selinux-policy/policy/modules/services/clamav.te


policy_module(clamav, 1.6.0)

########################################
#
# Declarations
#

# Main clamd domain
type clamd_t;
type clamd_exec_t;
init_daemon_domain(clamd_t, clamd_exec_t)

# configuration files
type clamd_etc_t;
files_type(clamd_etc_t)

# tmp files
type clamd_tmp_t;
files_tmp_file(clamd_tmp_t)

# log files
type clamd_var_log_t;
logging_log_file(clamd_var_log_t)

# var/lib files
type clamd_var_lib_t;
files_type(clamd_var_lib_t)

# pid files
type clamd_var_run_t;
files_pid_file(clamd_var_run_t)
typealias clamd_var_run_t alias clamd_sock_t;

type clamscan_t;
type clamscan_exec_t;
init_daemon_domain(clamscan_t, clamscan_exec_t)

# tmp files
type clamscan_tmp_t;
files_tmp_file(clamscan_tmp_t)

type freshclam_t;
type freshclam_exec_t;
init_daemon_domain(freshclam_t, freshclam_exec_t)

# log files
type freshclam_var_log_t;
logging_log_file(freshclam_var_log_t)

########################################
#
# clamd local policy
#

allow clamd_t self:capability { kill setgid setuid dac_override };
allow clamd_t self:fifo_file rw_fifo_file_perms;
allow clamd_t self:unix_stream_socket create_stream_socket_perms;
allow clamd_t self:unix_dgram_socket create_socket_perms;
allow clamd_t self:tcp_socket { listen accept };

# configuration files
allow clamd_t clamd_etc_t:dir list_dir_perms;
read_files_pattern(clamd_t, clamd_etc_t, clamd_etc_t)
read_lnk_files_pattern(clamd_t, clamd_etc_t, clamd_etc_t)

# tmp files
manage_dirs_pattern(clamd_t, clamd_tmp_t, clamd_tmp_t)
manage_files_pattern(clamd_t, clamd_tmp_t, clamd_tmp_t)
files_tmp_filetrans(clamd_t, clamd_tmp_t, { file dir })

# var/lib files for clamd
manage_dirs_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)
manage_files_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)

# log files
manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
manage_files_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file })

# pid file
manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
files_pid_filetrans(clamd_t, clamd_var_run_t, { file dir })

kernel_dontaudit_list_proc(clamd_t)
kernel_read_sysctl(clamd_t)
kernel_read_kernel_sysctls(clamd_t)

corenet_all_recvfrom_unlabeled(clamd_t)
corenet_all_recvfrom_netlabel(clamd_t)
corenet_tcp_sendrecv_all_if(clamd_t)
corenet_tcp_sendrecv_all_nodes(clamd_t)
corenet_tcp_sendrecv_all_ports(clamd_t)
corenet_tcp_sendrecv_clamd_port(clamd_t)
corenet_tcp_bind_all_nodes(clamd_t)
corenet_tcp_bind_clamd_port(clamd_t)
corenet_sendrecv_clamd_server_packets(clamd_t)

dev_read_rand(clamd_t)
dev_read_urand(clamd_t)

domain_use_interactive_fds(clamd_t)

files_read_etc_files(clamd_t)
files_read_etc_runtime_files(clamd_t)
files_search_spool(clamd_t)

libs_use_ld_so(clamd_t)
libs_use_shared_libs(clamd_t)

logging_send_syslog_msg(clamd_t)

miscfiles_read_localization(clamd_t)

sysnet_dns_name_resolve(clamd_t)

cron_use_fds(clamd_t)
cron_use_system_job_fds(clamd_t)
cron_rw_pipes(clamd_t)

optional_policy(`
	amavis_read_lib_files(clamd_t)
	amavis_read_spool_files(clamd_t)
	amavis_spool_filetrans(clamd_t,clamd_var_run_t,sock_file)
	amavis_create_pid_files(clamd_t)
')

########################################
#
# Freshclam local policy
#

allow freshclam_t self:capability { setgid setuid dac_override };
allow freshclam_t self:fifo_file rw_fifo_file_perms;
allow freshclam_t self:unix_stream_socket create_stream_socket_perms;
allow freshclam_t self:unix_dgram_socket create_socket_perms;
allow freshclam_t self:tcp_socket { listen accept };

# configuration files
allow freshclam_t clamd_etc_t:dir list_dir_perms;
read_files_pattern(freshclam_t, clamd_etc_t, clamd_etc_t)
read_lnk_files_pattern(freshclam_t, clamd_etc_t, clamd_etc_t)

# var/lib files together with clamd
manage_dirs_pattern(freshclam_t, clamd_var_lib_t, clamd_var_lib_t)
manage_files_pattern(freshclam_t, clamd_var_lib_t, clamd_var_lib_t)

# pidfiles- var/run together with clamd
manage_files_pattern(freshclam_t, clamd_var_run_t, clamd_var_run_t)
manage_sock_files_pattern(freshclam_t, clamd_var_run_t, clamd_var_run_t)
files_pid_filetrans(freshclam_t, clamd_var_run_t, file)

# log files (own logfiles only)
manage_files_pattern(freshclam_t, freshclam_var_log_t, freshclam_var_log_t)
allow freshclam_t freshclam_var_log_t:dir setattr;
allow freshclam_t clamd_var_log_t:dir search_dir_perms;
logging_log_filetrans(freshclam_t, freshclam_var_log_t, file)

corenet_all_recvfrom_unlabeled(freshclam_t)
corenet_all_recvfrom_netlabel(freshclam_t)
corenet_tcp_sendrecv_all_if(freshclam_t)
corenet_tcp_sendrecv_all_nodes(freshclam_t)
corenet_tcp_sendrecv_all_ports(freshclam_t)
corenet_tcp_sendrecv_clamd_port(freshclam_t)
corenet_tcp_connect_http_port(freshclam_t)
corenet_sendrecv_http_client_packets(freshclam_t)

dev_read_rand(freshclam_t)
dev_read_urand(freshclam_t)

domain_use_interactive_fds(freshclam_t)

files_read_etc_files(freshclam_t)
files_read_etc_runtime_files(freshclam_t)

libs_use_ld_so(freshclam_t)
libs_use_shared_libs(freshclam_t)

miscfiles_read_localization(freshclam_t)

sysnet_dns_name_resolve(freshclam_t)

clamav_stream_connect(freshclam_t)

cron_use_fds(freshclam_t)
cron_use_system_job_fds(freshclam_t)
cron_rw_pipes(freshclam_t)

########################################
#
# clamscam local policy
#

allow clamscan_t self:capability { setgid setuid dac_override };
allow clamscan_t self:fifo_file rw_file_perms;
allow clamscan_t self:unix_stream_socket create_stream_socket_perms;
allow clamscan_t self:unix_dgram_socket create_socket_perms;
allow clamscan_t self:tcp_socket { listen accept };

# configuration files
allow clamscan_t clamd_etc_t:dir list_dir_perms;
read_files_pattern(clamscan_t, clamd_etc_t, clamd_etc_t)
read_lnk_files_pattern(clamscan_t, clamd_etc_t, clamd_etc_t)

# tmp files
manage_dirs_pattern(clamscan_t, clamscan_tmp_t, clamscan_tmp_t)
manage_files_pattern(clamscan_t, clamscan_tmp_t, clamscan_tmp_t)
files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { file dir })

# var/lib files together with clamd
manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t)
allow clamscan_t clamd_var_lib_t:dir list_dir_perms;

kernel_read_kernel_sysctls(clamscan_t)

files_read_etc_files(clamscan_t)
files_read_etc_runtime_files(clamscan_t)
files_search_var_lib(clamscan_t)

init_read_utmp(clamscan_t)
init_dontaudit_write_utmp(clamscan_t)

libs_use_ld_so(clamscan_t)
libs_use_shared_libs(clamscan_t)

miscfiles_read_localization(clamscan_t)
miscfiles_read_public_files(clamscan_t)

clamav_stream_connect(clamscan_t)

optional_policy(`
	apache_read_sys_content(clamscan_t)
')
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`policy_module(clamav, 1.6.0)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`# Main clamd domain`
			`type clamd_t;`
			`type clamd_exec_t;`
			`init_daemon_domain(clamd_t, clamd_exec_t)`

			`# configuration files`
			`type clamd_etc_t;`
			`files_type(clamd_etc_t)`

			`# tmp files`
			`type clamd_tmp_t;`
			`files_tmp_file(clamd_tmp_t)`

			`# log files`
			`type clamd_var_log_t;`
			`logging_log_file(clamd_var_log_t)`

			`# var/lib files`
			`type clamd_var_lib_t;`
			`files_type(clamd_var_lib_t)`

			`# pid files`
			`type clamd_var_run_t;`
			`files_pid_file(clamd_var_run_t)`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`typealias clamd_var_run_t alias clamd_sock_t;`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`type clamscan_t;`
			`type clamscan_exec_t;`
			`init_daemon_domain(clamscan_t, clamscan_exec_t)`

patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00			`# tmp files`
			`type clamscan_tmp_t;`
			`files_tmp_file(clamscan_tmp_t)`

add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00			`type freshclam_t;`
			`type freshclam_exec_t;`
			`init_daemon_domain(freshclam_t, freshclam_exec_t)`

			`# log files`
			`type freshclam_var_log_t;`
			`logging_log_file(freshclam_var_log_t)`

			`########################################`
			`#`
			`# clamd local policy`
			`#`

			`allow clamd_t self:capability { kill setgid setuid dac_override };`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow clamd_t self:fifo_file rw_fifo_file_perms;`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00			`allow clamd_t self:unix_stream_socket create_stream_socket_perms;`
			`allow clamd_t self:unix_dgram_socket create_socket_perms;`
			`allow clamd_t self:tcp_socket { listen accept };`

			`# configuration files`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow clamd_t clamd_etc_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(clamd_t, clamd_etc_t, clamd_etc_t)`
			`read_lnk_files_pattern(clamd_t, clamd_etc_t, clamd_etc_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`# tmp files`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(clamd_t, clamd_tmp_t, clamd_tmp_t)`
			`manage_files_pattern(clamd_t, clamd_tmp_t, clamd_tmp_t)`
			`files_tmp_filetrans(clamd_t, clamd_tmp_t, { file dir })`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`# var/lib files for clamd`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)`
			`manage_files_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`# log files`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)`
			`manage_files_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)`
			`logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file })`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`# pid file`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)`
			`manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)`
			`manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)`
			`files_pid_filetrans(clamd_t, clamd_var_run_t, { file dir })`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`kernel_dontaudit_list_proc(clamd_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`kernel_read_sysctl(clamd_t)`
trunk: 4 patches from dan. 2007-09-05 14:48:21 +00:00			`kernel_read_kernel_sysctls(clamd_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(clamd_t)`
			`corenet_all_recvfrom_netlabel(clamd_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00			`corenet_tcp_sendrecv_all_if(clamd_t)`
			`corenet_tcp_sendrecv_all_nodes(clamd_t)`
			`corenet_tcp_sendrecv_all_ports(clamd_t)`
			`corenet_tcp_sendrecv_clamd_port(clamd_t)`
			`corenet_tcp_bind_all_nodes(clamd_t)`
packets for services 2006-05-30 19:46:34 +00:00			`corenet_tcp_bind_clamd_port(clamd_t)`
			`corenet_sendrecv_clamd_server_packets(clamd_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`dev_read_rand(clamd_t)`
			`dev_read_urand(clamd_t)`

			`domain_use_interactive_fds(clamd_t)`

			`files_read_etc_files(clamd_t)`
			`files_read_etc_runtime_files(clamd_t)`
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00			`files_search_spool(clamd_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`libs_use_ld_so(clamd_t)`
			`libs_use_shared_libs(clamd_t)`

patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00			`logging_send_syslog_msg(clamd_t)`

add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00			`miscfiles_read_localization(clamd_t)`

			`sysnet_dns_name_resolve(clamd_t)`

			`cron_use_fds(clamd_t)`
			`cron_use_system_job_fds(clamd_t)`
			`cron_rw_pipes(clamd_t)`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00			`amavis_read_lib_files(clamd_t)`
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00			`amavis_read_spool_files(clamd_t)`
			`amavis_spool_filetrans(clamd_t,clamd_var_run_t,sock_file)`
trunk: pyzor and clamav updates from dan 2007-06-26 18:43:11 +00:00			`amavis_create_pid_files(clamd_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00			`')`

			`########################################`
			`#`
			`# Freshclam local policy`
			`#`

			`allow freshclam_t self:capability { setgid setuid dac_override };`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow freshclam_t self:fifo_file rw_fifo_file_perms;`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00			`allow freshclam_t self:unix_stream_socket create_stream_socket_perms;`
			`allow freshclam_t self:unix_dgram_socket create_socket_perms;`
			`allow freshclam_t self:tcp_socket { listen accept };`

			`# configuration files`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow freshclam_t clamd_etc_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(freshclam_t, clamd_etc_t, clamd_etc_t)`
			`read_lnk_files_pattern(freshclam_t, clamd_etc_t, clamd_etc_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`# var/lib files together with clamd`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(freshclam_t, clamd_var_lib_t, clamd_var_lib_t)`
			`manage_files_pattern(freshclam_t, clamd_var_lib_t, clamd_var_lib_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`# pidfiles- var/run together with clamd`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(freshclam_t, clamd_var_run_t, clamd_var_run_t)`
			`manage_sock_files_pattern(freshclam_t, clamd_var_run_t, clamd_var_run_t)`
			`files_pid_filetrans(freshclam_t, clamd_var_run_t, file)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`# log files (own logfiles only)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(freshclam_t, freshclam_var_log_t, freshclam_var_log_t)`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow freshclam_t freshclam_var_log_t:dir setattr;`
			`allow freshclam_t clamd_var_log_t:dir search_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`logging_log_filetrans(freshclam_t, freshclam_var_log_t, file)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(freshclam_t)`
			`corenet_all_recvfrom_netlabel(freshclam_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00			`corenet_tcp_sendrecv_all_if(freshclam_t)`
			`corenet_tcp_sendrecv_all_nodes(freshclam_t)`
			`corenet_tcp_sendrecv_all_ports(freshclam_t)`
			`corenet_tcp_sendrecv_clamd_port(freshclam_t)`
			`corenet_tcp_connect_http_port(freshclam_t)`
packets for services 2006-05-30 19:46:34 +00:00			`corenet_sendrecv_http_client_packets(freshclam_t)`
add amavis and clamav from Erich Schubert 2006-03-07 21:15:24 +00:00
			`dev_read_rand(freshclam_t)`
			`dev_read_urand(freshclam_t)`

			`domain_use_interactive_fds(freshclam_t)`

			`files_read_etc_files(freshclam_t)`
			`files_read_etc_runtime_files(freshclam_t)`

			`libs_use_ld_so(freshclam_t)`
			`libs_use_shared_libs(freshclam_t)`

			`miscfiles_read_localization(freshclam_t)`

			`sysnet_dns_name_resolve(freshclam_t)`

			`clamav_stream_connect(freshclam_t)`

			`cron_use_fds(freshclam_t)`
			`cron_use_system_job_fds(freshclam_t)`
			`cron_rw_pipes(freshclam_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
			`########################################`
			`#`
			`# clamscam local policy`
			`#`

			`allow clamscan_t self:capability { setgid setuid dac_override };`
			`allow clamscan_t self:fifo_file rw_file_perms;`
			`allow clamscan_t self:unix_stream_socket create_stream_socket_perms;`
			`allow clamscan_t self:unix_dgram_socket create_socket_perms;`
			`allow clamscan_t self:tcp_socket { listen accept };`

			`# configuration files`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow clamscan_t clamd_etc_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(clamscan_t, clamd_etc_t, clamd_etc_t)`
			`read_lnk_files_pattern(clamscan_t, clamd_etc_t, clamd_etc_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00			`# tmp files`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(clamscan_t, clamscan_tmp_t, clamscan_tmp_t)`
			`manage_files_pattern(clamscan_t, clamscan_tmp_t, clamscan_tmp_t)`
			`files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { file dir })`
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`# var/lib files together with clamd`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t)`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow clamscan_t clamd_var_lib_t:dir list_dir_perms;`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
			`kernel_read_kernel_sysctls(clamscan_t)`

			`files_read_etc_files(clamscan_t)`
			`files_read_etc_runtime_files(clamscan_t)`
			`files_search_var_lib(clamscan_t)`

trunk: 4 patches from dan. 2007-09-05 14:48:21 +00:00			`init_read_utmp(clamscan_t)`
			`init_dontaudit_write_utmp(clamscan_t)`

most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`libs_use_ld_so(clamscan_t)`
			`libs_use_shared_libs(clamscan_t)`

			`miscfiles_read_localization(clamscan_t)`
			`miscfiles_read_public_files(clamscan_t)`

			`clamav_stream_connect(clamscan_t)`

			optional_policy(`
			`apache_read_sys_content(clamscan_t)`
			`')`