Oops, sorry,
Is this what you want?
# policy_module(couchdb, 1.0.0)
######################################## # # Declarations #
permissive couchdb_t;
type couchdb_t; type couchdb_exec_t; init_daemon_domain(couchdb_t, couchdb_exec_t)
type couchdb_initrc_exec_t; init_script_file(couchdb_initrc_exec_t)
type couchdb_etc_t; files_config_file(couchdb_etc_t)
type couchdb_tmp_t; files_tmp_file(couchdb_tmp_t)
type couchdb_var_lib_t; files_type(couchdb_var_lib_t)
type couchdb_var_log_t; logging_log_file(couchdb_var_log_t)
type couchdb_var_run_t; files_pid_file(couchdb_var_run_t)
######################################## # # Local policy #
allow couchdb_t self:process { setsched signal signull sigkill }; allow couchdb_t self:fifo_file rw_fifo_file_perms; allow couchdb_t self:tcp_socket create_stream_socket_perms; allow couchdb_t self:udp_socket create_socket_perms;
allow couchdb_t couchdb_etc_t:dir list_dir_perms; read_files_pattern(couchdb_t, couchdb_etc_t, couchdb_etc_t)
manage_files_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t) files_tmp_filetrans(couchdb_t, couchdb_tmp_t, file)
manage_dirs_pattern(couchdb_t, couchdb_var_lib_t, couchdb_var_lib_t) manage_files_pattern(couchdb_t, couchdb_var_lib_t, couchdb_var_lib_t)
create_files_pattern(couchdb_t, couchdb_var_log_t, couchdb_var_log_t) append_files_pattern(couchdb_t, couchdb_var_log_t, couchdb_var_log_t)
manage_files_pattern(couchdb_t, couchdb_var_run_t, couchdb_var_run_t)
can_exec(couchdb_t, couchdb_exec_t)
kernel_read_system_state(couchdb_t)
# 5984 corenet_sendrecv_vnc_server_packets(couchdb_t) corenet_tcp_bind_generic_node(couchdb_t) corenet_tcp_bind_vnc_port(couchdb_t) corenet_tcp_sendrecv_vnc_port(couchdb_t) corenet_udp_bind_generic_node(couchdb_t)
# basename, /usr/lib/erlang/erts-5.8.3/bin/erl corecmd_exec_bin(couchdb_t) corecmd_exec_shell(couchdb_t)
dev_read_sysfs(couchdb_t) dev_read_urand(couchdb_t)
# /usr/share/couchdb/www/index.html files_read_usr_files(couchdb_t)
# / fs_getattr_xattr_fs(couchdb_t)
miscfiles_read_localization(couchdb_t)
optional_policy(` # /usr/lib/erlang/erts-5.8.3/bin/beam.smp execmem_exec(couchdb_t) ')
On Tue, Mar 13, 2012 at 10:07 PM, Daniel J Walsh dwalsh@redhat.com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/13/2012 10:04 AM, Michael Milverton wrote:
Thanks Dan,
I don't have access to Fedora 17 at the moment so I can't test it but I will write a small python script this weekend so you can test it if you like. My feeling is that it won't work properly like it is because the fc file doesn't include couchjs, the JavaScript compiler. I think that was the main issue I had if I remember correctly.
Could you test the policy I attached as that seemed to work on Fedora 15 or is it too outdated? It was for couchdb 1.0.2.
P.S If you can wait a couple of weeks I should be able to get Fedora 17 running. It takes time because I have limited bandwidth (wireless) at the moment.
Thanks Michael
On 12/03/2012, at 21:54, Daniel J Walsh dwalsh@redhat.com wrote:
I wrote my own policy for couchdb using sepolgen for Fedora 17.
Totally untested, since I have no idea how to use couchdb.
Fixed avc's created by starting and stopping the service.
ps -eZ | grep couch system_u:system_r:couchdb_t:s0 4103 ? 00:00:00 couchdb system_u:system_r:couchdb_t:s0 4113 ? 00:00:00 couchdb system_u:system_r:couchdb_t:s0 4114 ? 00:00:00 beam.smp system_u:system_r:couchdb_t:s0 4130 ? 00:00:00 heart
Might want to write separate polciy for heart? beam.smp?
I added port definitions for tcp port couchdb_port_t 5984 and 6984.
<couchdb.te> <couchdb.if> <couchdb.fc> <couchdb.sh>
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
The policy you attached did not include any allow rules. Could you mail me the original source, te file. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk9fVKEACgkQrlYvE4MpobOUEgCg296xb2E45lvFOO4kS1vYDq44 hJsAn0A5YF19vItKoLibqKUG7mZm6FZi =LrXW -----END PGP SIGNATURE-----