diff options
author | Kenton Groombridge <concord@gentoo.org> | 2021-11-11 20:27:06 -0500 |
---|---|---|
committer | Kenton Groombridge <concord@gentoo.org> | 2022-06-06 11:15:12 -0400 |
commit | da106dd4019e3b58af29eca5048e181cb2a61224 (patch) | |
tree | b5f930a5581a724a30f9b97b484b3f2793afbdaa | |
parent | nginx: various fixes (diff) | |
download | hardened-refpolicy-da106dd4.tar.gz hardened-refpolicy-da106dd4.tar.bz2 hardened-refpolicy-da106dd4.zip |
phpfpm: various fixes and new tunables
Minor fixes for phpfpm and add several new tunables, primarily designed
to get various webapps working under SELinux.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
-rw-r--r-- | policy/modules/contrib/phpfpm.te | 73 |
1 files changed, 73 insertions, 0 deletions
diff --git a/policy/modules/contrib/phpfpm.te b/policy/modules/contrib/phpfpm.te index cffae6d7..a1044f31 100644 --- a/policy/modules/contrib/phpfpm.te +++ b/policy/modules/contrib/phpfpm.te @@ -19,6 +19,49 @@ gen_tunable(phpfpm_use_ldap, false) ## </desc> gen_tunable(phpfpm_send_syslog_msg, false) +## <desc> +## <p> +## Allow phpfpm to execute shells. This +## is needed by some webapps. +## </p> +## </desc> +gen_tunable(phpfpm_exec_shell, false) + +## <desc> +## <p> +## Allow phpfpm to connect to http ports. +## </p> +## </desc> +gen_tunable(phpfpm_connect_http, false) + +## <desc> +## <p> +## Allow phpfpm to connect to pop ports. +## </p> +## </desc> +gen_tunable(phpfpm_connect_pop, false) + +## <desc> +## <p> +## Allow phpfpm to connect to redis ports. +## </p> +## </desc> +gen_tunable(phpfpm_connect_redis, false) + +## <desc> +## <p> +## Allow phpfpm to connect to sieve ports. +## </p> +## </desc> +gen_tunable(phpfpm_connect_sieve, false) + +## <desc> +## <p> +## Allow phpfpm to connect to smtp ports. +## </p> +## </desc> +gen_tunable(phpfpm_connect_smtp, false) + type phpfpm_t; type phpfpm_exec_t; init_daemon_domain(phpfpm_t, phpfpm_exec_t) @@ -44,6 +87,8 @@ allow phpfpm_t self:fifo_file rw_fifo_file_perms; allow phpfpm_t self:tcp_socket rw_stream_socket_perms; allow phpfpm_t self:udp_socket connected_socket_perms; allow phpfpm_t self:unix_stream_socket { accept create_stream_socket_perms }; +allow phpfpm_t self:unix_dgram_socket { create_socket_perms }; +dontaudit phpfpm_t self:capability net_admin; manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t) logging_log_filetrans(phpfpm_t, phpfpm_log_t, file) @@ -87,6 +132,10 @@ apache_read_sys_content(phpfpm_t) apache_dontaudit_search_modules(phpfpm_t) optional_policy(` + apache_map_sys_content(phpfpm_t) +') + +optional_policy(` mysql_stream_connect(phpfpm_t) mysql_tcp_connect(phpfpm_t) ') @@ -106,6 +155,30 @@ optional_policy(` ') ') +tunable_policy(`phpfpm_exec_shell',` + corecmd_exec_shell(phpfpm_t) +') + +tunable_policy(`phpfpm_connect_http',` + corenet_tcp_connect_http_port(phpfpm_t) +') + +tunable_policy(`phpfpm_connect_pop',` + corenet_tcp_connect_pop_port(phpfpm_t) +') + +tunable_policy(`phpfpm_connect_redis',` + corenet_tcp_connect_redis_port(phpfpm_t) +') + +tunable_policy(`phpfpm_connect_sieve',` + corenet_tcp_connect_sieve_port(phpfpm_t) +') + +tunable_policy(`phpfpm_connect_smtp',` + corenet_tcp_connect_smtp_port(phpfpm_t) +') + tunable_policy(`phpfpm_send_syslog_msg',` logging_send_syslog_msg(phpfpm_t) ') |