49 lines
1.5 KiB
Plaintext
49 lines
1.5 KiB
Plaintext
|
#DESC arpwatch - keep track of ethernet/ip address pairings
|
||
|
|
#
|
||
|
|
# Author: Dan Walsh <dwalsh@redhat.com>
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the arpwatch_t domain.
|
||
|
|
#
|
||
|
|
# arpwatch_exec_t is the type of the arpwatch executable.
|
||
|
|
#
|
||
|
|
daemon_domain(arpwatch, `, privmail')
|
||
|
|
|
||
|
|
# for files created by arpwatch
|
||
|
|
type arpwatch_data_t, file_type, sysadmfile;
|
||
|
|
create_dir_file(arpwatch_t,arpwatch_data_t)
|
||
|
|
tmp_domain(arpwatch)
|
||
|
|
|
||
|
|
allow arpwatch_t self:capability { net_admin net_raw setgid setuid };
|
||
|
|
|
||
|
|
can_network_server(arpwatch_t)
|
||
|
|
allow arpwatch_t self:netlink_route_socket r_netlink_socket_perms;
|
||
|
|
allow arpwatch_t self:udp_socket create_socket_perms;
|
||
|
|
allow arpwatch_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow arpwatch_t self:packet_socket create_socket_perms;
|
||
|
|
allow arpwatch_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
|
||
|
|
allow arpwatch_t { sbin_t var_lib_t }:dir search;
|
||
|
|
allow arpwatch_t sbin_t:lnk_file read;
|
||
|
|
r_dir_file(arpwatch_t, etc_t)
|
||
|
|
r_dir_file(arpwatch_t, usr_t)
|
||
|
|
can_ypbind(arpwatch_t)
|
||
|
|
|
||
|
|
ifdef(`qmail.te', `
|
||
|
|
allow arpwatch_t bin_t:dir search;
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`distro_gentoo', `
|
||
|
|
allow initrc_t arpwatch_data_t:dir { add_name write };
|
||
|
|
allow initrc_t arpwatch_data_t:file create;
|
||
|
|
')dnl end distro_gentoo
|
||
|
|
|
||
|
|
# why is mail delivered to a directory of type arpwatch_data_t?
|
||
|
|
allow mta_delivery_agent arpwatch_data_t:dir search;
|
||
|
|
allow { system_mail_t mta_user_agent } arpwatch_tmp_t:file rw_file_perms;
|
||
|
|
ifdef(`hide_broken_symptoms', `
|
||
|
|
dontaudit { system_mail_t mta_user_agent } arpwatch_t:packet_socket { read write };
|
||
|
|
')
|