70 lines
1.7 KiB
Plaintext
70 lines
1.7 KiB
Plaintext
|
#
|
||
|
|
# Pyzor - Pyzor is a collaborative, networked system to detect and
|
||
|
|
# block spam using identifying digests of messages.
|
||
|
|
#
|
||
|
|
# Author: David Hampton <hampton@employees.org>
|
||
|
|
#
|
||
|
|
|
||
|
|
##########
|
||
|
|
# common definitions for pyzord and all flavors of pyzor
|
||
|
|
##########
|
||
|
|
define(`pyzor_base_domain',`
|
||
|
|
|
||
|
|
# Networking
|
||
|
|
can_network_client_tcp($1_t, http_port_t);
|
||
|
|
can_network_udp($1_t, pyzor_port_t);
|
||
|
|
can_resolve($1_t);
|
||
|
|
|
||
|
|
general_proc_read_access($1_t)
|
||
|
|
|
||
|
|
tmp_domain($1)
|
||
|
|
|
||
|
|
allow $1_t bin_t:dir { getattr search };
|
||
|
|
allow $1_t bin_t:file getattr;
|
||
|
|
allow $1_t lib_t:file { getattr read };
|
||
|
|
allow $1_t { var_t var_lib_t var_run_t }:dir search;
|
||
|
|
uses_shlib($1_t)
|
||
|
|
|
||
|
|
# Python does a getattr on this file
|
||
|
|
allow $1_t pyzor_exec_t:file getattr;
|
||
|
|
|
||
|
|
# mktemp and other randoms
|
||
|
|
allow $1_t { random_device_t urandom_device_t }:chr_file r_file_perms;
|
||
|
|
|
||
|
|
# Allow access to various files in the /etc/directory including mtab
|
||
|
|
# and nsswitch
|
||
|
|
allow $1_t { etc_t etc_runtime_t }:file { getattr read };
|
||
|
|
read_locale($1_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
|
||
|
|
#
|
||
|
|
# Define a user domain for a pyzor
|
||
|
|
#
|
||
|
|
# Note: expects to be called with an argument of user, sysadm
|
||
|
|
|
||
|
|
define(`pyzor_domain',`
|
||
|
|
type $1_pyzor_t, domain, privlog, nscd_client_domain;
|
||
|
|
role $1_r types $1_pyzor_t;
|
||
|
|
domain_auto_trans($1_t, pyzor_exec_t, $1_pyzor_t)
|
||
|
|
|
||
|
|
pyzor_base_domain($1_pyzor)
|
||
|
|
|
||
|
|
# Per-user config/data files
|
||
|
|
home_domain($1, pyzor)
|
||
|
|
file_type_auto_trans($1_pyzor_t, $1_home_dir_t, $1_pyzor_home_t, dir)
|
||
|
|
|
||
|
|
# System config files
|
||
|
|
r_dir_file($1_pyzor_t, pyzor_etc_t)
|
||
|
|
|
||
|
|
# System data files
|
||
|
|
r_dir_file($1_pyzor_t, pyzor_var_lib_t);
|
||
|
|
|
||
|
|
allow $1_pyzor_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
|
||
|
|
# Allow pyzor to be run by hand. Needed by any action other than
|
||
|
|
# invocation from a spam filter.
|
||
|
|
can_access_pty($1_pyzor_t, $1)
|
||
|
|
allow $1_pyzor_t sshd_t:fd use;
|
||
|
|
')
|