foreman.te

# vim: sw=4:ts=4:et
#
# Copyright 2013 Red Hat, Inc.
#
# This program and entire repository is free software: you can redistribute it
# and/or modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation, either version 3 of the License,
# or any later version.
#
# This program is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
# details.
#
# You should have received a copy of the GNU General Public License along with
# this program. If not, see http://www.gnu.org/licenses/.
#

policy_module(foreman, @@VERSION@@)

#######################################
#
# Declarations
#
# Note: Some mod_passanger 4.0+ processes are running under httpd_t domain,
# therefore we need to keep two domains: passenger_t and httpd_t.
#

## <desc>
## <p>
## Allow passenger to run foreman.
## </p>
## </desc>
gen_tunable(passenger_run_foreman, true)

## <desc>
### <p>
### Allow passenger to run the puppetmaster.
### </p>
### </desc>
gen_tunable(passenger_run_puppetmaster, true)

## <desc>
## <p>
## Allow passenger (httpd_t domain) to run foreman.
## </p>
## </desc>
gen_tunable(httpd_run_foreman, true)

## <desc>
## <p>
## Determine whether passenger can connect to LDAP ports.
## </p>
## </desc>
gen_tunable(passenger_can_connect_ldap, true)

## <desc>
## <p>
## Determine whether passenger can connect to TCP ports
## other than specified in the policy.
## </p>
## </desc>
gen_tunable(passenger_can_connect_all, false)

## <desc>
## <p>
## Determine whether passenger can connect to Docker via TCP
## </p>
## </desc>
gen_tunable(passenger_can_connect_docker_tcp, true)

## <desc>
## <p>
## Determine whether passenger can connect to Docker via local socket
## </p>
## </desc>
gen_tunable(passenger_can_connect_docker_unix, true)

## <desc>
## <p>
## Determine whether passenger can connect to OpenStack
## </p>
## </desc>
gen_tunable(passenger_can_connect_openstack, true)

## <desc>
## <p>
## Determine whether passenger can execute ssh (needed for qemu+ssh libvirt connection).
## </p>
## </desc>
gen_tunable(passenger_can_spawn_ssh, true)

## <desc>
## <p>
## Determine whether passenger can connect to local or remote libvirt.
## </p>
## </desc>
gen_tunable(passenger_can_connect_libvirt, true)

## <desc>
## <p>
## Determine whether passenger can connect to remote SMTP services
## </p>
## </desc>
gen_tunable(passenger_can_connect_smtp, true)

# Some basic aliases for different aspects of the filesystem to make things
# more clear.
require{
    type etc_t;
}
typealias etc_t alias foreman_config_t;

type foreman_db_t;
files_type(foreman_db_t)

type foreman_enc_t;
files_config_file(foreman_enc_t)

type foreman_lib_t;
files_type(foreman_lib_t)

type foreman_log_t;
logging_log_file(foreman_log_t)

type foreman_var_run_t;
files_pid_file(foreman_var_run_t)

type foreman_proxy_port_t;
corenet_port(foreman_proxy_port_t)

require{
    type bin_t;
    type httpd_t;
    type httpd_tmp_t;
    type ifconfig_exec_t;
    type init_t;
    type passenger_t;
    type passenger_tmp_t;
    type proc_net_t;
    type puppet_etc_t;
    type puppet_log_t;
    type puppet_port_t;
    type puppet_var_lib_t;
    type puppetmaster_exec_t;
    type puppetmaster_t;
    type sysctl_net_t;
    type websm_port_t;
}

#######################################
#
# Passanger/httpd local policy
#

allow passenger_t self:capability sys_resource;
allow passenger_t self:process signull;
allow passenger_t self:tcp_socket listen;

miscfiles_read_localization(passenger_t)

# Allow Foreman to connect to Foreman Proxy on port 9090 (Katello)
allow passenger_t websm_port_t:tcp_socket name_connect;

# Allow Foreman to connect to Foreman Proxy on a defined port
allow passenger_t foreman_proxy_port_t:tcp_socket name_connect;

# Allow Foreman to connect to PostgreSQL
corenet_tcp_connect_postgresql_port(passenger_t)
optional_policy(`
    postgresql_stream_connect(passenger_t)
')

# Allow Foreman to connect anywhere when bool is set
tunable_policy(`passenger_can_connect_all',`
    corenet_tcp_connect_all_ports(passenger_t)
')

# The read the code (and potentially modules) from /usr/share.
files_read_usr_files(passenger_t)

# Allow access to pseudo terminal devices to connect to local virt.
term_search_ptys(passenger_t)

# For memory-statistics script which executes /usr/bin/free
files_exec_usr_files(passenger_t)

# For memory-statistics and agent which executes /bin/ps (#3465)
dev_read_sysfs(passenger_t)
dev_search_sysfs(passenger_t)
dev_read_rand(passenger_t)

optional_policy(`
    tunable_policy(`passenger_run_foreman', `
        admin_pattern(httpd_t, foreman_lib_t, foreman_lib_t)
        admin_pattern(passenger_t, foreman_lib_t, foreman_lib_t)
        admin_pattern(passenger_t, foreman_var_run_t, foreman_var_run_t)

        # Allow Foreman to connect to hosts and guests
        corenet_tcp_connect_virt_port(passenger_t)
        corenet_tcp_connect_ssh_port(passenger_t)

        # Allow Foreman to write to the SQlite databases
        read_files_pattern(passenger_t, foreman_db_t, foreman_db_t)
        write_files_pattern(passenger_t, foreman_db_t, foreman_db_t)

        # Allow Foreman to do DNS queries via Ruby stdlib net package
        # http://projects.theforeman.org/issues/8030
        corenet_udp_bind_generic_port(passenger_t)
    ')
')

optional_policy(`
    tunable_policy(`passenger_run_foreman', `
        allow passenger_t self:process getsession;
        fs_rw_anon_inodefs_files(passenger_t)
        allow passenger_t httpd_t:unix_stream_socket { read write getattr };
        fs_getattr_xattr_fs(passenger_t)
        ifdef(`distro_rhel7', `
            allow passenger_t self:capability2 block_suspend;
        ')
    ')
')

tunable_policy(`httpd_run_foreman', `
    allow httpd_t passenger_tmp_t:sock_file write;
')

tunable_policy(`httpd_run_foreman', `
    manage_dirs_pattern(passenger_t, httpd_tmp_t, httpd_tmp_t)
    manage_files_pattern(passenger_t, httpd_tmp_t, httpd_tmp_t)
    manage_sock_files_pattern(passenger_t, httpd_tmp_t, httpd_tmp_t)
    manage_files_pattern(passenger_t, foreman_log_t , foreman_log_t)
')

optional_policy(`
    tunable_policy(`passenger_run_puppetmaster', `
        allow passenger_t foreman_enc_t:file { read getattr open ioctl execute execute_no_trans };
        allow passenger_t ifconfig_exec_t:file { read getattr open execute execute_no_trans };
        allow passenger_t init_t:unix_stream_socket { getattr ioctl };
        allow passenger_t proc_net_t:file { read getattr open };
        allow passenger_t puppet_log_t:file { write relabelfrom relabelto setattr };
        allow passenger_t puppet_var_lib_t:dir { relabelfrom relabelto create rmdir setattr };
        allow passenger_t puppet_var_lib_t:file { relabelfrom relabelto };
        allow passenger_t sysctl_net_t:dir search;
        # Allow basic httpd processes to access puppet_etc_t and
        # puppet_port_t before passenger is initialized.
        read_files_pattern(httpd_t, puppet_etc_t, puppet_etc_t)
        allow httpd_t puppet_port_t:tcp_socket name_connect;
    ')
')

# Puppetmaster touches file contexts of some files which causes issues when apache2 httpd
# is started from command line (under unconfined_u). This rule makes sure it does not
# go into unconfined_u. This is only needed for RHEL6 (upstart). This rule MUST NOT be
# in an optional_policy block!
domain_obj_id_change_exemption(passenger_t)

optional_policy(`
    # Allow sending of email reports.
    mta_send_mail(passenger_t)
')

tunable_policy(`passenger_can_connect_smtp',`
    corenet_tcp_connect_smtp_port(passenger_t)
')

optional_policy(`
    mysql_stream_connect(passenger_t)
    mysql_list_db(passenger_t)
')

optional_policy(`
    hostname_exec(passenger_t)
')

optional_policy(`
    # Transition to puppet_master
    corecmd_search_bin(passenger_t)
    domtrans_pattern(passenger_t, puppetmaster_exec_t, puppetmaster_t)
')

optional_policy(`
    tunable_policy(`passenger_can_connect_ldap', `
        corenet_tcp_connect_ldap_port(passenger_t)
    ')
')

#######################################
#
# OpenStack Compute Resource
#

tunable_policy(`passenger_can_connect_openstack',`
    ifdef(`distro_rhel6', `
        corenet_tcp_connect_commplex_port(passenger_t)
    ',`
        corenet_tcp_connect_commplex_main_port(passenger_t)
    ')
')

#######################################
#
# Libvirt Compute Resource
#

optional_policy(`
    tunable_policy(`passenger_can_spawn_ssh',`
        require {
            class process { getcap setcap };
        }
        allow passenger_t self:process { getcap setcap };

        ssh_exec(passenger_t)
        ssh_read_user_home_files(passenger_t)
    ')
')

optional_policy(`
    tunable_policy(`passenger_can_connect_libvirt',`
        virt_getattr_exec(passenger_t)
        virt_read_pid_symlinks(passenger_t)
        virt_stream_connect(passenger_t)
    ')
')

#######################################
#
# Websockify
#

type websockify_t;
type websockify_exec_t;
role system_r types websockify_t;

application_domain(websockify_t, websockify_exec_t)
domtrans_pattern(passenger_t, websockify_exec_t, websockify_t)

require {
    type vnc_port_t;
    class process { siginh rlimitinh noatsecure };
}

allow websockify_t self:netlink_route_socket { all_netlink_route_socket_perms };
allow websockify_t self:tcp_socket { all_tcp_socket_perms };
allow websockify_t self:udp_socket { all_udp_socket_perms };
allow passenger_t websockify_t:process { siginh noatsecure rlimitinh };

apache_search_config(websockify_t)
corenet_tcp_bind_generic_node(websockify_t)
corenet_tcp_connect_vnc_port(websockify_t)
corenet_tcp_bind_vnc_port(websockify_t)
dev_read_urand(websockify_t)
kernel_read_system_state(websockify_t)
logging_send_syslog_msg(websockify_t)
miscfiles_read_localization(websockify_t)
sysnet_read_config(websockify_t)
abrt_stream_connect(websockify_t)
files_search_var_lib(websockify_t)
read_files_pattern(websockify_t, puppet_var_lib_t, puppet_var_lib_t)

######################################
#
# Docker
#

type docker_port_t;
corenet_port(docker_port_t)

tunable_policy(`passenger_can_connect_docker_tcp',`
    allow passenger_t docker_port_t:tcp_socket name_connect;
')

tunable_policy(`passenger_can_connect_docker_unix',`
    ifndef(`distro_rhel6', `
        docker_stream_connect(passenger_t)
    ')
')

######################################
#
# Elasticsearch
#

# We carry elasticsearch policy until it is delivered to RHEL6:
# https://bugzilla.redhat.com/show_bug.cgi?id=1102119
type elasticsearch_port_t;
corenet_port(elasticsearch_port_t)

######################################
#
# Foreman Katello plugin
#

# System status (ping) controller checks for service status using sysvinit scripts
# This is temporary solution until https://bugzilla.redhat.com/show_bug.cgi?id=1105085
# is fixed.
init_exec_script_files(passenger_t)

ifndef(`distro_rhel7', `
    consoletype_exec(passenger_t)
')

# Katello does connect to Elasticsearch services
allow passenger_t elasticsearch_port_t:tcp_socket name_connect;

# Katello uses certs in /etc/pki/katello for websockets
miscfiles_read_certs(websockify_t)

######################################
#
# Foreman Bootdisk plugin
#

# no rules necessary

######################################
#
# Foreman Hooks plugin
#

typealias bin_t alias foreman_hook_t;

######################################
#
# Foreman Setup plugin
#

# no rules necessary

######################################
#
# Foreman Discovery plugin
#

# no rules necessary

######################################
#
# Foreman Tasks plugin
#

# the plugin daemon uses daemon gem for the backround job
type foreman_tasks_exec_t;
init_daemon_domain(passenger_t, foreman_tasks_exec_t)