1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
|
# SELinux module for the NGINX Web Server
policy_module(nginx,1.0.10)
########################################
#
# Declarations
#
## <desc>
## <p>
## Allow nginx to serve HTTP content (act as an http server)
## </p>
## </desc>
gen_tunable(nginx_enable_http_server, false)
## <desc>
## <p>
## Allow nginx to act as an imap proxy server)
## </p>
## </desc>
gen_tunable(nginx_enable_imap_server, false)
## <desc>
## <p>
## Allow nginx to act as a pop3 server)
## </p>
## </desc>
gen_tunable(nginx_enable_pop3_server, false)
## <desc>
## <p>
## Allow nginx to act as an smtp server)
## </p>
## </desc>
gen_tunable(nginx_enable_smtp_server, false)
## <desc>
## <p>
## Allow nginx to connect to remote HTTP servers
## </p>
## </desc>
gen_tunable(nginx_can_network_connect_http, false)
## <desc>
## <p>
## Allow nginx to connect to remote servers (regardless of protocol)
## </p>
## </desc>
gen_tunable(nginx_can_network_connect, false)
type nginx_t;
type nginx_exec_t;
init_daemon_domain(nginx_t, nginx_exec_t)
# conf files
type nginx_conf_t;
files_type(nginx_conf_t)
# log files
type nginx_log_t;
logging_log_file(nginx_log_t)
# tmp files
type nginx_tmp_t;
files_tmp_file(nginx_tmp_t)
# var/lib files
type nginx_var_lib_t;
files_type(nginx_var_lib_t)
# pid files
type nginx_runtime_t alias nginx_var_run_t;
files_runtime_file(nginx_runtime_t)
########################################
#
# nginx local policy
#
allow nginx_t self:fifo_file rw_inherited_fifo_file_perms;
allow nginx_t self:unix_stream_socket create_stream_socket_perms;
allow nginx_t self:tcp_socket { listen accept };
allow nginx_t self:capability { setuid net_bind_service setgid chown };
# conf files
list_dirs_pattern(nginx_t, nginx_conf_t, nginx_conf_t)
read_files_pattern(nginx_t, nginx_conf_t, nginx_conf_t)
# log files
manage_files_pattern(nginx_t, nginx_log_t, nginx_log_t)
logging_log_filetrans(nginx_t, nginx_log_t, { file dir })
# pid file
manage_dirs_pattern(nginx_t, nginx_runtime_t, nginx_runtime_t)
manage_files_pattern(nginx_t, nginx_runtime_t, nginx_runtime_t)
files_runtime_filetrans(nginx_t, nginx_runtime_t, file)
# tmp files
manage_files_pattern(nginx_t, nginx_tmp_t, nginx_tmp_t)
manage_dirs_pattern(nginx_t, nginx_tmp_t, nginx_tmp_t)
files_tmp_filetrans(nginx_t, nginx_tmp_t, dir)
# var/lib files
create_files_pattern(nginx_t, nginx_var_lib_t, nginx_var_lib_t)
create_sock_files_pattern(nginx_t, nginx_var_lib_t, nginx_var_lib_t)
files_var_lib_filetrans(nginx_t,nginx_var_lib_t, { file dir sock_file })
kernel_read_kernel_sysctls(nginx_t)
corenet_tcp_bind_generic_node(nginx_t)
corenet_tcp_sendrecv_generic_if(nginx_t)
corenet_tcp_sendrecv_generic_node(nginx_t)
dev_read_rand(nginx_t)
dev_read_urand(nginx_t)
domain_use_interactive_fds(nginx_t)
files_read_etc_files(nginx_t)
miscfiles_read_localization(nginx_t)
sysnet_dns_name_resolve(nginx_t)
optional_policy(`
apache_read_config(nginx_t)
apache_read_module_files(nginx_t)
apache_manage_log(nginx_t)
')
tunable_policy(`nginx_enable_http_server',`
corenet_tcp_bind_http_port(nginx_t)
apache_read_all_content(nginx_t)
apache_manage_all_rw_content(nginx_t)
')
# We enable both binding and connecting, since nginx acts here as a reverse proxy
tunable_policy(`nginx_enable_imap_server',`
corenet_tcp_bind_pop_port(nginx_t)
corenet_tcp_connect_pop_port(nginx_t)
')
tunable_policy(`nginx_enable_pop3_server',`
corenet_tcp_bind_pop_port(nginx_t)
corenet_tcp_connect_pop_port(nginx_t)
')
tunable_policy(`nginx_enable_smtp_server',`
corenet_tcp_bind_smtp_port(nginx_t)
corenet_tcp_connect_smtp_port(nginx_t)
')
tunable_policy(`nginx_can_network_connect_http',`
corenet_tcp_connect_http_port(nginx_t)
')
tunable_policy(`nginx_can_network_connect',`
corenet_tcp_connect_all_ports(nginx_t)
')
optional_policy(`
phpfpm_stream_connect(nginx_t)
')
ifdef(`distro_gentoo',`
# needs to be able to signal its children
allow nginx_t self:process { signal sigchld };
optional_policy(`
uwsgi_stream_connect(nginx_t)
')
')
|
GitWeb