Here's an selinux policy for haproxy. The patch is built and lightly tested with haproxy-1.3.15.7-1.fc10.i386 on Fedora9, and haproxy-1.2.18 on RHEL5.
Please apply :-) -jf
From 68f90b363e04404541e93e2aa25305381856dc8f Mon Sep 17 00:00:00 2001 From: Jan-Frode Myklebust <[email protected]> Date: Tue, 17 Mar 2009 21:08:21 +0100 Subject: [PATCH] Added a SElinux policy for haproxy. --- contrib/selinux/README | 18 ++++++++++++++ contrib/selinux/haproxy.fc | 6 ++++ contrib/selinux/haproxy.if | 2 + contrib/selinux/haproxy.te | 55 ++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 81 insertions(+), 0 deletions(-) create mode 100644 contrib/selinux/README create mode 100644 contrib/selinux/haproxy.fc create mode 100644 contrib/selinux/haproxy.if create mode 100644 contrib/selinux/haproxy.te diff --git a/contrib/selinux/README b/contrib/selinux/README new file mode 100644 index 0000000..7ad924d --- /dev/null +++ b/contrib/selinux/README @@ -0,0 +1,18 @@ +This directory includes an selinux policy for haproxy. It assumes +the following file locations: + + /usr/sbin/haproxy -- binary + /etc/haproxy/haproxy\.cfg -- configuration + /var/run/haproxy\.pid -- pid-file + /var/run/haproxy\.sock(.*) -- stats socket + /var/empty/haproxy -- chroot dir + +To build and load it on RHEL5 you'll need the "selinux-policy-devel" package, +and from within this directory run: + + make -f /usr/share/selinux/devel/Makefile + sudo semodule -i haproxy.pp + restorecon /usr/sbin/haproxy /etc/haproxy/haproxy.cfg /var/run/haproxy.pid /var/run/haproxy.sock* + + +Feedback to Jan-Frode Myklebust <[email protected]> is much appreciated, diff --git a/contrib/selinux/haproxy.fc b/contrib/selinux/haproxy.fc new file mode 100644 index 0000000..63a0828 --- /dev/null +++ b/contrib/selinux/haproxy.fc @@ -0,0 +1,6 @@ +# haproxy labeling policy +# file: haproxy.fc +/usr/sbin/haproxy -- gen_context(system_u:object_r:haproxy_exec_t, s0) +/etc/haproxy/haproxy\.cfg -- gen_context(system_u:object_r:haproxy_conf_t, s0) +/var/run/haproxy\.pid -- gen_context(system_u:object_r:haproxy_var_run_t, s0) +/var/run/haproxy\.sock(.*) -- gen_context(system_u:object_r:haproxy_var_run_t, s0) diff --git a/contrib/selinux/haproxy.if b/contrib/selinux/haproxy.if new file mode 100644 index 0000000..236ad38 --- /dev/null +++ b/contrib/selinux/haproxy.if @@ -0,0 +1,2 @@ +## <summary>selinux policy module for haproxy</summary> + diff --git a/contrib/selinux/haproxy.te b/contrib/selinux/haproxy.te new file mode 100644 index 0000000..024c02a --- /dev/null +++ b/contrib/selinux/haproxy.te @@ -0,0 +1,55 @@ +policy_module(haproxy,1.0.0) + +######################################## +# +# Declarations +# + +type haproxy_t; +type haproxy_exec_t; +type haproxy_port_t; +init_daemon_domain(haproxy_t, haproxy_exec_t) + +type haproxy_var_run_t; +files_pid_file(haproxy_var_run_t) + +type haproxy_conf_t; +files_config_file(haproxy_conf_t) + +######################################## +# +# Local policy +# + +# Configuration files - read +allow haproxy_t haproxy_conf_t : dir list_dir_perms; +allow haproxy_t haproxy_conf_t : file read_file_perms; +allow haproxy_t haproxy_conf_t : lnk_file read_file_perms; + +# PID and socket file - create, read, and write +files_pid_filetrans(haproxy_t, haproxy_var_run_t, { file sock_file }) +allow haproxy_t haproxy_var_run_t:file manage_file_perms; +allow haproxy_t haproxy_var_run_t:sock_file { create rename link setattr unlink }; + +allow haproxy_t self : tcp_socket create_stream_socket_perms; +allow haproxy_t self: udp_socket create_socket_perms; +allow haproxy_t self: capability { setgid setuid sys_chroot sys_resource kill }; +allow haproxy_t self: process { setrlimit signal }; + + +logging_send_syslog_msg(haproxy_t) + +corenet_tcp_bind_all_ports(haproxy_t) +corenet_tcp_connect_all_ports(haproxy_t) +corenet_tcp_bind_all_nodes(haproxy_t) +corenet_tcp_sendrecv_all_ports(haproxy_t) +corenet_tcp_recvfrom_unlabeled(haproxy_t) + +# use shared libraries +libs_use_ld_so(haproxy_t) +libs_use_shared_libs(haproxy_t) + +# Read /etc/localtime: +miscfiles_read_localization(haproxy_t) +# Read /etc/passwd and more. +files_read_etc_files(haproxy_t) -- 1.6.0.6
From f35efb3db3082e70bca4864e3a7fce94217dafed Mon Sep 17 00:00:00 2001 From: Jan-Frode Myklebust <[email protected]> Date: Tue, 17 Mar 2009 21:22:12 +0100 Subject: [PATCH] Some additional allows needed on RHEL5. --- contrib/selinux/haproxy.te | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/contrib/selinux/haproxy.te b/contrib/selinux/haproxy.te index 024c02a..ef94f3f 100644 --- a/contrib/selinux/haproxy.te +++ b/contrib/selinux/haproxy.te @@ -53,3 +53,14 @@ libs_use_shared_libs(haproxy_t) miscfiles_read_localization(haproxy_t) # Read /etc/passwd and more. files_read_etc_files(haproxy_t) + +# RHEL5 specific: +require { + type unlabeled_t; + type haproxy_t; + class packet send; + class packet recv; +} + +allow haproxy_t unlabeled_t:packet { send recv }; + -- 1.6.0.6
pgpcOogauPzNN.pgp
Description: PGP signature
