65 lines
1.9 KiB
Plaintext
65 lines
1.9 KiB
Plaintext
|
#DESC Inetd - Internet services daemon
|
||
|
|
#
|
||
|
|
# Authors: Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser
|
||
|
|
# re-written with daemon_domain by Russell Coker <russell@coker.com.au>
|
||
|
|
# X-Debian-Packages: netkit-inetd openbsd-inetd xinetd
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the inetd_t domain and
|
||
|
|
# the inetd_child_t domain.
|
||
|
|
#
|
||
|
|
|
||
|
|
daemon_domain(inetd, `ifdef(`unlimitedInetd', `,admin, etc_writer, fs_domain, auth_write, privmem')' )
|
||
|
|
|
||
|
|
can_network(inetd_t)
|
||
|
|
allow inetd_t port_type:tcp_socket name_connect;
|
||
|
|
allow inetd_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow inetd_t self:unix_stream_socket create_socket_perms;
|
||
|
|
allow inetd_t self:fifo_file rw_file_perms;
|
||
|
|
allow inetd_t etc_t:file { getattr read ioctl };
|
||
|
|
allow inetd_t self:process setsched;
|
||
|
|
|
||
|
|
log_domain(inetd)
|
||
|
|
tmp_domain(inetd)
|
||
|
|
|
||
|
|
# Use capabilities.
|
||
|
|
allow inetd_t self:capability { setuid setgid net_bind_service };
|
||
|
|
|
||
|
|
# allow any domain to connect to inetd
|
||
|
|
can_tcp_connect(userdomain, inetd_t)
|
||
|
|
|
||
|
|
# Run each daemon with a defined domain in its own domain.
|
||
|
|
# These rules have been moved to the individual target domain .te files.
|
||
|
|
|
||
|
|
# Run other daemons in the inetd_child_t domain.
|
||
|
|
allow inetd_t { bin_t sbin_t }:dir search;
|
||
|
|
allow inetd_t sbin_t:lnk_file read;
|
||
|
|
|
||
|
|
# Bind to the telnet, ftp, rlogin and rsh ports.
|
||
|
|
ifdef(`ftpd.te', `allow inetd_t ftp_port_t:tcp_socket name_bind;')
|
||
|
|
ifdef(`rshd.te', `allow inetd_t rsh_port_t:tcp_socket name_bind;')
|
||
|
|
ifdef(`talk.te', `
|
||
|
|
allow inetd_t talk_port_t:tcp_socket name_bind;
|
||
|
|
allow inetd_t ntalk_port_t:tcp_socket name_bind;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow inetd_t auth_port_t:tcp_socket name_bind;
|
||
|
|
# Communicate with the portmapper.
|
||
|
|
ifdef(`portmap.te', `can_udp_send(inetd_t, portmap_t)')
|
||
|
|
|
||
|
|
|
||
|
|
inetd_child_domain(inetd_child)
|
||
|
|
allow inetd_child_t proc_net_t:dir search;
|
||
|
|
allow inetd_child_t proc_net_t:file { getattr read };
|
||
|
|
|
||
|
|
ifdef(`unconfined.te', `
|
||
|
|
domain_auto_trans(inetd_t, unconfined_exec_t, unconfined_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`unlimitedInetd', `
|
||
|
|
unconfined_domain(inetd_t)
|
||
|
|
')
|
||
|
|
|