rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
923aa2ad32
selinux-policy/policy/modules/services/tgtd.te

75 lines
1.9 KiB
Plaintext
Raw Normal View History

Bump module versions for release.
2010-05-24 19:32:01 +00:00
policy_module(tgtd, 1.1.0)
RESET tgtd daemon. This one makes an effort to check for syntax and that it actually compiles. Signed-off-by: Matthew Ife <deleriux@airattack-central.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2009-10-28 17:00:03 +00:00
########################################
#
# TGTD personal declarations.
#
type tgtd_t;
type tgtd_exec_t;
init_daemon_domain(tgtd_t, tgtd_exec_t)
type tgtd_initrc_exec_t;
init_script_file(tgtd_initrc_exec_t)
type tgtd_tmp_t;
files_tmp_file(tgtd_tmp_t)
type tgtd_tmpfs_t;
files_tmpfs_file(tgtd_tmpfs_t)
type tgtd_var_lib_t;
files_type(tgtd_var_lib_t)
########################################
#
# TGTD personal policy.
#
allow tgtd_t self:capability sys_resource;
allow tgtd_t self:process { setrlimit signal };
allow tgtd_t self:fifo_file rw_fifo_file_perms;
Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible.
2010-09-24 07:28:34 +00:00
allow tgtd_t self:netlink_route_socket create_netlink_socket_perms;
RESET tgtd daemon. This one makes an effort to check for syntax and that it actually compiles. Signed-off-by: Matthew Ife <deleriux@airattack-central.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2009-10-28 17:00:03 +00:00
allow tgtd_t self:shm create_shm_perms;
allow tgtd_t self:sem create_sem_perms;
clean up 0bca409 and add changelog entry.
2009-11-03 14:25:37 +00:00
allow tgtd_t self:tcp_socket create_stream_socket_perms;
RESET tgtd daemon. This one makes an effort to check for syntax and that it actually compiles. Signed-off-by: Matthew Ife <deleriux@airattack-central.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2009-10-28 17:00:03 +00:00
allow tgtd_t self:udp_socket create_socket_perms;
allow tgtd_t self:unix_dgram_socket create_socket_perms;
manage_sock_files_pattern(tgtd_t, tgtd_tmp_t, tgtd_tmp_t)
files_tmp_filetrans(tgtd_t, tgtd_tmp_t, { sock_file })
manage_files_pattern(tgtd_t, tgtd_tmpfs_t, tgtd_tmpfs_t)
fs_tmpfs_filetrans(tgtd_t, tgtd_tmpfs_t, file)
manage_dirs_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
manage_files_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
files_var_lib_filetrans(tgtd_t, tgtd_var_lib_t, { dir file })
clean up 0bca409 and add changelog entry.
2009-11-03 14:25:37 +00:00
kernel_read_fs_sysctls(tgtd_t)
RESET tgtd daemon. This one makes an effort to check for syntax and that it actually compiles. Signed-off-by: Matthew Ife <deleriux@airattack-central.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2009-10-28 17:00:03 +00:00
corenet_all_recvfrom_netlabel(tgtd_t)
corenet_all_recvfrom_unlabeled(tgtd_t)
corenet_tcp_sendrecv_generic_if(tgtd_t)
corenet_tcp_sendrecv_generic_node(tgtd_t)
corenet_tcp_sendrecv_iscsi_port(tgtd_t)
one further rearrangement of tgtd.
2009-11-03 14:41:24 +00:00
corenet_tcp_bind_generic_node(tgtd_t)
corenet_tcp_bind_iscsi_port(tgtd_t)
corenet_sendrecv_iscsi_server_packets(tgtd_t)
RESET tgtd daemon. This one makes an effort to check for syntax and that it actually compiles. Signed-off-by: Matthew Ife <deleriux@airattack-central.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2009-10-28 17:00:03 +00:00
Add the ability to send audit messages to confined admin policies Remove permissive domain from cmirrord and dontaudit sys_tty_config Split out unconfined_domain() calls from other unconfined_ calls so we can disable unconfined.pp and leave unconfineduser virt needs to be able to read processes to clearance for MLS
2010-09-15 15:31:20 +00:00
dev_search_sysfs(tgtd_t)
RESET tgtd daemon. This one makes an effort to check for syntax and that it actually compiles. Signed-off-by: Matthew Ife <deleriux@airattack-central.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2009-10-28 17:00:03 +00:00
files_read_etc_files(tgtd_t)
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
fs_read_anon_inodefs_files(tgtd_t)
Iscsi and tgtd patches from Dan Walsh.
2010-03-09 20:17:16 +00:00
storage_manage_fixed_disk(tgtd_t)
RESET tgtd daemon. This one makes an effort to check for syntax and that it actually compiles. Signed-off-by: Matthew Ife <deleriux@airattack-central.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2009-10-28 17:00:03 +00:00
logging_send_syslog_msg(tgtd_t)
miscfiles_read_localization(tgtd_t)
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
Allow iscsid to manage tgtd semaphores
2010-09-15 14:50:07 +00:00
optional_policy(`
iscsi_manage_semaphores(tgtd_t)
')
Reference in New Issue Copy Permalink