Chapter 4. Example Policy Reference - dhcpd
This chapter provides an understanding of how the policy works with the
dhcpd daemon. This daemon ships as part of the dhcp
package. This chapter first discusses the locations and purposes of key
policy files, and then policy types are explained. This chapter serves as a
reference analysis that can be applied to all of the targeted daemons.
Analysis in this file results from direct investigation of the policy files
as well as extensive usage of apol, which is
discussed in Chapter 6 Tools for Manipulating and Analyzing SELinux.
This section covers the various top level files that comprise the policy
for dhcpd. Refer to Section 4.2 Policy Types - dhcpd for a description of what the types
are allowed to do.
- $SELINUX_POLICY/domains/program/dhcpd.te
This file defines the policy rules for the dhcpd domain,
dhcpd_t. These rules are discussed
in Section 4.2 Policy Types - dhcpd. Because the type enforcement
file calls macros that are defined elsewhere, the
dhcpd.te file is only the starting point for
the policy. The policy building process expands the macros into
many more lines of rules.
- $SELINUX_POLICY/file_contexts/program/dhcpd.fc
This defines the security context for files associated with the
dhcpd server daemon, assigning them one of the
dhcp_<*>_t
types:
# dhcpd
/etc/dhcpd.conf -- system_u:object_r:dhcp_etc_t
/etc/dhcp3(/.*)? system_u:object_r:dhcp_etc_t
/usr/sbin/dhcpd.* -- system_u:object_r:dhcpd_exec_t
/var/lib/dhcp(3)?/dhcpd\.leases.* -- \
system_u:object_r:dhcpd_state_t
/var/run/dhcpd\.pid -d system_u:object_r:dhcpd_var_run_t
ifdef(`dhcp_defined', `', `
/var/lib/dhcp(3)? -d system_u:object_r:dhcp_state_t
define(`dhcp_defined')
') |
 | Note |
|---|
| | As you are looking for dhcpd.fc, you see
there are a large number of file contexts files in
$SELINUX_POLICY/file_contexts/program/. Most of
these files are unused. The context files are not pulled into the
policy without a corresponding TE file in the
$SELINUX_POLICY/domains/ path.
|
The context file contains an ifdef
statement; the purpose here is to make certain the shared directory
/var/lib/dhcp is available without declaring it
multiple times. This is discussed in detail in Example 3-1.
