rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Tor patch from Dan Walsh.

Browse Source
This commit is contained in:
Chris PeBenito 2010-03-29 14:30:52 -04:00
parent 2b93b88584
commit 25d81d2655
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/services/tor.fc
View File

@ -5,5 +5,8 @@
/usr/sbin/tor -- gen_context(system_u:object_r:tor_exec_t,s0) /usr/sbin/tor -- gen_context(system_u:object_r:tor_exec_t,s0)
/var/lib/tor(/.*)? gen_context(system_u:object_r:tor_var_lib_t,s0) /var/lib/tor(/.*)? gen_context(system_u:object_r:tor_var_lib_t,s0)
/var/lib/tor-data(/.*)? gen_context(system_u:object_r:tor_var_lib_t,s0)
/var/log/tor(/.*)? gen_context(system_u:object_r:tor_var_log_t,s0) /var/log/tor(/.*)? gen_context(system_u:object_r:tor_var_log_t,s0)
/var/run/tor(/.*)? gen_context(system_u:object_r:tor_var_run_t,s0) /var/run/tor(/.*)? gen_context(system_u:object_r:tor_var_run_t,s0)

15
policy/modules/services/tor.te
View File

@ -1,11 +1,19 @@
policy_module(tor, 1.6.0) policy_module(tor, 1.6.1)
######################################## ########################################
# #
# Declarations # Declarations
# #
## <desc>
## <p>
## Allow tor daemon to bind
## tcp sockets to all unreserved ports.
## </p>
## </desc>
gen_tunable(tor_bind_all_unreserved_ports, false)
type tor_t; type tor_t;
type tor_exec_t; type tor_exec_t;
init_daemon_domain(tor_t, tor_exec_t) init_daemon_domain(tor_t, tor_exec_t)
@ -89,11 +97,16 @@ domain_use_interactive_fds(tor_t)
files_read_etc_files(tor_t) files_read_etc_files(tor_t)
files_read_etc_runtime_files(tor_t) files_read_etc_runtime_files(tor_t)
files_read_usr_files(tor_t)
auth_use_nsswitch(tor_t) auth_use_nsswitch(tor_t)
miscfiles_read_localization(tor_t) miscfiles_read_localization(tor_t)
tunable_policy(`tor_bind_all_unreserved_ports', `
corenet_tcp_bind_all_unreserved_ports(tor_t)
')
optional_policy(` optional_policy(`
seutil_sigchld_newrole(tor_t) seutil_sigchld_newrole(tor_t)
') ')