rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Tweaks on pulseaudio 1868383, ksmtuned d279dd6, and smokeping f3c346c.

Browse Source
This commit is contained in:
Chris PeBenito 2010-03-29 09:19:40 -04:00
parent f3c346cc07
commit ad0071bbe4
8 changed files with 65 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
policy/modules/apps/pulseaudio.fc
View File

@ -1,9 +1,7 @@
HOME_DIR/\.pulse-cookie gen_context(system_u:object_r:pulseaudio_home_t,s0)
HOME_DIR/\.pulse(/.*)? gen_context(system_u:object_r:pulseaudio_home_t,s0)
/var/lib/pulse(/.*)? gen_context(system_u:object_r:pulseaudio_var_lib_t,s0)
/var/run/pulse(/.*)? gen_context(system_u:object_r:pulseaudio_var_run_t,s0)
/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0)
/var/lib/pulse(/.*)? gen_context(system_u:object_r:pulseaudio_var_lib_t,s0)
/var/run/pulse(/.*)? gen_context(system_u:object_r:pulseaudio_var_run_t,s0)

91
policy/modules/apps/pulseaudio.if
View File

@ -58,7 +58,7 @@ interface(`pulseaudio_domtrans',`
type pulseaudio_t, pulseaudio_exec_t;
')
domtrans_pattern($1,pulseaudio_exec_t,pulseaudio_t)
domtrans_pattern($1, pulseaudio_exec_t, pulseaudio_t)
')
########################################
@ -88,7 +88,7 @@ interface(`pulseaudio_run',`
########################################
## <summary>
## Execute a pulseaudio in the current domain
## Execute a pulseaudio in the current domain.
## </summary>
## <param name="domain">
## <summary>
@ -101,7 +101,29 @@ interface(`pulseaudio_exec',`
type pulseaudio_exec_t;
')
can_exec($1,pulseaudio_exec_t)
can_exec($1, pulseaudio_exec_t)
')
#####################################
## <summary>
## Connect to pulseaudio over a unix domain
## stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`pulseaudio_stream_connect',`
gen_require(`
type pulseaudio_t, pulseaudio_var_run_t;
')
files_search_pids($1)
allow $1 pulseaudio_t:process signull;
allow pulseaudio_t $1:process signull;
stream_connect_pattern($1, pulseaudio_var_run_t, pulseaudio_var_run_t, pulseaudio_t)
')
########################################
@ -127,7 +149,25 @@ interface(`pulseaudio_dbus_chat',`
########################################
## <summary>
## Read pulseaudio homedir files
## Set the attributes of the pulseaudio homedir.
## </summary>
## <param name="user_domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`pulseaudio_setattr_home_dir',`
gen_require(`
type pulseaudio_home_t;
')
allow $1 pulseaudio_home_t:dir setattr;
')
########################################
## <summary>
## Read pulseaudio homedir files.
## </summary>
## <param name="user_domain">
## <summary>
@ -146,7 +186,8 @@ interface(`pulseaudio_read_home_files',`
########################################
## <summary>
## Manage pulseaudio homedir files
## Create, read, write, and delete pulseaudio
## home directory files.
## </summary>
## <param name="user_domain">
## <summary>
@ -162,43 +203,3 @@ interface(`pulseaudio_manage_home_files',`
userdom_search_user_home_dirs($1)
manage_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
')
########################################
## <summary>
## Allow domain to setattr on pulseaudio homedir
## </summary>
## <param name="user_domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`pulseaudio_setattr_home_dir',`
gen_require(`
type pulseaudio_home_t;
')
allow $1 pulseaudio_home_t:dir setattr;
')
#####################################
## <summary>
## Connect to pulseaudio over a unix domain
## stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`pulseaudio_stream_connect',`
gen_require(`
type pulseaudio_t, pulseaudio_var_run_t;
')
files_search_pids($1)
allow $1 pulseaudio_t:process signull;
allow pulseaudio_t $1:process signull;
stream_connect_pattern($1, pulseaudio_var_run_t, pulseaudio_var_run_t, pulseaudio_t)
')

3
policy/modules/apps/pulseaudio.te
View File

@ -28,6 +28,7 @@ files_pid_file(pulseaudio_var_run_t)
#
# pulseaudio local policy
#
allow pulseaudio_t self:capability { fowner fsetid chown setgid setuid sys_nice sys_resource sys_tty_config };
allow pulseaudio_t self:process { getcap setcap setrlimit setsched getsched signal signull };
allow pulseaudio_t self:fifo_file rw_file_perms;
@ -37,9 +38,9 @@ allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
allow pulseaudio_t self:udp_socket create_socket_perms;
allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
userdom_search_user_home_dirs(pulseaudio_t)
manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
userdom_search_user_home_dirs(pulseaudio_t)
manage_dirs_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t)
manage_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t)

8
policy/modules/services/ksmtuned.if
View File

@ -1,5 +1,4 @@
## <summary>policy for Kernel Samepage Merging (KSM) Tuning Daemon</summary>
## <summary>Kernel Samepage Merging (KSM) Tuning Daemon</summary>
########################################
## <summary>
@ -19,7 +18,6 @@ interface(`ksmtuned_domtrans',`
domtrans_pattern($1, ksmtuned_exec_t, ksmtuned_t)
')
########################################
## <summary>
## Execute ksmtuned server in the ksmtuned domain.
@ -40,7 +38,7 @@ interface(`ksmtuned_initrc_domtrans',`
########################################
## <summary>
## All of the rules required to administrate
## All of the rules required to administrate
## an ksmtuned environment
## </summary>
## <param name="domain">
@ -63,7 +61,7 @@ interface(`ksmtuned_admin',`
allow $1 ksmtuned_t:process { ptrace signal_perms };
ps_process_pattern(ksmtumed_t)
files_list_pids($1)
admin_pattern($1, ksmtuned_var_run_t)

10
policy/modules/services/ksmtuned.te
View File

@ -1,4 +1,5 @@
policy_module(ksmtuned,1.0.0)
policy_module(ksmtuned, 1.0.0)
########################################
#
@ -19,14 +20,9 @@ files_pid_file(ksmtuned_var_run_t)
#
# ksmtuned local policy
#
allow ksmtuned_t self:capability { sys_ptrace sys_tty_config };
# Init script handling
domain_use_interactive_fds(ksmtuned_t)
# internal communication is often done using fifo and unix sockets.
allow ksmtuned_t self:fifo_file rw_file_perms;
allow ksmtuned_t self:unix_stream_socket create_stream_socket_perms;
manage_files_pattern(ksmtuned_t, ksmtuned_var_run_t, ksmtuned_var_run_t)
files_pid_filetrans(ksmtuned_t, ksmtuned_var_run_t, file)

2
policy/modules/services/smokeping.fc
View File

@ -7,5 +7,3 @@
/var/lib/smokeping(/.*)? gen_context(system_u:object_r:smokeping_var_lib_t,s0)
/var/run/smokeping(/.*)? gen_context(system_u:object_r:smokeping_var_run_t,s0)

7
policy/modules/services/smokeping.if
View File

@ -1,5 +1,4 @@
## <summary>policy for smokeping</summary>
## <summary>Smokeping network latency measurement.</summary>
########################################
## <summary>
@ -129,12 +128,12 @@ interface(`smokeping_manage_lib_files',`
')
files_search_var_lib($1)
manage_files_pattern($1, smokeping_var_lib_t, smokeping_var_lib_t)
manage_files_pattern($1, smokeping_var_lib_t, smokeping_var_lib_t)
')
########################################
## <summary>
## All of the rules required to administrate
## All of the rules required to administrate
## a smokeping environment
## </summary>
## <param name="domain">

12
policy/modules/services/smokeping.te
View File

@ -1,5 +1,5 @@
policy_module(smokeping,1.0.0)
policy_module(smokeping, 1.0.0)
########################################
#
@ -28,12 +28,12 @@ allow smokeping_t self:fifo_file rw_fifo_file_perms;
allow smokeping_t self:udp_socket create_socket_perms;
allow smokeping_t self:unix_stream_socket create_stream_socket_perms;
manage_dirs_pattern(smokeping_t, smokeping_var_run_t, smokeping_var_run_t)
manage_files_pattern(smokeping_t, smokeping_var_run_t, smokeping_var_run_t)
manage_dirs_pattern(smokeping_t, smokeping_var_run_t, smokeping_var_run_t)
manage_files_pattern(smokeping_t, smokeping_var_run_t, smokeping_var_run_t)
files_pid_filetrans(smokeping_t, smokeping_var_run_t, { file dir })
manage_dirs_pattern(smokeping_t, smokeping_var_lib_t, smokeping_var_lib_t)
manage_files_pattern(smokeping_t, smokeping_var_lib_t, smokeping_var_lib_t)
manage_dirs_pattern(smokeping_t, smokeping_var_lib_t, smokeping_var_lib_t)
manage_files_pattern(smokeping_t, smokeping_var_lib_t, smokeping_var_lib_t)
files_var_lib_filetrans(smokeping_t, smokeping_var_lib_t, { file dir } )
corecmd_read_bin_symlinks(smokeping_t)
@ -61,7 +61,7 @@ netutils_domtrans_ping(smokeping_t)
optional_policy(`
apache_content_template(smokeping_cgi)
allow httpd_smokeping_cgi_script_t self:udp_socket create_socket_perms;
manage_files_pattern(httpd_smokeping_cgi_script_t, smokeping_var_lib_t, smokeping_var_lib_t)