selinux-policy/policy/modules/services/icecast.te

policy_module(icecast, 1.0.1)

########################################
#
# Declarations
#

## <desc>
##	<p>
##	Allow icecast to connect to all ports, not just
##	sound ports.
##	</p>
## </desc>
gen_tunable(icecast_connect_any, false)

type icecast_t;
type icecast_exec_t;
init_daemon_domain(icecast_t, icecast_exec_t)

type icecast_initrc_exec_t;
init_script_file(icecast_initrc_exec_t)

type icecast_var_run_t;
files_pid_file(icecast_var_run_t)

type icecast_log_t;
logging_log_file(icecast_log_t)

########################################
#
# icecast local policy
#

allow icecast_t self:capability { dac_override setgid setuid sys_nice };
allow icecast_t self:process { getsched fork setsched signal };
allow icecast_t self:fifo_file rw_fifo_file_perms;
allow icecast_t self:unix_stream_socket create_stream_socket_perms;
allow icecast_t self:tcp_socket create_stream_socket_perms;

manage_dirs_pattern(icecast_t, icecast_log_t, icecast_log_t)
manage_files_pattern(icecast_t, icecast_log_t, icecast_log_t)
logging_log_filetrans(icecast_t, icecast_log_t, { file dir })

manage_dirs_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)
manage_files_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)
files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir })

kernel_read_system_state(icecast_t)

corenet_tcp_bind_soundd_port(icecast_t)
corenet_tcp_connect_soundd_port(icecast_t)

tunable_policy(`icecast_connect_any',`
	corenet_tcp_connect_all_ports(icecast_t)
	corenet_tcp_bind_all_ports(icecast_t)
	corenet_sendrecv_all_packets(icecast_t)
')

# Init script handling
domain_use_interactive_fds(icecast_t)

files_read_etc_files(icecast_t)

auth_use_nsswitch(icecast_t)

miscfiles_read_localization(icecast_t)

sysnet_dns_name_resolve(icecast_t)

optional_policy(`
	apache_read_sys_content(icecast_t)
')

optional_policy(`
	rtkit_scheduled(icecast_t)
')
Module version bump for c17ad38 5271920 2a2b6a7 01c4413 c4fbfae a831710 67effb0 483be01 c6c63f6 b0d8d59 5b082e4 b8097d6 689d954 5afc3d3 f3c5e77 a59e50c cf87233 17759c7 dc1db54 e9bf16d 4f95198 bf40792 622c63b c20842c dc7cc4d 792d448 2010-09-15 14:42:34 +00:00			`policy_module(icecast, 1.0.1)`
icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

Allow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port 2010-09-07 20:23:09 +00:00			`## <desc>`
Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. 2010-09-22 10:07:37 +00:00			`## <p>`
			`## Allow icecast to connect to all ports, not just`
			`## sound ports.`
			`## </p>`
Allow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port 2010-09-07 20:23:09 +00:00			`## </desc>`
			`gen_tunable(icecast_connect_any, false)`

icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00			`type icecast_t;`
			`type icecast_exec_t;`
			`init_daemon_domain(icecast_t, icecast_exec_t)`

			`type icecast_initrc_exec_t;`
			`init_script_file(icecast_initrc_exec_t)`

			`type icecast_var_run_t;`
			`files_pid_file(icecast_var_run_t)`

			`type icecast_log_t;`
			`logging_log_file(icecast_log_t)`

			`########################################`
			`#`
			`# icecast local policy`
			`#`

			`allow icecast_t self:capability { dac_override setgid setuid sys_nice };`
			`allow icecast_t self:process { getsched fork setsched signal };`
			`allow icecast_t self:fifo_file rw_fifo_file_perms;`
			`allow icecast_t self:unix_stream_socket create_stream_socket_perms;`
			`allow icecast_t self:tcp_socket create_stream_socket_perms;`

Minor tweaks on icecast. 2010-03-22 12:56:32 +00:00			`manage_dirs_pattern(icecast_t, icecast_log_t, icecast_log_t)`
			`manage_files_pattern(icecast_t, icecast_log_t, icecast_log_t)`
Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. 2010-09-22 10:07:37 +00:00			`logging_log_filetrans(icecast_t, icecast_log_t, { file dir })`
icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00
Minor tweaks on icecast. 2010-03-22 12:56:32 +00:00			`manage_dirs_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)`
			`manage_files_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)`
icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00			`files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir })`

UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`kernel_read_system_state(icecast_t)`

icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00			`corenet_tcp_bind_soundd_port(icecast_t)`
Policy fixes 2010-08-30 12:57:06 +00:00			`corenet_tcp_connect_soundd_port(icecast_t)`
icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00
Allow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port 2010-09-07 20:23:09 +00:00			tunable_policy(`icecast_connect_any',`
			`corenet_tcp_connect_all_ports(icecast_t)`
			`corenet_tcp_bind_all_ports(icecast_t)`
			`corenet_sendrecv_all_packets(icecast_t)`
			`')`

icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00			`# Init script handling`
			`domain_use_interactive_fds(icecast_t)`

			`files_read_etc_files(icecast_t)`

			`auth_use_nsswitch(icecast_t)`

			`miscfiles_read_localization(icecast_t)`

			`sysnet_dns_name_resolve(icecast_t)`

UPdate for f14 policy 2010-08-26 13:41:21 +00:00			optional_policy(`
			`apache_read_sys_content(icecast_t)`
			`')`

icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00			optional_policy(`
Rename rtkit_schedule() to rtkit_scheduled(). 2010-03-22 13:54:58 +00:00			`rtkit_scheduled(icecast_t)`
icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule 2010-03-19 19:46:59 +00:00			`')`