## <summary>TCP/IP encryption</summary> ######################################## ## <summary> ## Execute ipsec in the ipsec domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`ipsec_domtrans',` gen_require(` type ipsec_t, ipsec_exec_t; ') domain_auto_trans($1,ipsec_exec_t,ipsec_t) allow $1 ipsec_t:fd use; allow ipsec_t $1:fd use; allow ipsec_t $1:fifo_file rw_file_perms; allow ipsec_t $1:process sigchld; ') ######################################## ## <summary> ## Connect to IPSEC using a unix domain stream socket. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`ipsec_stream_connect',` gen_require(` type ipsec_t, ipsec_var_run_t; ') files_search_pids($1) allow $1 ipsec_var_run_t:dir search; allow $1 ipsec_var_run_t:sock_file write; allow $1 ipsec_t:unix_stream_socket connectto; ') ######################################## ## <summary> ## Get the attributes of an IPSEC key socket. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`ipsec_getattr_key_sockets',` gen_require(` type ipsec_t; ') allow $1 ipsec_t:key_socket getattr; ') ######################################## ## <summary> ## Execute the IPSEC management program in the caller domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`ipsec_exec_mgmt',` gen_require(` type ipsec_exec_t; ') can_exec($1,ipsec_exec_t) ') ######################################## ## <summary> ## Read the IPSEC configuration ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`ipsec_read_config',` gen_require(` type ipsec_conf_file_t; ') files_search_etc($1) allow $1 ipsec_conf_file_t:file r_file_perms; ') ######################################## ## <summary> ## Create, read, write, and delete the IPSEC pid files. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`ipsec_manage_pid',` gen_require(` type ipsec_var_run_t; ') files_search_pids($1) allow $1 ipsec_var_run_t:dir rw_dir_perms; allow $1 ipsec_var_run_t:file create_file_perms; ')