rpms/selinux-policy
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Minor tweaks on icecast.

Browse Source
This commit is contained in:
Chris PeBenito 2010-03-22 08:56:32 -04:00
parent 584dfaca45
commit 340af119b0
3 changed files with 28 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/services/icecast.fc
View File

@ -1,4 +1,3 @@
/etc/rc\.d/init\.d/icecast -- gen_context(system_u:object_r:icecast_initrc_exec_t,s0) /etc/rc\.d/init\.d/icecast -- gen_context(system_u:object_r:icecast_initrc_exec_t,s0)
/usr/bin/icecast -- gen_context(system_u:object_r:icecast_exec_t,s0) /usr/bin/icecast -- gen_context(system_u:object_r:icecast_exec_t,s0)

42
policy/modules/services/icecast.if
View File

@ -1,4 +1,3 @@
## <summary> ShoutCast compatible streaming media server</summary> ## <summary> ShoutCast compatible streaming media server</summary>
######################################## ########################################
@ -19,6 +18,24 @@ interface(`icecast_domtrans',`
domtrans_pattern($1, icecast_exec_t, icecast_t) domtrans_pattern($1, icecast_exec_t, icecast_t)
') ')
########################################
## <summary>
## Allow domain signal icecast
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`icecast_signal',`
gen_require(`
type icecast_t;
')
allow $1 icecast_t:process signal;
')
######################################## ########################################
## <summary> ## <summary>
## Execute icecast server in the icecast domain. ## Execute icecast server in the icecast domain.
@ -131,27 +148,7 @@ interface(`icecast_manage_log',`
') ')
logging_search_logs($1) logging_search_logs($1)
manage_dirs_pattern($1, icecast_log_t, icecast_log_t)
manage_files_pattern($1, icecast_log_t, icecast_log_t) manage_files_pattern($1, icecast_log_t, icecast_log_t)
manage_lnk_files_pattern($1, icecast_log_t, icecast_log_t)
')
########################################
## <summary>
## Allow domain signal icecast
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`icecast_signal',`
gen_require(`
type icecast_t;
')
allow $1 icecast_t:process signal;
') ')
######################################## ########################################
@ -176,8 +173,7 @@ interface(`icecast_admin',`
type icecast_t, icecast_initrc_exec_t; type icecast_t, icecast_initrc_exec_t;
') ')
allow $1 icecast_t:process { ptrace signal_perms getattr }; ps_process_pattern($1, icecast_t)
read_files_pattern($1, icecast_t, icecast_t)
# Allow icecast_t to restart the apache service # Allow icecast_t to restart the apache service
icecast_initrc_domtrans($1) icecast_initrc_domtrans($1)

5
policy/modules/services/icecast.te
View File

@ -1,4 +1,5 @@
policy_module(icecast,1.0.0)
policy_module(icecast, 1.0.0)
######################################## ########################################
# #
@ -25,8 +26,6 @@ logging_log_file(icecast_log_t)
allow icecast_t self:capability { dac_override setgid setuid sys_nice }; allow icecast_t self:capability { dac_override setgid setuid sys_nice };
allow icecast_t self:process { getsched fork setsched signal }; allow icecast_t self:process { getsched fork setsched signal };
# internal communication is often done using fifo and unix sockets.
allow icecast_t self:fifo_file rw_fifo_file_perms; allow icecast_t self:fifo_file rw_fifo_file_perms;
allow icecast_t self:unix_stream_socket create_stream_socket_perms; allow icecast_t self:unix_stream_socket create_stream_socket_perms;
allow icecast_t self:tcp_socket create_stream_socket_perms; allow icecast_t self:tcp_socket create_stream_socket_perms;