Attachment 619107 Details for Bug 861607 – a rng starting point

a rng starting point

file_861607.txt (text/plain), 2.16 KB, created by Dominick Grift on 2012-09-29 15:18:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dominick Grift

Created: 2012-09-29 15:18:56 UTC

Size: 2.16 KB

patch

obsolete

>policy_module(rng, 1.0.0)
>
>########################################
>#
># Declarations
>#
>
>type rngd_t;
>type rngd_exec_t;
>init_daemon_domain(rngd_t, rngd_exec_t)
>
>type rngd_initrc_exec_t;
>init_script_file(rngd_initrc_exec_t)
>
>type rngd_unit_file_t;
>systemd_unit_file(rngd_unit_file_t)
>
>########################################
>#
># Local policy
>#
>
>allow rngd_t self:capability sys_admin;
>
>dev_read_rand(rngd_t)
>dev_read_urand(rngd_t)
>dev_rw_tpm(rngd_t)
>dev_write_rand(rngd_t)
>
>/etc/rc\.d/init\.d/rngd	--	gen_context(system_u:object_r:rngd_initrc_exec_t,s0)
>
>/usr/lib/systemd/system/rngd.*    --  gen_context(system_u:object_r:rngd_unit_file_t,s0)
>
>/usr/sbin/rngd	--	gen_context(system_u:object_r:rngd_exec_t,s0)
>
>
>## <summary>Check and feed random data from hardware device to kernel random device.</summary>
>
>########################################
>## <summary>
>##	Execute rngd in the rngd domain.
>## </summary>
>## <param name="domain">
>##	<summary>
>##	Domain allowed to transition.
>##	</summary>
>## </param>
>#
>interface(`rng_systemctl_rngd',`
>	gen_require(`
>		type rngd_t, rngd_unit_file_t;
>	')
>
>	systemd_exec_systemctl($1)
>	allow $1 rngd_unit_file_t:file read_file_perms;
>	allow $1 rngd_unit_file_t:service manage_service_perms;
>
>	ps_process_pattern($1, rngd_t)
>')
>
>########################################
>## <summary>
>##	All of the rules required to
>##	administrate an rng environment.
>## </summary>
>## <param name="domain">
>##	<summary>
>##	Domain allowed access.
>##	</summary>
>## </param>
>## <param name="role">
>##	<summary>
>##	Role allowed access.
>##	</summary>
>## </param>
>## <rolecap/>
>#
>interface(`rng_admin',`
>	gen_require(`
>		type rngd_t, rngd_initrc_exec_t, rngd_unit_file_t;
>	')
>
>	allow $1 rngd_t:process signal_perms;
>	ps_process_pattern($1, rngd_t)
>
>	tunable_policy(`deny_ptrace',`',`
>		allow $1 rngd_t:process ptrace;
>	')
>
>	init_labeled_script_domtrans($1, rngd_initrc_exec_t)
>	domain_system_change_exemption($1)
>	role_transition $2 rngd_initrc_exec_t system_r;
>	allow $2 system_r;
>
>	rng_systemctl($1)
>	admin_pattern($1, rngd_unit_file_t)
>	allow $1 rngd_unit_file_t:service all_service_perms;
>')
>

Actions: View

Attachments on bug 861607: 619107