From 1d986872fe4f00a0f502fa334f67def44977cb30 Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Thu, 15 Jul 2010 19:42:23 +0000 Subject: Selinux policy module needed to run a qpid cluster with selinux in enforcing mode. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@964551 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/qpidd.te | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 qpid/cpp/etc/selinux/qpidd.te (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/qpidd.te b/qpid/cpp/etc/selinux/qpidd.te new file mode 100644 index 0000000000..9163c55acf --- /dev/null +++ b/qpid/cpp/etc/selinux/qpidd.te @@ -0,0 +1,16 @@ +# selinux policy module needed to run a qpid cluster with selinux in enforcing mode. + +policy_module(qpidd, 1.1) +require { + type initrc_t; + type ccs_t; + type aisexec_t; +} +#============= ccs_t ============== +fs_rw_tmpfs_files(ccs_t) +allow ccs_t initrc_t:sem rw_sem_perms; +allow ccs_t initrc_t:shm rw_shm_perms; +allow ccs_t self:capability ipc_owner; +allow aisexec_t initrc_t:sem rw_sem_perms; +allow aisexec_t initrc_t:shm rw_shm_perms; +allow aisexec_t self:capability { ipc_owner dac_override }; -- cgit v1.2.1 From b9b8004b7b13530d70502f0cf947037a6c265525 Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Tue, 20 Jul 2010 13:28:14 +0000 Subject: Added compile instructions to selinux policy source file. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@965840 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/qpidd.te | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/qpidd.te b/qpid/cpp/etc/selinux/qpidd.te index 9163c55acf..92ff3043bd 100644 --- a/qpid/cpp/etc/selinux/qpidd.te +++ b/qpid/cpp/etc/selinux/qpidd.te @@ -1,4 +1,6 @@ -# selinux policy module needed to run a qpid cluster with selinux in enforcing mode. +# selinux policy needed to run a qpid cluster with selinux in enforcing mode. +# To build the compiled .pp file in this directory do: +# make -f /usr/share/selinux/devel/Makefile policy_module(qpidd, 1.1) require { -- cgit v1.2.1 From 0f1e39bcfc971ddbcc3bf1a3a62e177c1d714b0f Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Wed, 21 Jul 2010 16:37:04 +0000 Subject: Added selinux policy so developers can run cluster tests with enforcing=1 git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@966302 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/qpidd.te | 10 +++++++--- qpid/cpp/etc/selinux/qpiddevel.te | 23 +++++++++++++++++++++++ 2 files changed, 30 insertions(+), 3 deletions(-) create mode 100644 qpid/cpp/etc/selinux/qpiddevel.te (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/qpidd.te b/qpid/cpp/etc/selinux/qpidd.te index 92ff3043bd..322645531e 100644 --- a/qpid/cpp/etc/selinux/qpidd.te +++ b/qpid/cpp/etc/selinux/qpidd.te @@ -1,6 +1,10 @@ -# selinux policy needed to run a qpid cluster with selinux in enforcing mode. -# To build the compiled .pp file in this directory do: -# make -f /usr/share/selinux/devel/Makefile +# selinux policy needed to run the qpidd service with clustering +# enabled and selinux in enforcing mode. +# +# To build the qpid.pp module in this directory do: +# sudo make -f /usr/share/selinux/devel/Makefile +# To install the compiled qpidd.pp +# sudo semodule -i qpidd.pp policy_module(qpidd, 1.1) require { diff --git a/qpid/cpp/etc/selinux/qpiddevel.te b/qpid/cpp/etc/selinux/qpiddevel.te new file mode 100644 index 0000000000..092b9fc203 --- /dev/null +++ b/qpid/cpp/etc/selinux/qpiddevel.te @@ -0,0 +1,23 @@ +# selinux policy for qpid developers. +# If you have configured a qpid source tree with cluster support, you will need +# this policy to run the make check tests with with selinux in enforcing mode. +# +# To build the qpid.pp module in this directory do: +# sudo make -f /usr/share/selinux/devel/Makefile +# To install the compiled qpiddevel.pp +# sudo semodule -i qpiddevel.pp + +module qpiddevel 1.0; + +require { + type unconfined_t; + type aisexec_t; + class capability sys_admin; + class sem { write unix_read unix_write associate read destroy }; + class shm { unix_read write unix_write associate read destroy }; +} + +#============= aisexec_t ============== +allow aisexec_t self:capability sys_admin; +allow aisexec_t unconfined_t:sem { write unix_read unix_write associate read destroy }; +allow aisexec_t unconfined_t:shm { unix_read write unix_write associate read destroy }; -- cgit v1.2.1 From e4c52614d3b80e0068422b20b45a8bba1239e57a Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Wed, 21 Jul 2010 17:29:08 +0000 Subject: Added makefile to build & install selinux policy modules. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@966323 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/.gitignore | 7 +++++++ qpid/cpp/etc/selinux/Makefile | 14 ++++++++++++++ 2 files changed, 21 insertions(+) create mode 100644 qpid/cpp/etc/selinux/.gitignore create mode 100644 qpid/cpp/etc/selinux/Makefile (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/.gitignore b/qpid/cpp/etc/selinux/.gitignore new file mode 100644 index 0000000000..9e81f21cbd --- /dev/null +++ b/qpid/cpp/etc/selinux/.gitignore @@ -0,0 +1,7 @@ +/qpidd.fc +/qpidd.if +/qpidd.pp +/qpiddevel.fc +/qpiddevel.if +/qpiddevel.pp +/tmp diff --git a/qpid/cpp/etc/selinux/Makefile b/qpid/cpp/etc/selinux/Makefile new file mode 100644 index 0000000000..440879d1ed --- /dev/null +++ b/qpid/cpp/etc/selinux/Makefile @@ -0,0 +1,14 @@ +# Makefile to build and install the selinux policies in this directory. +# Needs to be run as root. + +POLICIES = qpidd.pp qpiddevel.pp +SOURCES = $(POLICIES:.pp=.te) + +install: $(POLICIES) + for p in $(POLICIES); do /usr/sbin/semodule -i $$p; done + +$(POLICIES): $(SOURCES) + make -f /usr/share/selinux/devel/Makefile + +clean: + rm -rf *~ *.pp *.fc *.if tmp -- cgit v1.2.1 From 862f986a4ab70a12df8f0d200f7a38d48936dfd2 Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Wed, 28 Jul 2010 20:32:36 +0000 Subject: Updated developer SELinux policy to also allow tests run under valgrind. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@980198 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/qpiddevel.te | 3 +++ 1 file changed, 3 insertions(+) (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/qpiddevel.te b/qpid/cpp/etc/selinux/qpiddevel.te index 092b9fc203..0968f6eeb1 100644 --- a/qpid/cpp/etc/selinux/qpiddevel.te +++ b/qpid/cpp/etc/selinux/qpiddevel.te @@ -12,6 +12,7 @@ module qpiddevel 1.0; require { type unconfined_t; type aisexec_t; + type unconfined_execmem_t; class capability sys_admin; class sem { write unix_read unix_write associate read destroy }; class shm { unix_read write unix_write associate read destroy }; @@ -21,3 +22,5 @@ require { allow aisexec_t self:capability sys_admin; allow aisexec_t unconfined_t:sem { write unix_read unix_write associate read destroy }; allow aisexec_t unconfined_t:shm { unix_read write unix_write associate read destroy }; +allow aisexec_t unconfined_execmem_t:sem { write unix_read unix_write associate read destroy }; +allow aisexec_t unconfined_execmem_t:shm { write unix_read unix_write associate read destroy }; -- cgit v1.2.1 From 7e86bd7adcfa93064c65ae22c92df15ecc0f7e90 Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Mon, 9 Aug 2010 19:29:10 +0000 Subject: Add missing destroy permissions to qpidd selinux module. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@983784 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/qpidd.te | 2 ++ 1 file changed, 2 insertions(+) (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/qpidd.te b/qpid/cpp/etc/selinux/qpidd.te index 322645531e..05721db812 100644 --- a/qpid/cpp/etc/selinux/qpidd.te +++ b/qpid/cpp/etc/selinux/qpidd.te @@ -19,4 +19,6 @@ allow ccs_t initrc_t:shm rw_shm_perms; allow ccs_t self:capability ipc_owner; allow aisexec_t initrc_t:sem rw_sem_perms; allow aisexec_t initrc_t:shm rw_shm_perms; +allow aisexec_t initrc_t:sem destroy; +allow aisexec_t initrc_t:shm destroy; allow aisexec_t self:capability { ipc_owner dac_override }; -- cgit v1.2.1 From c97f626955e2a78af2b14d478d9eff308e53a44b Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Thu, 12 Aug 2010 16:43:27 +0000 Subject: Updated selinux policy to work on versions lacking aisexec_t. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@984858 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/Makefile | 6 ++++-- qpid/cpp/etc/selinux/qpidd.te | 32 +++++++++++++++++++------------- qpid/cpp/etc/selinux/qpiddevel.te | 27 ++++++++++++++++----------- 3 files changed, 39 insertions(+), 26 deletions(-) (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/Makefile b/qpid/cpp/etc/selinux/Makefile index 440879d1ed..e44ec2224b 100644 --- a/qpid/cpp/etc/selinux/Makefile +++ b/qpid/cpp/etc/selinux/Makefile @@ -4,11 +4,13 @@ POLICIES = qpidd.pp qpiddevel.pp SOURCES = $(POLICIES:.pp=.te) -install: $(POLICIES) - for p in $(POLICIES); do /usr/sbin/semodule -i $$p; done +all: $(POLICIES) $(POLICIES): $(SOURCES) make -f /usr/share/selinux/devel/Makefile +install: $(POLICIES) + for p in $(POLICIES); do /usr/sbin/semodule -i $$p; done + clean: rm -rf *~ *.pp *.fc *.if tmp diff --git a/qpid/cpp/etc/selinux/qpidd.te b/qpid/cpp/etc/selinux/qpidd.te index 05721db812..e830575fd1 100644 --- a/qpid/cpp/etc/selinux/qpidd.te +++ b/qpid/cpp/etc/selinux/qpidd.te @@ -6,19 +6,25 @@ # To install the compiled qpidd.pp # sudo semodule -i qpidd.pp -policy_module(qpidd, 1.1) -require { +policy_module(qpidd, 1.2) + +gen_require(` type initrc_t; type ccs_t; - type aisexec_t; -} -#============= ccs_t ============== + class sem { write unix_read unix_write associate read destroy }; + class shm { unix_read write unix_write associate read destroy }; +') + fs_rw_tmpfs_files(ccs_t) -allow ccs_t initrc_t:sem rw_sem_perms; -allow ccs_t initrc_t:shm rw_shm_perms; -allow ccs_t self:capability ipc_owner; -allow aisexec_t initrc_t:sem rw_sem_perms; -allow aisexec_t initrc_t:shm rw_shm_perms; -allow aisexec_t initrc_t:sem destroy; -allow aisexec_t initrc_t:shm destroy; -allow aisexec_t self:capability { ipc_owner dac_override }; +allow ccs_t initrc_t:sem { read write unix_read unix_write associate destroy }; +allow ccs_t initrc_t:shm { read write unix_read unix_write associate destroy }; +allow ccs_t self:capability { ipc_owner dac_override }; + +optional_policy(` + gen_require(` + type aisexec_t; + ') + allow aisexec_t initrc_t:sem { read write unix_read unix_write associate destroy }; + allow aisexec_t initrc_t:shm { read write unix_read unix_write associate destroy }; + allow aisexec_t self:capability { sys_admin ipc_owner dac_override }; +') diff --git a/qpid/cpp/etc/selinux/qpiddevel.te b/qpid/cpp/etc/selinux/qpiddevel.te index 0968f6eeb1..5b280288f7 100644 --- a/qpid/cpp/etc/selinux/qpiddevel.te +++ b/qpid/cpp/etc/selinux/qpiddevel.te @@ -7,20 +7,25 @@ # To install the compiled qpiddevel.pp # sudo semodule -i qpiddevel.pp -module qpiddevel 1.0; +policy_module(qpiddevel, 1.1) -require { +gen_require(` type unconfined_t; - type aisexec_t; - type unconfined_execmem_t; + type ccs_t; class capability sys_admin; class sem { write unix_read unix_write associate read destroy }; class shm { unix_read write unix_write associate read destroy }; -} +') -#============= aisexec_t ============== -allow aisexec_t self:capability sys_admin; -allow aisexec_t unconfined_t:sem { write unix_read unix_write associate read destroy }; -allow aisexec_t unconfined_t:shm { unix_read write unix_write associate read destroy }; -allow aisexec_t unconfined_execmem_t:sem { write unix_read unix_write associate read destroy }; -allow aisexec_t unconfined_execmem_t:shm { write unix_read unix_write associate read destroy }; +allow ccs_t self:capability sys_admin; +allow ccs_t unconfined_t:sem { write unix_read unix_write associate read destroy }; +allow ccs_t unconfined_t:shm { unix_read write unix_write associate read destroy }; + +optional_policy(` + gen_require(` + type aisexec_t; + ') + allow aisexec_t self:capability sys_admin; + allow aisexec_t unconfined_t:sem { read write unix_read unix_write associate destroy }; + allow aisexec_t unconfined_t:shm { read write unix_read unix_write associate destroy }; +') -- cgit v1.2.1 From b6a46afb970b0e9f8b87a1ec26b94e93fc0828c0 Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Fri, 13 Aug 2010 20:41:33 +0000 Subject: Fix qpiddevel selinux policy to work with valgrind. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@985356 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/qpiddevel.te | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/qpiddevel.te b/qpid/cpp/etc/selinux/qpiddevel.te index 5b280288f7..95e1c934b6 100644 --- a/qpid/cpp/etc/selinux/qpiddevel.te +++ b/qpid/cpp/etc/selinux/qpiddevel.te @@ -11,6 +11,7 @@ policy_module(qpiddevel, 1.1) gen_require(` type unconfined_t; + type unconfined_execmem_t; type ccs_t; class capability sys_admin; class sem { write unix_read unix_write associate read destroy }; @@ -28,4 +29,7 @@ optional_policy(` allow aisexec_t self:capability sys_admin; allow aisexec_t unconfined_t:sem { read write unix_read unix_write associate destroy }; allow aisexec_t unconfined_t:shm { read write unix_read unix_write associate destroy }; + allow aisexec_t unconfined_execmem_t:sem { write unix_read unix_write associate read destroy }; + allow aisexec_t unconfined_execmem_t:shm { write unix_read unix_write associate read destroy }; + ') -- cgit v1.2.1 From c4bafa4c2a626c0c7a952f6b19fc2a7f15c23793 Mon Sep 17 00:00:00 2001 From: Gordon Sim Date: Wed, 27 Oct 2010 09:44:57 +0000 Subject: Added some missing licenses; added FedOps.h to distribution list git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1027879 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/Makefile | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/Makefile b/qpid/cpp/etc/selinux/Makefile index e44ec2224b..1ab6337114 100644 --- a/qpid/cpp/etc/selinux/Makefile +++ b/qpid/cpp/etc/selinux/Makefile @@ -1,3 +1,21 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# # Makefile to build and install the selinux policies in this directory. # Needs to be run as root. -- cgit v1.2.1 From 368c86d008aabb122d6b1b034e497bfb56c73e2b Mon Sep 17 00:00:00 2001 From: Robert Gemmell Date: Thu, 28 Oct 2010 20:58:44 +0000 Subject: Add ASF licence to the git ignore files git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1028476 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/.gitignore | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/.gitignore b/qpid/cpp/etc/selinux/.gitignore index 9e81f21cbd..aca772170b 100644 --- a/qpid/cpp/etc/selinux/.gitignore +++ b/qpid/cpp/etc/selinux/.gitignore @@ -1,3 +1,22 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + /qpidd.fc /qpidd.if /qpidd.pp -- cgit v1.2.1 From 4978d516e39c7862934bed5eb0cdcfb528f0390e Mon Sep 17 00:00:00 2001 From: Robert Gemmell Date: Sun, 31 Oct 2010 23:39:39 +0000 Subject: add ASF licence to various files in the cpp tree git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1029521 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/etc/selinux/qpidd.te | 19 +++++++++++++++++++ qpid/cpp/etc/selinux/qpiddevel.te | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) (limited to 'qpid/cpp/etc/selinux') diff --git a/qpid/cpp/etc/selinux/qpidd.te b/qpid/cpp/etc/selinux/qpidd.te index e830575fd1..52b8e29509 100644 --- a/qpid/cpp/etc/selinux/qpidd.te +++ b/qpid/cpp/etc/selinux/qpidd.te @@ -1,3 +1,22 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + # selinux policy needed to run the qpidd service with clustering # enabled and selinux in enforcing mode. # diff --git a/qpid/cpp/etc/selinux/qpiddevel.te b/qpid/cpp/etc/selinux/qpiddevel.te index 95e1c934b6..10c5dfc880 100644 --- a/qpid/cpp/etc/selinux/qpiddevel.te +++ b/qpid/cpp/etc/selinux/qpiddevel.te @@ -1,3 +1,22 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + # selinux policy for qpid developers. # If you have configured a qpid source tree with cluster support, you will need # this policy to run the make check tests with with selinux in enforcing mode. -- cgit v1.2.1