[PATCH hardened-refpolicy] vinlyd: new policy module

Varnish Cache was renamed to Vinyl Cache with release 9.0.0, and all
paths, programs, user and group have been renamed.

This module adds the new vinyld module, which is the same as the
existing varnishd with the new names.

The varnishd module will need to be retained for the time being, as
the 8.x branch is still maintained with the old names.

Link: https://vinyl-cache.org/docs/9.0/whats-new/upgrading-9.0.html
Signed-off-by: Brett A C Sheffield <[email protected]>
---
 policy/modules/kernel/corenetwork.if | 315 +++++++++++++++++++++++++++
 policy/modules/services/vinyld.fc    |  19 ++
 policy/modules/services/vinyld.if    | 212 ++++++++++++++++++
 policy/modules/services/vinyld.te    | 136 ++++++++++++
 4 files changed, 682 insertions(+)
 create mode 100644 policy/modules/services/vinyld.fc
 create mode 100644 policy/modules/services/vinyld.if
 create mode 100644 policy/modules/services/vinyld.te

diff --git a/policy/modules/kernel/corenetwork.if b/policy/modules/kernel/corenetwork.if
index b86f8aaf..4ea8ae98 100644
--- a/policy/modules/kernel/corenetwork.if
+++ b/policy/modules/kernel/corenetwork.if
@@ -70135,6 +70135,321 @@ interface(`corenet_relabelto_varnishd_server_packets',`
 
 
 
+########################################
+## <summary>
+##	Bind TCP sockets to the vinyld port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_tcp_bind_vinyld_port',`
+	gen_require(`
+		type vinyld_port_t;
+	')
+
+	allow $1 vinyld_port_t:tcp_socket name_bind;
+	allow $1 self:capability net_bind_service;
+')
+
+########################################
+## <summary>
+##	Bind UDP sockets to the vinyld port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_udp_bind_vinyld_port',`
+	gen_require(`
+		type vinyld_port_t;
+	')
+
+	allow $1 vinyld_port_t:udp_socket name_bind;
+	allow $1 self:capability net_bind_service;
+')
+
+########################################
+## <summary>
+##	Make a TCP connection to the vinyld port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`corenet_tcp_connect_vinyld_port',`
+	gen_require(`
+		type vinyld_port_t;
+	')
+
+	allow $1 vinyld_port_t:tcp_socket name_connect;
+')
+
+
+########################################
+## <summary>
+##	Send vinyld_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="write" weight="10"/>
+#
+interface(`corenet_send_vinyld_client_packets',`
+	gen_require(`
+		type vinyld_client_packet_t;
+	')
+
+	allow $1 vinyld_client_packet_t:packet send;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send vinyld_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_send_vinyld_client_packets',`
+	gen_require(`
+		type vinyld_client_packet_t;
+	')
+
+	dontaudit $1 vinyld_client_packet_t:packet send;
+')
+
+########################################
+## <summary>
+##	Receive vinyld_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="read" weight="10"/>
+#
+interface(`corenet_receive_vinyld_client_packets',`
+	gen_require(`
+		type vinyld_client_packet_t;
+	')
+
+	allow $1 vinyld_client_packet_t:packet recv;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to receive vinyld_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_receive_vinyld_client_packets',`
+	gen_require(`
+		type vinyld_client_packet_t;
+	')
+
+	dontaudit $1 vinyld_client_packet_t:packet recv;
+')
+
+########################################
+## <summary>
+##	Send and receive vinyld_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`corenet_sendrecv_vinyld_client_packets',`
+	corenet_send_vinyld_client_packets($1)
+	corenet_receive_vinyld_client_packets($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send and receive vinyld_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_sendrecv_vinyld_client_packets',`
+	corenet_dontaudit_send_vinyld_client_packets($1)
+	corenet_dontaudit_receive_vinyld_client_packets($1)
+')
+
+########################################
+## <summary>
+##	Relabel packets to vinyld_client the packet type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`corenet_relabelto_vinyld_client_packets',`
+	gen_require(`
+		type vinyld_client_packet_t;
+	')
+
+	allow $1 vinyld_client_packet_t:packet relabelto;
+')
+
+
+########################################
+## <summary>
+##	Send vinyld_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="write" weight="10"/>
+#
+interface(`corenet_send_vinyld_server_packets',`
+	gen_require(`
+		type vinyld_server_packet_t;
+	')
+
+	allow $1 vinyld_server_packet_t:packet send;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send vinyld_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_send_vinyld_server_packets',`
+	gen_require(`
+		type vinyld_server_packet_t;
+	')
+
+	dontaudit $1 vinyld_server_packet_t:packet send;
+')
+
+########################################
+## <summary>
+##	Receive vinyld_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="read" weight="10"/>
+#
+interface(`corenet_receive_vinyld_server_packets',`
+	gen_require(`
+		type vinyld_server_packet_t;
+	')
+
+	allow $1 vinyld_server_packet_t:packet recv;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to receive vinyld_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_receive_vinyld_server_packets',`
+	gen_require(`
+		type vinyld_server_packet_t;
+	')
+
+	dontaudit $1 vinyld_server_packet_t:packet recv;
+')
+
+########################################
+## <summary>
+##	Send and receive vinyld_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`corenet_sendrecv_vinyld_server_packets',`
+	corenet_send_vinyld_server_packets($1)
+	corenet_receive_vinyld_server_packets($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send and receive vinyld_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_sendrecv_vinyld_server_packets',`
+	corenet_dontaudit_send_vinyld_server_packets($1)
+	corenet_dontaudit_receive_vinyld_server_packets($1)
+')
+
+########################################
+## <summary>
+##	Relabel packets to vinyld_server the packet type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`corenet_relabelto_vinyld_server_packets',`
+	gen_require(`
+		type vinyld_server_packet_t;
+	')
+
+	allow $1 vinyld_server_packet_t:packet relabelto;
+')
+
+
+
+
 ########################################
 ## <summary>
 ##	Bind TCP sockets to the virt port.
diff --git a/policy/modules/services/vinyld.fc b/policy/modules/services/vinyld.fc
new file mode 100644
index 00000000..cbc743d1
--- /dev/null
+++ b/policy/modules/services/vinyld.fc
@@ -0,0 +1,19 @@
+/etc/rc\.d/init\.d/vinyld	--	gen_context(system_u:object_r:vinyld_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/vinyllog	--	gen_context(system_u:object_r:vinyllog_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/vinylncsa	--	gen_context(system_u:object_r:vinyllog_initrc_exec_t,s0)
+
+/etc/vinyl-cache(/.*)?	gen_context(system_u:object_r:vinyld_etc_t,s0)
+
+/usr/bin/vinyld		--	gen_context(system_u:object_r:vinyld_exec_t,s0)
+/usr/bin/vinyllog	--	gen_context(system_u:object_r:vinyllog_exec_t,s0)
+/usr/bin/vinylncsa	--	gen_context(system_u:object_r:vinyllog_exec_t,s0)
+
+/usr/sbin/vinyld	--	gen_context(system_u:object_r:vinyld_exec_t,s0)
+
+/var/lib/vinyl-cache(/.*)?	gen_context(system_u:object_r:vinyld_var_lib_t,s0)
+
+/var/log/vinyl-cache(/.*)?	gen_context(system_u:object_r:vinyllog_log_t,s0)
+
+/run/vinyld\.pid	--	gen_context(system_u:object_r:vinyld_runtime_t,s0)
+/run/vinyllog\.pid	--	gen_context(system_u:object_r:vinyllog_runtime_t,s0)
+/run/vinylncsa\.pid	--	gen_context(system_u:object_r:vinyllog_runtime_t,s0)
diff --git a/policy/modules/services/vinyld.if b/policy/modules/services/vinyld.if
new file mode 100644
index 00000000..215eb218
--- /dev/null
+++ b/policy/modules/services/vinyld.if
@@ -0,0 +1,212 @@
+## <summary>vinyld http accelerator daemon.</summary>
+
+#######################################
+## <summary>
+##	Execute vinyld in the vinyld domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`vinyld_domtrans',`
+	gen_require(`
+		type vinyld_t, vinyld_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, vinyld_exec_t, vinyld_t)
+')
+
+#######################################
+## <summary>
+##	Execute vinyld in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`vinyld_exec',`
+	gen_require(`
+		type vinyld_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, vinyld_exec_t)
+')
+
+######################################
+## <summary>
+##	Read vinyld configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`vinyld_read_config',`
+	gen_require(`
+		type vinyld_etc_t;
+	')
+
+	files_search_etc($1)
+	read_files_pattern($1, vinyld_etc_t, vinyld_etc_t)
+')
+
+#####################################
+## <summary>
+##	Read vinyl-cache lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`vinyld_read_lib_files',`
+	gen_require(`
+		type vinyld_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	read_files_pattern($1, vinyld_var_lib_t, vinyld_var_lib_t)
+')
+
+#######################################
+## <summary>
+##	Read vinyl-cache log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`vinyld_read_log',`
+	gen_require(`
+		type vinyllog_log_t;
+	')
+
+	logging_search_logs($1)
+	read_files_pattern($1, vinyllog_log_t, vinyllog_log_t)
+')
+
+######################################
+## <summary>
+##	Append vinyl-cache log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`vinyld_append_log',`
+	gen_require(`
+		type vinyllog_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, vinyllog_log_t, vinyllog_log_t)
+')
+
+#####################################
+## <summary>
+##	Create, read, write, and delete
+##	vinyl-cache log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`vinyld_manage_log',`
+	gen_require(`
+		type vinyllog_log_t;
+	')
+
+	logging_search_logs($1)
+	manage_files_pattern($1, vinyllog_log_t, vinyllog_log_t)
+')
+
+######################################
+## <summary>
+##	All of the rules required to
+##	administrate an vinyllog environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`vinyld_admin_vinyllog',`
+	gen_require(`
+		type vinyllog_t, vinyllog_initrc_exec_t, vinyllog_log_t;
+		type vinyllog_runtime_t;
+	')
+
+	allow $1 vinyllog_t:process { ptrace signal_perms };
+	ps_process_pattern($1, vinyllog_t)
+
+	init_startstop_service($1, $2, vinyllog_t, vinyllog_initrc_exec_t)
+
+	files_list_runtime($1)
+	admin_pattern($1, vinyllog_runtime_t)
+
+	logging_list_logs($1)
+	admin_pattern($1, vinyllog_log_t)
+')
+
+#######################################
+## <summary>
+##	All of the rules required to
+##	administrate an vinyld environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`vinyld_admin',`
+	gen_require(`
+		type vinyld_t, vinyld_var_lib_t, vinyld_etc_t;
+		type vinyld_runtime_t, vinyld_tmp_t;
+		type vinyld_initrc_exec_t;
+	')
+
+	allow $1 vinyld_t:process { ptrace signal_perms };
+	ps_process_pattern($1, vinyld_t)
+
+	init_startstop_service($1, $2, vinyld_t, vinyld_initrc_exec_t)
+
+	files_list_var_lib($1)
+	admin_pattern($1, vinyld_var_lib_t)
+
+	files_list_etc($1)
+	admin_pattern($1, vinyld_etc_t)
+
+	files_list_runtime($1)
+	admin_pattern($1, vinyld_runtime_t)
+
+	files_list_tmp($1)
+	admin_pattern($1, vinyld_tmp_t)
+')
diff --git a/policy/modules/services/vinyld.te b/policy/modules/services/vinyld.te
new file mode 100644
index 00000000..0c934686
--- /dev/null
+++ b/policy/modules/services/vinyld.te
@@ -0,0 +1,136 @@
+policy_module(vinyld)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+##	<p>
+##	Determine whether vinyld can
+##	use the full TCP network.
+## </p>
+## </desc>
+gen_tunable(vinyld_connect_any, false)
+
+type vinyld_t;
+type vinyld_exec_t;
+init_daemon_domain(vinyld_t, vinyld_exec_t)
+
+type vinyld_initrc_exec_t;
+init_script_file(vinyld_initrc_exec_t)
+
+type vinyld_etc_t;
+files_type(vinyld_etc_t)
+
+type vinyld_runtime_t alias vinyld_var_run_t;
+files_runtime_file(vinyld_runtime_t)
+
+type vinyld_tmp_t;
+files_tmp_file(vinyld_tmp_t)
+
+type vinyld_var_lib_t;
+files_type(vinyld_var_lib_t)
+
+type vinyllog_t;
+type vinyllog_exec_t;
+init_daemon_domain(vinyllog_t, vinyllog_exec_t)
+
+type vinyllog_initrc_exec_t;
+init_script_file(vinyllog_initrc_exec_t)
+
+type vinyllog_log_t;
+files_type(vinyllog_log_t)
+
+type vinyllog_runtime_t alias vinyllog_var_run_t;
+files_runtime_file(vinyllog_runtime_t)
+
+########################################
+#
+# Local policy
+#
+
+allow vinyld_t self:capability { dac_override ipc_lock kill setgid setuid };
+dontaudit vinyld_t self:capability sys_tty_config;
+allow vinyld_t self:process signal;
+allow vinyld_t self:fifo_file rw_fifo_file_perms;
+allow vinyld_t self:tcp_socket { accept listen };
+
+allow vinyld_t vinyld_etc_t:dir list_dir_perms;
+allow vinyld_t vinyld_etc_t:file read_file_perms;
+allow vinyld_t vinyld_etc_t:lnk_file read_lnk_file_perms;
+
+manage_dirs_pattern(vinyld_t, vinyld_tmp_t, vinyld_tmp_t)
+manage_files_pattern(vinyld_t, vinyld_tmp_t, vinyld_tmp_t)
+files_tmp_filetrans(vinyld_t, vinyld_tmp_t, { file dir })
+
+manage_dirs_pattern(vinyld_t, vinyld_var_lib_t, vinyld_var_lib_t)
+manage_files_pattern(vinyld_t, vinyld_var_lib_t, vinyld_var_lib_t)
+files_var_lib_filetrans(vinyld_t, vinyld_var_lib_t, { dir file })
+
+manage_files_pattern(vinyld_t, vinyld_runtime_t, vinyld_runtime_t)
+files_runtime_filetrans(vinyld_t, vinyld_runtime_t, file)
+
+can_exec(vinyld_t, vinyld_var_lib_t)
+
+kernel_read_system_state(vinyld_t)
+
+corecmd_exec_bin(vinyld_t)
+corecmd_exec_shell(vinyld_t)
+
+corenet_all_recvfrom_netlabel(vinyld_t)
+corenet_tcp_sendrecv_generic_if(vinyld_t)
+corenet_tcp_sendrecv_generic_node(vinyld_t)
+corenet_tcp_bind_generic_node(vinyld_t)
+
+corenet_sendrecv_http_server_packets(vinyld_t)
+corenet_tcp_bind_http_port(vinyld_t)
+corenet_sendrecv_http_client_packets(vinyld_t)
+corenet_tcp_connect_http_port(vinyld_t)
+
+corenet_sendrecv_http_cache_server_packets(vinyld_t)
+corenet_tcp_bind_http_cache_port(vinyld_t)
+corenet_sendrecv_http_cache_client_packets(vinyld_t)
+corenet_tcp_connect_http_cache_port(vinyld_t)
+
+corenet_sendrecv_vinyld_server_packets(vinyld_t)
+corenet_tcp_bind_vinyld_port(vinyld_t)
+
+dev_read_urand(vinyld_t)
+
+files_read_usr_files(vinyld_t)
+
+fs_getattr_all_fs(vinyld_t)
+
+auth_use_nsswitch(vinyld_t)
+
+logging_send_syslog_msg(vinyld_t)
+
+miscfiles_read_localization(vinyld_t)
+
+tunable_policy(`vinyld_connect_any',`
+	corenet_sendrecv_all_client_packets(vinyld_t)
+	corenet_tcp_connect_all_ports(vinyld_t)
+	corenet_sendrecv_all_server_packets(vinyld_t)
+	corenet_tcp_bind_all_ports(vinyld_t)
+')
+
+#######################################
+#
+# Log local policy
+#
+
+manage_files_pattern(vinyllog_t, vinyllog_runtime_t, vinyllog_runtime_t)
+files_runtime_filetrans(vinyllog_t, vinyllog_runtime_t, file)
+
+manage_dirs_pattern(vinyllog_t, vinyllog_log_t, vinyllog_log_t)
+append_files_pattern(vinyllog_t, vinyllog_log_t, vinyllog_log_t)
+create_files_pattern(vinyllog_t, vinyllog_log_t, vinyllog_log_t)
+setattr_files_pattern(vinyllog_t, vinyllog_log_t, vinyllog_log_t)
+logging_log_filetrans(vinyllog_t, vinyllog_log_t, { file dir })
+
+read_files_pattern(vinyllog_t, vinyld_var_lib_t, vinyld_var_lib_t)
+
+files_search_var_lib(vinyllog_t)
+
+miscfiles_read_localization(vinyllog_t)
-- 
2.52.0