add ircd, bug 1658

refpolicy/Changelog

@@ -53,6 +53,7 @@
 	gatekeeper
 	gift
 	imaze
+	ircd
 	jabber
 	mozilla
 	mplayer

refpolicy/policy/modules/services/ircd.fc

@@ -0,0 +1,7 @@
+/etc/(dancer-)?ircd(/.*)?	gen_context(system_u:object_r:ircd_etc_t,s0)
+
+/usr/sbin/(dancer-)?ircd --	gen_context(system_u:object_r:ircd_exec_t,s0)
+
+/var/lib/dancer-ircd(/.*)?	gen_context(system_u:object_r:ircd_var_lib_t,s0)
+/var/log/(dancer-)?ircd(/.*)?	gen_context(system_u:object_r:ircd_log_t,s0)
+/var/run/dancer-ircd(/.*)?	gen_context(system_u:object_r:ircd_var_run_t,s0)

refpolicy/policy/modules/services/ircd.if

@@ -0,0 +1 @@
+## <summary>IRC server</summary>

refpolicy/policy/modules/services/ircd.te

@@ -0,0 +1,113 @@
+
+policy_module(ircd,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ircd_t;
+type ircd_exec_t;
+init_daemon_domain(ircd_t,ircd_exec_t)
+
+type ircd_etc_t;
+files_config_file(ircd_etc_t)
+
+type ircd_log_t;
+logging_log_file(ircd_log_t)
+
+type ircd_var_lib_t;
+files_type(ircd_var_lib_t)
+
+type ircd_var_run_t;
+files_pid_file(ircd_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+dontaudit ircd_t self:capability sys_tty_config;
+allow ircd_t self:process signal_perms;
+allow ircd_t self:tcp_socket create_stream_socket_perms;
+allow ircd_t self:udp_socket create_socket_perms;
+
+allow ircd_t ircd_etc_t:file r_file_perms;
+allow ircd_t ircd_etc_t:dir r_dir_perms;
+allow ircd_t ircd_etc_t:lnk_file { getattr read };
+files_search_etc(ircd_t)
+
+allow ircd_t ircd_log_t:file create_file_perms;
+allow ircd_t ircd_log_t:dir rw_dir_perms;
+logging_log_filetrans(ircd_t,ircd_log_t,{ file dir })
+
+allow ircd_t ircd_var_lib_t:file create_file_perms;
+allow ircd_t ircd_var_lib_t:dir rw_dir_perms;
+files_var_lib_filetrans(ircd_t,ircd_var_lib_t,file)
+
+allow ircd_t ircd_var_run_t:file create_file_perms;
+allow ircd_t ircd_var_run_t:dir rw_dir_perms;
+files_pid_filetrans(ircd_t,ircd_var_run_t,file)
+
+kernel_read_system_state(ircd_t)
+kernel_read_kernel_sysctls(ircd_t)
+
+corecmd_search_sbin(ircd_t)
+
+corenet_tcp_sendrecv_generic_if(ircd_t)
+corenet_udp_sendrecv_generic_if(ircd_t)
+corenet_raw_sendrecv_generic_if(ircd_t)
+corenet_tcp_sendrecv_all_nodes(ircd_t)
+corenet_udp_sendrecv_all_nodes(ircd_t)
+corenet_raw_sendrecv_all_nodes(ircd_t)
+corenet_tcp_sendrecv_all_ports(ircd_t)
+corenet_udp_sendrecv_all_ports(ircd_t)
+corenet_non_ipsec_sendrecv(ircd_t)
+corenet_tcp_bind_all_nodes(ircd_t)
+corenet_udp_bind_all_nodes(ircd_t)
+corenet_tcp_bind_ircd_port(ircd_t)
+
+dev_read_sysfs(ircd_t)
+
+domain_use_interactive_fds(ircd_t)
+
+files_read_etc_files(ircd_t)
+files_read_etc_runtime_files(ircd_t)
+
+fs_getattr_all_fs(ircd_t)
+fs_search_auto_mountpoints(ircd_t)
+
+term_dontaudit_use_console(ircd_t)
+
+init_use_fds(ircd_t)
+init_use_script_ptys(ircd_t)
+
+libs_use_ld_so(ircd_t)
+libs_use_shared_libs(ircd_t)
+
+logging_send_syslog_msg(ircd_t)
+
+miscfiles_read_localization(ircd_t)
+
+sysnet_read_config(ircd_t)
+
+userdom_dontaudit_use_unpriv_user_fds(ircd_t)
+userdom_dontaudit_search_sysadm_home_dirs(ircd_t)
+
+ifdef(`targeted_policy',`
+	term_dontaudit_use_unallocated_ttys(ircd_t)
+	term_dontaudit_use_generic_ptys(ircd_t)
+	files_dontaudit_read_root_files(ircd_t)
+')
+
+optional_policy(`
+	nis_use_ypbind(ircd_t)
+')
+
+optional_policy(`
+	seutil_sigchld_newrole(ircd_t)
+')
+
+optional_policy(`
+	udev_read_db(ircd_t)
+')