Implement cobblerd policy.

My previous version had a minor bug in admin_role where it was using cobblerd_var_log_t, and cobblerd_var_lib_t instead of cobbler_var_log_t, and cobbler_var_lib_t.

Whilst i was at it, i decided the implement a cobbler_etc_t for cobbler content in /etc. This because you cannot admin a cobbler environment witouth having access to cobbler config files and i dont want to give cobbler_admin access to manage etc_t.

As a consequence if this i also removed the files_read_etc_files(cobblerd_t), as i think that cobbler only needed it to read its own files in /etc. However this is not confirmed, and it may need read access to etc_t afteral.

Also i would like to underscore my reason for using public_content_rw_t. One of the reasons is that i do not want to give cobbler access to manage httpd_sys_content_rw_t. In general i do not want to depend on apache module at all.

Signed-off-by Dominick Grift <[email protected]>

---
:100644 100644 df59b53... cb8e9fc... M policy/modules/kernel/corenetwork.te.in
:100644 100644 f5b7880... f853bf5... M policy/modules/kernel/files.if
:100644 100644 a898dd8... c1139e4... M policy/modules/services/apache.if
:100644 100644 eb3ccae... 02a2f7d... M policy/modules/services/apache.te
:100644 100644 0bc0189... aef64b7... M policy/modules/services/bind.if
:000000 100644 0000000... 0a811f6... A policy/modules/services/cobbler.fc
:000000 100644 0000000... 433099f... A policy/modules/services/cobbler.if
:000000 100644 0000000... 7e5c614... A policy/modules/services/cobbler.te
:100644 100644 51316b4... 8e4d1be... M policy/modules/services/dhcp.if
:100644 100644 a328cea... 89e2e66... M policy/modules/services/dnsmasq.fc
:100644 100644 28c0734... 09e1efd... M policy/modules/services/dnsmasq.if
:100644 100644 a4e478e... edcf106... M policy/modules/services/dnsmasq.te
:100644 100644 299f7a4... 479615b... M policy/modules/services/rsync.fc
:100644 100644 7418196... 7dc8495... M policy/modules/services/rsync.if
:100644 100644 97a6086... ee78a18... M policy/modules/services/rsync.te
:100644 100644 2cbde68... 828b0c3... M policy/modules/services/tftp.if
:100644 100644 6557a8e... 3051ca7... M policy/modules/system/miscfiles.fc
:100644 100644 5a4f576... 0e77e21... M policy/modules/system/sysnetwork.fc

 policy/modules/kernel/corenetwork.te.in |    1 +
 policy/modules/kernel/files.if          |   18 +++
 policy/modules/services/apache.if       |   21 ++++
 policy/modules/services/apache.te       |    4 +
 policy/modules/services/bind.if         |   38 +++++++
 policy/modules/services/cobbler.fc      |    7 +
 policy/modules/services/cobbler.if      |  183 +++++++++++++++++++++++++++++++
 policy/modules/services/cobbler.te      |  124 +++++++++++++++++++++
 policy/modules/services/dhcp.if         |   19 +++
 policy/modules/services/dnsmasq.fc      |    1 +
 policy/modules/services/dnsmasq.if      |   38 +++++++
 policy/modules/services/dnsmasq.te      |    7 +-
 policy/modules/services/rsync.fc        |    1 +
 policy/modules/services/rsync.if        |   38 +++++++
 policy/modules/services/rsync.te        |    5 +
 policy/modules/services/tftp.if         |   38 +++++++
 policy/modules/system/miscfiles.fc      |    3 +
 policy/modules/system/sysnetwork.fc     |    2 +
 18 files changed, 546 insertions(+), 2 deletions(-)

policy/modules/kernel/corenetwork.te.in +1 -0

index df59b53..cb8e9fc 100644
@@ -84,6 +84,7 @@ network_port(certmaster, tcp,51235,s0)
 network_port(clamd, tcp,3310,s0)
 network_port(clockspeed, udp,4041,s0)
 network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006,s0, udp,50006,s0, tcp,50007,s0, udp,50007,s0, tcp,50008,s0, udp,50008,s0)
+network_port(cobbler, tcp,25151,s0)
 network_port(comsat, udp,512,s0)
 network_port(cvs, tcp,2401,s0, udp,2401,s0)
 network_port(cyphesis, tcp,6767,s0, tcp,6769,s0, udp,32771,s0)

policy/modules/kernel/files.if +18 -0

index f5b7880..f853bf5 100644
@@ -1504,6 +1504,24 @@ interface(`files_dontaudit_getattr_boot_dirs',`
 
 ########################################
 ## <summary>
+##	List the /boot directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_list_boot',`
+	gen_require(`
+		type boot_t;
+	')
+
+	allow $1 boot_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
 ##	Search the /boot directory.
 ## </summary>
 ## <param name="domain">

policy/modules/services/apache.if +21 -0

index a898dd8..c1139e4 100644
@@ -758,6 +758,27 @@ interface(`apache_domtrans_rotatelogs',`
 
 ########################################
 ## <summary>
+##	Allow the specified domain to list
+##	apache system content files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`apache_list_sys_content',`
+	gen_require(`
+		type httpd_sys_content_t;
+	')
+
+	list_dirs_pattern($1, httpd_sys_content_t, httpd_sys_content_t)
+	read_lnk_files_pattern($1, httpd_sys_content_t, httpd_sys_content_t)
+	files_search_var($1)
+')
+
+########################################
+## <summary>
 ##	Allow the specified domain to manage
 ##	apache system content files.
 ## </summary>

policy/modules/services/apache.te +4 -0

index eb3ccae..02a2f7d 100644
@@ -451,6 +451,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	cobbler_search_var_lib(httpd_t)
+')
+
+optional_policy(`
 	cron_system_entry(httpd_t, httpd_exec_t)
 ')
 

policy/modules/services/bind.if +38 -0

index 0bc0189..aef64b7 100644
@@ -2,6 +2,25 @@
 
 ########################################
 ## <summary>
+##	Execute bind server in the bind domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`bind_initrc_domtrans',`
+	gen_require(`
+		type named_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, named_initrc_exec_t)
+')
+
+########################################
+## <summary>
 ##	Execute ndc in the ndc domain.
 ## </summary>
 ## <param name="domain">

@@ -192,6 +211,25 @@ interface(`bind_manage_config_dirs',`
 
 ########################################
 ## <summary>
+##	Manage BIND zone files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`bind_manage_zone',`
+	gen_require(`
+		type named_zone_t;
+	')
+
+	files_search_var($1)
+	manage_files_pattern($1, named_zone_t, named_zone_t)
+')
+
+########################################
+## <summary>
 ##	Search the BIND cache directory.
 ## </summary>
 ## <param name="domain">

policy/modules/services/cobbler.fc new file +7 -0

new file mode 100644
index 0000000..0a811f6
@@ -0,0 +1,7 @@
+/etc/cobbler(/.*)?								gen_context(system_u:object_r:cobbler_etc_t, s0)
+/etc/rc\.d/init\.d/cobblerd				--		gen_context(system_u:object_r:cobblerd_initrc_exec_t, s0)
+
+/usr/bin/cobblerd						--		gen_context(system_u:object_r:cobblerd_exec_t, s0)
+
+/var/lib/cobbler(/.*)?							gen_context(system_u:object_r:cobbler_var_lib_t, s0)
+/var/log/cobbler(/.*)?							gen_context(system_u:object_r:cobbler_var_log_t, s0)

policy/modules/services/cobbler.if new file +183 -0

new file mode 100644
index 0000000..433099f
@@ -0,0 +1,183 @@
+## <summary>Cobbler installation server.</summary>
+## <desc>
+##	<p>
+##		Cobbler is a Linux installation server that allows for
+##		rapid setup of network installation environments. It
+##		glues together and automates many associated Linux
+##		tasks so you do not have to hop between lots of various
+##		commands and applications when rolling out new systems,
+##		and, in some cases, changing existing ones.
+##	</p>
+## </desc>
+
+########################################
+## <summary>
+##	Read Cobbler content in /etc
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cobbler_read_config',`
+	gen_require(`
+		type cobbler_etc_t;
+	')
+
+	read_files_pattern($1, cobbler_etc_t, cobbler_etc_t);
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read and write
+##  Cobbler log files (leaked fd).
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cobbler_dontaudit_rw_log',`
+	gen_require(`
+		type cobbler_var_log_t;
+	')
+
+	dontaudit $1 cobbler_var_log_t:file rw_file_perms;
+')
+
+########################################
+## <summary>
+##	Read cobbler files in /var/lib
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cobbler_read_var_lib_files',`
+	gen_require(`
+		type cobbler_var_lib_t;
+	')
+
+	read_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Manage cobbler files in /var/lib
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cobbler_manage_var_lib_files',`
+	gen_require(`
+		type cobbler_var_lib_t;
+	')
+
+	manage_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Search cobbler dirs in /var/lib
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cobbler_search_var_lib',`
+	gen_require(`
+		type cobbler_var_lib_t;
+	')
+
+	search_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run cobblerd.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`cobblerd_domtrans',`
+	gen_require(`
+		type cobblerd_t, cobblerd_exec_t;
+	')
+
+	domtrans_pattern($1, cobblerd_exec_t, cobblerd_t)
+')
+
+########################################
+## <summary>
+##	Execute cobblerd server in the cobblerd domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`cobblerd_initrc_domtrans',`
+	gen_require(`
+		type cobblerd_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, cobblerd_initrc_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an cobblerd environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`cobblerd_admin',`
+	gen_require(`
+		type cobblerd_t, cobbler_var_lib_t, cobbler_var_log_t;
+		type cobbler_etc_t;
+	')
+
+	allow $1 cobblerd_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, cobblerd_t, cobblerd_t)
+
+	files_search_etc($1)
+	admin_pattern($1, cobbler_etc_t)
+
+	files_list_var_lib($1)
+	admin_pattern($1, cobbler_var_lib_t)
+
+	files_search_var_log($1)
+	admin_pattern($1, cobbler_var_log_t)
+
+	cobblerd_initrc_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 cobblerd_initrc_exec_t system_r;
+	allow $2 system_r;
+')

policy/modules/services/cobbler.te new file +124 -0

new file mode 100644
index 0000000..7e5c614
@@ -0,0 +1,124 @@
+
+policy_module(cobbler, 1.0.0) 
+
+########################################
+#
+# Cobbler personal declarations.
+#
+
+## <desc>
+## <p>
+## Allow Cobbler to modify public files
+## used for public file transfer services.
+## </p>
+## </desc>
+gen_tunable(cobbler_anon_write, false)
+
+type cobblerd_t;
+type cobblerd_exec_t;
+init_daemon_domain(cobblerd_t, cobblerd_exec_t)
+
+type cobblerd_initrc_exec_t;
+init_script_file(cobblerd_initrc_exec_t)
+
+type cobbler_etc_t;
+files_config_file(cobbler_etc_t)
+
+type cobbler_var_log_t;
+logging_log_file(cobbler_var_log_t)
+
+type cobbler_var_lib_t;
+files_type(cobbler_var_lib_t)
+
+########################################
+#
+# Cobbler personal policy.
+#
+
+allow cobblerd_t self:capability { chown dac_override fowner sys_nice };
+allow cobblerd_t self:process { getsched setsched signal };
+allow cobblerd_t self:fifo_file rw_fifo_file_perms;
+allow cobblerd_t self:tcp_socket create_stream_socket_perms;
+
+read_files_pattern(cobblerd_t, cobbler_etc_t, cobbler_etc_t)
+
+manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
+manage_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
+files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, { dir file })
+
+append_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
+create_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
+read_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
+setattr_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
+logging_log_filetrans(cobblerd_t, cobbler_var_log_t, file)
+
+corecmd_exec_bin(cobblerd_t)
+corecmd_exec_shell(cobblerd_t)
+
+corenet_all_recvfrom_netlabel(cobblerd_t)
+corenet_all_recvfrom_unlabeled(cobblerd_t)
+corenet_sendrecv_cobbler_server_packets(cobblerd_t)
+corenet_tcp_bind_cobbler_port(cobblerd_t)
+corenet_tcp_bind_generic_node(cobblerd_t)
+corenet_tcp_sendrecv_generic_if(cobblerd_t)
+corenet_tcp_sendrecv_generic_node(cobblerd_t)
+corenet_tcp_sendrecv_generic_port(cobblerd_t)
+
+dev_read_urand(cobblerd_t)
+
+files_read_usr_files(cobblerd_t)
+
+files_list_boot(cobblerd_t)
+
+files_list_tmp(cobblerd_t)
+
+kernel_read_system_state(cobblerd_t)
+
+miscfiles_read_localization(cobblerd_t)
+miscfiles_read_public_files(cobblerd_t)
+
+sysnet_read_config(cobblerd_t)
+sysnet_rw_dhcp_config(cobblerd_t)
+sysnet_write_config(cobblerd_t)
+
+tunable_policy(`cobbler_anon_write',`
+	miscfiles_manage_public_files(cobblerd_t)
+')
+
+optional_policy(`
+	apache_list_sys_content(cobblerd_t)
+')
+
+optional_policy(`
+	bind_read_config(cobblerd_t)
+	bind_write_config(cobblerd_t)
+	bind_domtrans_ndc(cobblerd_t)
+	bind_domtrans(cobblerd_t)
+	bind_initrc_domtrans(cobblerd_t)
+	bind_manage_zone(cobblerd_t)
+')
+
+optional_policy(`
+	dhcpd_domtrans(cobblerd_t)
+	dhcpd_initrc_domtrans(cobblerd_t)
+')
+
+optional_policy(`
+	dnsmasq_domtrans(cobblerd_t)
+	dnsmasq_initrc_domtrans(cobblerd_t)
+	dnsmasq_write_config(cobblerd_t)
+')
+
+optional_policy(`
+	rpm_exec(cobblerd_t)
+')
+
+optional_policy(`
+	rsync_read_config(cobblerd_t)
+	rsync_write_config(cobblerd_t)
+')
+
+optional_policy(`
+	tftp_manage_tftpdir_dirs(cobblerd_t)
+	tftp_manage_tftpdir_files(cobblerd_t)
+')

policy/modules/services/dhcp.if +19 -0

index 51316b4..8e4d1be 100644
@@ -2,6 +2,25 @@
 
 ########################################
 ## <summary>
+##	Transition to dhcpd.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dhcpd_domtrans',`
+	gen_require(`
+		type dhcpd_t, dhcpd_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, dhcpd_exec_t, dhcpd_t)
+')
+
+########################################
+## <summary>
 ##	Set the attributes of the DCHP
 ##	server state files.
 ## </summary>

policy/modules/services/dnsmasq.fc +1 -0

index a328cea..89e2e66 100644
@@ -1,3 +1,4 @@
+/etc/dnsmasq\.conf			--	gen_context(system_u:object_r:dnsmasq_etc_t, s0)
 /etc/rc\.d/init\.d/dnsmasq	--	gen_context(system_u:object_r:dnsmasq_initrc_exec_t,s0)
 
 /usr/sbin/dnsmasq		--	gen_context(system_u:object_r:dnsmasq_exec_t,s0)

policy/modules/services/dnsmasq.if +38 -0

index 28c0734..09e1efd 100644
@@ -136,6 +136,44 @@ interface(`dnsmasq_read_pid_files',`
 
 ########################################
 ## <summary>
+##	Read dnsmasq config files.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed.
+## </summary>
+## </param>
+#
+interface(`dnsmasq_read_config',`
+	gen_require(`
+		type dnsmasq_etc_t;
+	')
+
+	read_files_pattern($1, dnsmasq_etc_t, dnsmasq_etc_t)
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
+##	Write to dnsmasq config files.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed.
+## </summary>
+## </param>
+#
+interface(`dnsmasq_write_config',`
+	gen_require(`
+		type dnsmasq_etc_t;
+	')
+
+	write_files_pattern($1, dnsmasq_etc_t, dnsmasq_etc_t)
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
 ##	All of the rules required to administrate 
 ##	an dnsmasq environment
 ## </summary>

policy/modules/services/dnsmasq.te +5 -2

index a4e478e..edcf106 100644
@@ -13,6 +13,9 @@ init_daemon_domain(dnsmasq_t, dnsmasq_exec_t)
 type dnsmasq_initrc_exec_t;
 init_script_file(dnsmasq_initrc_exec_t)
 
+type dnsmasq_etc_t;
+files_config_file(dnsmasq_etc_t)
+
 type dnsmasq_lease_t;
 files_type(dnsmasq_lease_t)
 

@@ -34,6 +37,8 @@ allow dnsmasq_t self:udp_socket create_socket_perms;
 allow dnsmasq_t self:packet_socket create_socket_perms;
 allow dnsmasq_t self:rawip_socket create_socket_perms;
 
+read_files_pattern(dnsmasq_t, dnsmasq_etc_t, dnsmasq_etc_t)
+
 # dhcp leases
 manage_files_pattern(dnsmasq_t, dnsmasq_lease_t, dnsmasq_lease_t)
 files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file)

@@ -66,8 +71,6 @@ dev_read_urand(dnsmasq_t)
 
 domain_use_interactive_fds(dnsmasq_t)
 
-# allow access to dnsmasq.conf
-files_read_etc_files(dnsmasq_t)
 files_read_etc_runtime_files(dnsmasq_t)
 
 fs_getattr_all_fs(dnsmasq_t)

policy/modules/services/rsync.fc +1 -0

index 299f7a4..479615b 100644
@@ -1,3 +1,4 @@
+/etc/rsyncd\.conf	--	gen_context(system_u:object_r:rsync_etc_t, s0)
 
 /usr/bin/rsync		--	gen_context(system_u:object_r:rsync_exec_t,s0)
 

policy/modules/services/rsync.if +38 -0

index 7418196..7dc8495 100644
@@ -103,3 +103,41 @@ interface(`rsync_exec',`
 
 	can_exec($1, rsync_exec_t)
 ')
+
+########################################
+## <summary>
+##	Read rsync config files.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed.
+## </summary>
+## </param>
+#
+interface(`rsync_read_config',`
+	gen_require(`
+		type rsync_etc_t;
+	')
+
+	read_files_pattern($1, rsync_etc_t, rsync_etc_t)
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
+##	Write to rsync config files.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed.
+## </summary>
+## </param>
+#
+interface(`rsync_write_config',`
+	gen_require(`
+		type rsync_etc_t;
+	')
+
+	write_files_pattern($1, rsync_etc_t, rsync_etc_t)
+	files_search_etc($1)
+')

policy/modules/services/rsync.te +5 -0

index 97a6086..ee78a18 100644
@@ -28,6 +28,9 @@ init_daemon_domain(rsync_t, rsync_exec_t)
 application_executable_file(rsync_exec_t)
 role system_r types rsync_t;
 
+type rsync_etc_t;
+files_config_file(rsync_etc_t)
+
 type rsync_data_t;
 files_type(rsync_data_t)
 

@@ -57,6 +60,8 @@ allow rsync_t self:udp_socket connected_socket_perms;
 allow rsync_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
 #end for identd
 
+read_files_pattern(rsync_t, rsync_etc_t, rsync_etc_t)
+
 allow rsync_t rsync_data_t:dir list_dir_perms;
 read_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
 read_lnk_files_pattern(rsync_t, rsync_data_t, rsync_data_t)

policy/modules/services/tftp.if +38 -0

index 2cbde68..828b0c3 100644
@@ -2,6 +2,44 @@
 
 ########################################
 ## <summary>
+##	Manage tftp /var/lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`tftp_manage_tftpdir_dirs',`
+	gen_require(`
+		type tftpdir_rw_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, tftpdir_rw_t, tftpdir_rw_t)
+')
+
+########################################
+## <summary>
+##	Manage tftp /var/lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`tftp_manage_tftpdir_files',`
+	gen_require(`
+		type tftpdir_rw_t;
+	')
+
+	files_search_var_lib($1)
+	manage_files_pattern($1, tftpdir_rw_t, tftpdir_rw_t)
+')
+
+########################################
+## <summary>
 ##	Read tftp content
 ## </summary>
 ## <param name="domain">

policy/modules/system/miscfiles.fc +3 -0

index 6557a8e..3051ca7 100644
@@ -74,6 +74,9 @@ ifdef(`distro_redhat',`
 /var/cache/fonts(/.*)?		gen_context(system_u:object_r:tetex_data_t,s0)
 /var/cache/man(/.*)?		gen_context(system_u:object_r:man_t,s0)
 
+/var/www/cobbler/images(/.*)?				gen_context(system_u:object_r:public_content_rw_t, s0)
+/var/lib/cobbler/webui_sessions(/.*)?		gen_context(system_u:object_r:public_content_rw_t, s0)
+
 /var/spool/texmf(/.*)?		gen_context(system_u:object_r:tetex_data_t,s0)
 
 ifdef(`distro_debian',`

policy/modules/system/sysnetwork.fc +2 -0

index 5a4f576..0e77e21 100644
@@ -11,6 +11,8 @@
 /etc/dhclient-script	--	gen_context(system_u:object_r:dhcp_etc_t,s0)
 /etc/dhcpc.*			gen_context(system_u:object_r:dhcp_etc_t,s0)
 /etc/dhcpd\.conf	--	gen_context(system_u:object_r:dhcp_etc_t,s0)
+/etc/dhcp/dhcpd\.conf	--	gen_context(system_u:object_r:dhcp_etc_t,s0)
+/etc/ethers			--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/resolv\.conf.*	--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/yp\.conf.*		--	gen_context(system_u:object_r:net_conf_t,s0)
 

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy