
interface(`pkcs_rw_shm',`
56+
gen_require(`
57+
type pkcs_t;
58+
')
59+
60+
allow $1 pkcs_slotd_t:shm rw_shm_perms;
61+
')
62+
63+
########################################
64+
## <summary>
65+
## Connect to pkcs using a unix
66+
## domain stream socket.
67+
## </summary>
68+
## <param name="domain">
69+
## <summary>
70+
## Domain allowed access.
71+
## </summary>
72+
## </param>
73+
#
74+
interface(`pkcs_stream_connect',`
75+
gen_require(`
76+
type pkcs_slotd_t, pkcs_slotd_var_run_t;
77+
')
78+
79+
files_search_var_lib($1)
80+
stream_connect_pattern($1, pkcs_slotd_var_run_t, pkcs_slotd_var_run_t, pkcs_slotd_t)
81+
')
82+
83+
########################################
84+
## <summary>
85+
## Manage pkcs var_lib files.
86+
## </summary>
87+
## <param name="domain">
88+
## <summary>
89+
## Domain allowed access.
90+
## </summary>
91+
## </param>
92+
#
93+
interface(`pkcs_manage_var_lib',`
94+
gen_require(`
95+
type pkcs_var_lib_t;
96+
')
97+
98+
files_search_var_lib($1)
99+
manage_dirs_pattern($1, pkcs_slotd_var_lib_t, pkcs_slotd_var_lib_t)
100+
manage_files_pattern($1, pkcs_slotd_var_lib_t, pkcs_slotd_var_lib_t)
101+
')
102+
103+
########################################
104+
## <summary>
105+
## Get attributes of pkcs executable files.
106+
## </summary>
107+
## <param name="domain">
108+
## <summary>
109+
## Domain allowed access.
110+
## </summary>
111+
## </param>
112+
#
113+
interface(`pkcs_getattr_exec_files',`
114+
gen_require(`
115+
type pkcs_slotd_exec_t;
116+
')
117+
118+
allow $1 pkcs_slotd_exec_t:file getattr_file_perms;
119+
')
120+
121+
########################################
122+
## <summary>
123+
## Use opencryptoki services
124+
## </summary>
125+
## <param name="domain">
126+
## <summary>
127+
## Domain allowed access.
128+
## </summary>
129+
## </param>
130+
#
131+
interface(`pkcs_use_opencryptoki',`
132+
gen_require(`
133+
type pkcs_slotd_t;
134+
')
135+
136+
allow $1 self:capability fsetid;
137+
allow pkcs_slotd_t $1:process signull;
138+
139+
kernel_search_proc($1)
140+
ps_process_pattern(pkcs_slotd_t, $1)
141+
142+
dev_rw_crypto($1)
143+
144+
pkcs_getattr_exec_files($1)
145+
pkcs_manage_lock($1)
146+
pkcs_rw_shm($1)
147+
pkcs_stream_connect($1)
148+
pkcs_manage_var_lib($1)
149+
150+
')
151+
3152
########################################
4153
## <summary>
5154
## All of the rules required to

‎sssd.te‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,10 @@ optional_policy(`
177177
ldap_read_certs(sssd_t)
178178
')
179179

180+
optional_policy(`
181+
pkcs_read_lock(sssd_t)
182+
')
183+
180184
optional_policy(`
181185
samba_manage_var_dirs(sssd_t)
182186
samba_manage_var_files(sssd_t)

0 commit comments

Comments
 (0)