SELinux Policy

SELinux Policy

Below are the files sqlbak.fc and sqlbak.te for configuring the SELinux policy. This policy is minimal and not complete, as additional privileges may be required depending on the type of database and backup settings. For example, when backing up PostgreSQL, type transitions may be needed to run the psql/pg_dump utilities, as well as access to the directories where these utilities are stored. Use setenforce 0 and audit2allow to grant broader permissions.

SqlBak runs on .NET, and although sqlbak is a self-contained application, meaning it includes a minimal set of .NET libraries, the .NET runtime itself still requires dynamic compilation and various privileges for proper operation. These privileges are listed in the section permissions needed for .NET.

We strive to keep this policy up to date. If you encounter any issues while using it, please contact our support.

sqlbak.fc

 

/opt/sqlbak3/Pranas.SqlBak3.App.Service         gen_context(system_u:object_r:sqlbak_exec_t)
/opt/sqlbak3/sqlbak         gen_context(system_u:object_r:sqlbak_exec_t)
/opt/sqlbak3(/.*)?        gen_context(system_u:object_r:sqlbak_opt_t)
/etc/sqlbak3(/.*)?         gen_context(system_u:object_r:sqlbak_etc_t)
/var/log/sqlbak3(/.*)?       gen_context(system_u:object_r:sqlbak_log_t)
/opt/sqlbak3/sqlbak-wrapper.sh  gen_context(system_u:object_r:sqlbak_exec_t)

sqlbak.te

 

policy_module(sqlbak, 1.0);

require {

    attribute domain;
    attribute file_type;

    class chr_file { append ioctl open read write };
    class dir { getattr open read search };
    class fd use;
    class fifo_file { getattr ioctl };
    class file { execute execute_no_trans getattr ioctl lock map open read setattr unlink };
    class filesystem associate;
    class lnk_file { getattr read };
    class process { noatsecure rlimitinh siginh };
    class sock_file write;
    class unix_stream_socket connectto;

    role unconfined_r;

    type admin_home_t;
    type bin_t;
    type cgroup_t;
    type cpu_online_t;
    type devtty_t;
    type etc_t;
    type fs_t;
    type home_root_t;
    type init_t;
    type initrc_t;
    type ld_so_cache_t;
    type ld_so_t;
    type lib_t;
    type locale_t;
    type null_device_t;
    type passwd_file_t;
    type proc_net_t;
    type proc_t;
    type root_t;
    type samba_etc_t;
    type sbin_t;
    type shell_exec_t;
    type shlib_t;
    type sqlbak_exec_t;
    type sqlbak_log_t;
    type sqlbak_opt_t;
    type sqlbak_t;
    type sshd_session_t;
    type sysctl_crypto_t;
    type sysctl_vm_overcommit_t;
    type sysctl_vm_t;
    type systemd_coredump_t;
    type systemd_resolved_t;
    type systemd_resolved_var_run_t;
    type tmp_t;
    type tmpfs_t;
    type unconfined_t;
    type user_devpts_t;
    type user_home_dir_t;
    type var_lib_t;
    type var_log_t;
    type var_run_t;
}

# sqlbak types
type sqlbak_t;
type sqlbak_exec_t;
type sqlbak_opt_t;
type sqlbak_etc_t;
type sqlbak_log_t;

# for running the sqlbak utility to configure the backup agent
role unconfined_r types sqlbak_t;
type_transition unconfined_t sqlbak_exec_t : process sqlbak_t;
allow unconfined_t sqlbak_t:process { transition noatsecure rlimitinh siginh };
allow unconfined_t sqlbak_exec_t:file { read open execute };
allow unconfined_t sqlbak_t:file { read open execute getattr ioctl};
allow unconfined_t sqlbak_t:dir search;
allow unconfined_t sqlbak_opt_t:dir search;

# for working and running under systemctl
init_daemon_domain(sqlbak_t, sqlbak_exec_t)
role system_r types sqlbak_t;
allow init_t sqlbak_exec_t:file { execute entrypoint getattr open read map };
allow init_t sqlbak_opt_t:dir { read search getattr open write add_name remove_name };
allow init_t sqlbak_opt_t:file { read getattr open execute map execute_no_trans entrypoint lock ioctl };
allow init_t sqlbak_etc_t:dir search;
allow sqlbak_t init_t:fd use;
allow sqlbak_t init_t:unix_stream_socket { read write };

# sqlbak access to itself
allow sqlbak_t self:unix_stream_socket { connectto create connect bind listen accept };
allow sqlbak_t self:fd use;
allow sqlbak_t self:fifo_file { read write getattr ioctl };
allow sqlbak_t self:shm { create read write destroy getattr setattr lock};
allow sqlbak_t self:capability *;
allow sqlbak_t self:capability2 { block_suspend audit_read };
allow sqlbak_t self:filesystem { mount unmount remount };
allow sqlbak_t self:file { create read write append execute getattr setattr lock ioctl link unlink rename open };
allow sqlbak_t self:rawip_socket { create bind connect getattr setattr };
allow sqlbak_t self:dir { create read write add_name remove_name search getattr setattr };
allow sqlbak_t self:lnk_file { read getattr };
allow sqlbak_t self:unix_dgram_socket { create ioctl };
allow sqlbak_t self:unix_dgram_socket { create connect bind };
allow sqlbak_t self:process *;

# ability for main sqlbak process to launch itself
type_transition sqlbak_t sqlbak_exec_t:process sqlbak_t;
allow sqlbak_t sqlbak_t:process { fork execmem execstack sigchld sigkill signal signull sigstop };
allow sqlbak_t sqlbak_exec_t:file { entrypoint execute getattr open read map };

# permissions on sqlbak directories
allow sqlbak_exec_t sqlbak_exec_t:file entrypoint;

allow sqlbak_t sqlbak_opt_t:dir *;
allow sqlbak_t sqlbak_opt_t:file *;

allow sqlbak_t sqlbak_etc_t:file *;
allow sqlbak_t sqlbak_etc_t:dir *;

allow sqlbak_t sqlbak_log_t:dir *;
allow sqlbak_t sqlbak_log_t:file *;

# permissions for temporary files
allow sqlbak_t tmp_t:dir *;
allow sqlbak_t tmp_t:fifo_file *;
allow sqlbak_t tmp_t:file *;
allow sqlbak_t tmp_t:sock_file { create read getattr setattr unlink write}; # for inter-process communication within sqlbak
allow sqlbak_t tmpfs_t:file { map execute read write create unlink };
allow sqlbak_t tmpfs_t:dir { read search getattr write add_name remove_name create };

# allow associating security labels with the filesystem
allow sqlbak_t sqlbak_etc_t:filesystem associate;
allow sqlbak_etc_t fs_t:filesystem associate;
allow sqlbak_t fs_t:filesystem getattr;
allow sqlbak_exec_t fs_t:filesystem associate;
allow sqlbak_log_t fs_t:filesystem associate;
allow sqlbak_opt_t fs_t:filesystem associate;

# ability to read user groups (sqlbak creates its own user group during installation)
allow sqlbak_t cgroup_t:dir search;
allow sqlbak_t cgroup_t:file { read getattr open };
allow sqlbak_t cgroup_t:filesystem getattr;

# permissions needed for .NET
allow sqlbak_t cpu_online_t:file { open read };
allow sqlbak_t null_device_t:chr_file { read write open getattr ioctl };
allow sqlbak_t sysctl_crypto_t:dir search;
allow sqlbak_t sysctl_crypto_t:file { open read };
allow sqlbak_t sysctl_vm_overcommit_t:file { open read };
allow sqlbak_t user_devpts_t:chr_file { read write ioctl append};
allow sqlbak_t admin_home_t:dir { getattr search };
allow sqlbak_t shell_exec_t:file { execute execute_no_trans getattr map open read };
allow sqlbak_t sshd_session_t:fd use;
allow sqlbak_t root_t:file { read getattr open };
allow sqlbak_t root_t:dir { read search getattr };
allow sqlbak_t lib_t:file { execute execute_no_trans execmod getattr read map open };
allow sqlbak_t lib_t:dir { read search getattr };
allow sqlbak_t lib_t:lnk_file { read getattr };
allow sqlbak_t var_lib_t:dir search;
allow sqlbak_t ld_so_t:file { execute execute_no_trans getattr open read map };
allow sqlbak_t ld_so_cache_t:file { read open };
kernel_read_proc_files(sqlbak_t)
dev_read_sysfs(sqlbak_t)
dev_read_urand(sqlbak_t)
dev_read_rand(sqlbak_t)

## locale access
allow sqlbak_t locale_t:dir search;
allow sqlbak_t locale_t:file { lock getattr read open };
allow sqlbak_t locale_t:lnk_file { getattr read };

## Ability to run system binaries
allow sqlbak_t bin_t:file { execute execute_no_trans getattr open read map };
allow sqlbak_t bin_t:dir search;
allow sqlbak_t bin_t:lnk_file {read getattr};

## read filesystem attributes
allow sqlbak_t sysfs_t:dir { read search getattr open };
allow sqlbak_t sysfs_t:file { read getattr open lock ioctl };
allow sqlbak_t sysfs_t:lnk_file read;

# network access and dashboard interaction
sysnet_dns_name_resolve(sqlbak_t)
kernel_read_net_sysctls(sqlbak_t)
corenet_tcp_connect_all_ports(sqlbak_t)
corenet_udp_send_all_ports(sqlbak_t)

# for debugging in case of a crash
allow systemd_coredump_t sqlbak_opt_t:dir search;
allow systemd_coredump_t sqlbak_opt_t:file { open getattr map read };