selinux-policy/strict/domains/program/tftpd.te
2005-04-29 17:45:15 +00:00

44 lines
1.2 KiB
Plaintext

#DESC TFTP - UDP based file server for boot loaders
#
# Author: Russell Coker <russell@coker.com.au>
# X-Debian-Packages: tftpd atftpd
# Depends: inetd.te
#
#################################
#
# Rules for the tftpd_t domain.
#
# tftpd_exec_t is the type of the tftpd executable.
#
daemon_domain(tftpd)
type tftp_port_t, port_type, reserved_port_type;
# tftpdir_t is the type of files in the /tftpboot directories.
type tftpdir_t, file_type, sysadmfile;
r_dir_file(tftpd_t, tftpdir_t)
domain_auto_trans(inetd_t, tftpd_exec_t, tftpd_t)
# Use the network.
can_network_udp(tftpd_t)
allow tftpd_t tftp_port_t:udp_socket name_bind;
ifdef(`inetd.te', `
allow inetd_t tftp_port_t:udp_socket name_bind;
')
allow tftpd_t self:unix_dgram_socket create_socket_perms;
allow tftpd_t self:unix_stream_socket create_stream_socket_perms;
# allow any domain to connect to the TFTP server
allow tftpd_t inetd_t:udp_socket rw_socket_perms;
# Use capabilities
allow tftpd_t self:capability { setgid setuid net_bind_service sys_chroot };
allow tftpd_t etc_t:dir r_dir_perms;
allow tftpd_t etc_t:file r_file_perms;
allow tftpd_t var_t:dir r_dir_perms;
allow tftpd_t var_t:{ file lnk_file } r_file_perms;