121 lines
2.5 KiB
Diff
121 lines
2.5 KiB
Diff
From 80978901354b17cf3460d5d4451b48b59a9204ae Mon Sep 17 00:00:00 2001
|
|
From: Stefano Brivio <sbrivio@redhat.com>
|
|
Date: Fri, 10 Mar 2023 17:00:31 +0000
|
|
Subject: [PATCH 19/20] contrib/selinux: Split interfaces into smaller bits
|
|
|
|
...to fit accepted Fedora practices.
|
|
|
|
Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
|
|
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
|
|
(cherry picked from commit 93105ea06619d4c199f8140f4b75ae359757dc6d)
|
|
---
|
|
contrib/selinux/passt.if | 71 ++++++++++++++++++++++++++++++++++------
|
|
1 file changed, 61 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/contrib/selinux/passt.if b/contrib/selinux/passt.if
|
|
index 3e37c5b..f7560a7 100644
|
|
--- a/contrib/selinux/passt.if
|
|
+++ b/contrib/selinux/passt.if
|
|
@@ -17,37 +17,88 @@ interface(`passt_domtrans',`
|
|
domtrans_pattern($1, passt_exec_t, passt_t)
|
|
')
|
|
|
|
-interface(`passt_socket',`
|
|
+interface(`passt_socket_dir',`
|
|
+ gen_require(`
|
|
+ type passt_t;
|
|
+ ')
|
|
+
|
|
+ allow passt_t $1:dir add_entry_dir_perms;
|
|
+')
|
|
+
|
|
+interface(`passt_socket_create',`
|
|
+ gen_require(`
|
|
+ type passt_t;
|
|
+ ')
|
|
+
|
|
+ allow passt_t $1:sock_file create;
|
|
+')
|
|
+
|
|
+interface(`passt_socket_use',`
|
|
gen_require(`
|
|
type passt_t;
|
|
')
|
|
|
|
- allow $1 $2:sock_file write;
|
|
allow $1 passt_t:unix_stream_socket connectto;
|
|
+ allow $1 $2:sock_file { read write };
|
|
+ allow passt_t $2:sock_file { read write };
|
|
+')
|
|
+
|
|
+interface(`passt_socket_delete',`
|
|
+ gen_require(`
|
|
+ type passt_t;
|
|
+ ')
|
|
+
|
|
+ allow $1 $2:sock_file unlink;
|
|
+')
|
|
+
|
|
+interface(`passt_logfile_dir',`
|
|
+ gen_require(`
|
|
+ type passt_t;
|
|
+ ')
|
|
|
|
- allow passt_t $2:sock_file { create read write unlink };
|
|
+ allow passt_t $1:dir add_entry_dir_perms;
|
|
')
|
|
|
|
-interface(`passt_logfile',`
|
|
+interface(`passt_logfile_use',`
|
|
gen_require(`
|
|
type passt_t;
|
|
')
|
|
|
|
logging_log_file($1);
|
|
- allow passt_t $1:dir { search write add_name };
|
|
allow passt_t $1:file { create open read write };
|
|
')
|
|
|
|
-interface(`passt_pidfile',`
|
|
+interface(`passt_pidfile_dir',`
|
|
+ gen_require(`
|
|
+ type passt_t;
|
|
+ ')
|
|
+
|
|
+ allow passt_t $1:dir add_entry_dir_perms;
|
|
+')
|
|
+
|
|
+interface(`passt_pidfile_write',`
|
|
+ gen_require(`
|
|
+ type passt_t;
|
|
+ ')
|
|
+
|
|
+ files_pid_file($1);
|
|
+ allow passt_t $1:file { create open write };
|
|
+')
|
|
+
|
|
+interface(`passt_pidfile_read',`
|
|
gen_require(`
|
|
type passt_t;
|
|
')
|
|
|
|
- allow $1 $2:file { open read unlink };
|
|
+ allow $1 $2:file { open read };
|
|
+')
|
|
+
|
|
+interface(`passt_pidfile_delete',`
|
|
+ gen_require(`
|
|
+ type passt_t;
|
|
+ ')
|
|
|
|
- files_pid_file($2);
|
|
- allow passt_t $2:dir { search write add_name };
|
|
- allow passt_t $2:file { create open write };
|
|
+ allow $1 $2:file unlink;
|
|
')
|
|
|
|
interface(`passt_kill',`
|
|
--
|
|
2.39.2
|
|
|