add slrnpull

This commit is contained in:
Chris PeBenito 2006-01-04 20:44:30 +00:00
parent 6f11d6b894
commit 1d427acc6c
7 changed files with 146 additions and 2 deletions

View File

@ -8,6 +8,7 @@
fetchmail fetchmail
openct openct
readahead readahead
slrnpull
smartmon smartmon
sysstat sysstat
vbetool (Dan Walsh) vbetool (Dan Walsh)

View File

@ -1,5 +1,5 @@
policy_module(logrotate,1.1.0) policy_module(logrotate,1.1.1)
######################################## ########################################
# #
@ -180,6 +180,10 @@ optional_policy(`nscd',`
nscd_use_socket(logrotate_t) nscd_use_socket(logrotate_t)
') ')
optional_policy(`slrnpull',`
slrnpull_manage_spool(logrotate_t)
')
optional_policy(`squid',` optional_policy(`squid',`
# cjp: why? # cjp: why?
squid_domtrans(logrotate_t) squid_domtrans(logrotate_t)

View File

@ -0,0 +1,10 @@
#
# /usr
#
/usr/bin/slrnpull -- gen_context(system_u:object_r:slrnpull_exec_t,s0)
#
# /var
#
/var/spool/slrnpull(/.*)? gen_context(system_u:object_r:slrnpull_spool_t,s0)

View File

@ -0,0 +1,38 @@
## <summary>Service for downloading news feeds the slrn newsreader.</summary>
########################################
## <summary>
## Allow the domain to search slrnpull spools.
## </summary>
## <param name="pty_type">
## domain allowed access
## </param>
#
interface(`slrnpull_search_spool',`
gen_require(`
type slrnpull_spool_t;
')
files_search_spool($1)
allow $1 slrnpull_spool_t:dir search_dir_perms;
')
########################################
## <summary>
## Allow the domain to create, read,
## write, and delete slrnpull spools.
## </summary>
## <param name="pty_type">
## domain allowed access
## </param>
#
interface(`slrnpull_manage_spool',`
gen_require(`
type slrnpull_spool_t;
')
files_search_spool($1)
allow $1 slrnpull_spool_t:dir create_dir_perms;
allow $1 slrnpull_spool_t:file create_file_perms;
allow $1 slrnpull_spool_t:lnk_file create_lnk_perms;
')

View File

@ -0,0 +1,87 @@
policy_module(slrnpull,1.0.0)
########################################
#
# Declarations
#
type slrnpull_t;
type slrnpull_exec_t;
init_daemon_domain(slrnpull_t,slrnpull_exec_t)
type slrnpull_var_run_t;
files_pid_file(slrnpull_var_run_t)
type slrnpull_spool_t;
files_type(slrnpull_spool_t)
type slrnpull_log_t;
logging_log_file(slrnpull_log_t)
########################################
#
# Local policy
#
dontaudit slrnpull_t self:capability sys_tty_config;
allow slrnpull_t self:process signal_perms;
allow slrnpull_t slrnpull_log_t:file create_file_perms;
logging_create_log(slrnpull_t,slrnpull_log_t)
allow slrnpull_t slrnpull_spool_t:dir rw_dir_perms;
allow slrnpull_t slrnpull_spool_t:dir create_dir_perms;
allow slrnpull_t slrnpull_spool_t:file create_file_perms;
allow slrnpull_t slrnpull_spool_t:lnk_file create_lnk_perms;
files_search_spool(slrnpull_t)
allow slrnpull_t slrnpull_var_run_t:file create_file_perms;
allow slrnpull_t slrnpull_var_run_t:dir rw_dir_perms;
files_create_pid(slrnpull_t,slrnpull_var_run_t)
kernel_list_proc(slrnpull_t)
kernel_read_kernel_sysctl(slrnpull_t)
kernel_read_proc_symlinks(slrnpull_t)
dev_read_sysfs(slrnpull_t)
domain_use_wide_inherit_fd(slrnpull_t)
files_read_etc_files(slrnpull_t)
fs_getattr_all_fs(slrnpull_t)
fs_search_auto_mountpoints(slrnpull_t)
term_dontaudit_use_console(slrnpull_t)
init_use_fd(slrnpull_t)
init_use_script_pty(slrnpull_t)
libs_use_ld_so(slrnpull_t)
libs_use_shared_libs(slrnpull_t)
logging_send_syslog_msg(slrnpull_t)
miscfiles_read_localization(slrnpull_t)
userdom_dontaudit_use_unpriv_user_fd(slrnpull_t)
userdom_dontaudit_search_sysadm_home_dir(slrnpull_t)
ifdef(`targeted_policy',`
files_dontaudit_read_root_file(slrnpull_t)
term_dontaudit_use_unallocated_tty(slrnpull_t)
term_dontaudit_use_generic_pty(slrnpull_t)
')
optional_policy(`cron',`
cron_system_entry(slrnpull_t,slrnpull_exec_t)
')
optional_policy(`selinuxutil',`
seutil_sigchld_newrole(slrnpull_t)
')
optional_policy(`udev',`
udev_read_db(slrnpull_t)
')

View File

@ -424,6 +424,10 @@ template(`base_user_template',`
samba_connect_winbind($1_t) samba_connect_winbind($1_t)
') ')
optional_policy(`slrnpull',`
slrnpull_search_spool($1_t)
')
optional_policy(`squid',` optional_policy(`squid',`
squid_use($1_t) squid_use($1_t)
') ')

View File

@ -1,5 +1,5 @@
policy_module(userdomain,1.1.0) policy_module(userdomain,1.1.1)
gen_require(` gen_require(`
role sysadm_r, staff_r, user_r; role sysadm_r, staff_r, user_r;