1e2abee10b
Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.
125 lines
3.0 KiB
Plaintext
125 lines
3.0 KiB
Plaintext
policy_module(stunnel, 1.9.1)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type stunnel_t;
|
|
domain_type(stunnel_t)
|
|
role system_r types stunnel_t;
|
|
|
|
type stunnel_exec_t;
|
|
domain_entry_file(stunnel_t, stunnel_exec_t)
|
|
|
|
ifdef(`distro_gentoo',`
|
|
init_daemon_domain(stunnel_t, stunnel_exec_t)
|
|
',`
|
|
inetd_tcp_service_domain(stunnel_t, stunnel_exec_t)
|
|
')
|
|
|
|
type stunnel_etc_t;
|
|
files_config_file(stunnel_etc_t)
|
|
|
|
type stunnel_tmp_t;
|
|
files_tmp_file(stunnel_tmp_t)
|
|
|
|
type stunnel_var_run_t;
|
|
files_pid_file(stunnel_var_run_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow stunnel_t self:capability { setgid setuid sys_chroot };
|
|
allow stunnel_t self:process signal_perms;
|
|
allow stunnel_t self:fifo_file rw_fifo_file_perms;
|
|
allow stunnel_t self:tcp_socket create_stream_socket_perms;
|
|
allow stunnel_t self:udp_socket create_socket_perms;
|
|
|
|
allow stunnel_t stunnel_etc_t:dir list_dir_perms;
|
|
allow stunnel_t stunnel_etc_t:file read_file_perms;
|
|
allow stunnel_t stunnel_etc_t:lnk_file { getattr read };
|
|
|
|
manage_dirs_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t)
|
|
manage_files_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t)
|
|
files_tmp_filetrans(stunnel_t, stunnel_tmp_t, { file dir })
|
|
|
|
manage_dirs_pattern(stunnel_t, stunnel_var_run_t, stunnel_var_run_t)
|
|
manage_files_pattern(stunnel_t, stunnel_var_run_t, stunnel_var_run_t)
|
|
files_pid_filetrans(stunnel_t, stunnel_var_run_t, { dir file })
|
|
|
|
kernel_read_kernel_sysctls(stunnel_t)
|
|
kernel_read_system_state(stunnel_t)
|
|
kernel_read_network_state(stunnel_t)
|
|
|
|
corecmd_exec_bin(stunnel_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(stunnel_t)
|
|
corenet_all_recvfrom_netlabel(stunnel_t)
|
|
corenet_tcp_sendrecv_generic_if(stunnel_t)
|
|
corenet_udp_sendrecv_generic_if(stunnel_t)
|
|
corenet_tcp_sendrecv_generic_node(stunnel_t)
|
|
corenet_udp_sendrecv_generic_node(stunnel_t)
|
|
corenet_tcp_sendrecv_all_ports(stunnel_t)
|
|
corenet_udp_sendrecv_all_ports(stunnel_t)
|
|
corenet_tcp_bind_generic_node(stunnel_t)
|
|
corenet_tcp_connect_all_ports(stunnel_t)
|
|
|
|
fs_getattr_all_fs(stunnel_t)
|
|
|
|
auth_use_nsswitch(stunnel_t)
|
|
|
|
logging_send_syslog_msg(stunnel_t)
|
|
|
|
miscfiles_read_localization(stunnel_t)
|
|
|
|
sysnet_read_config(stunnel_t)
|
|
|
|
ifdef(`distro_gentoo',`
|
|
dontaudit stunnel_t self:capability sys_tty_config;
|
|
allow stunnel_t self:udp_socket create_socket_perms;
|
|
|
|
dev_read_sysfs(stunnel_t)
|
|
|
|
fs_search_auto_mountpoints(stunnel_t)
|
|
|
|
domain_use_interactive_fds(stunnel_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(stunnel_t)
|
|
userdom_dontaudit_search_user_home_dirs(stunnel_t)
|
|
|
|
optional_policy(`
|
|
daemontools_service_domain(stunnel_t, stunnel_exec_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(stunnel_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(stunnel_t)
|
|
')
|
|
',`
|
|
allow stunnel_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
|
|
|
|
dev_read_urand(stunnel_t)
|
|
|
|
files_read_etc_files(stunnel_t)
|
|
files_read_etc_runtime_files(stunnel_t)
|
|
files_search_home(stunnel_t)
|
|
|
|
optional_policy(`
|
|
kerberos_use(stunnel_t)
|
|
')
|
|
')
|
|
|
|
# hack since this port has no interfaces since it doesnt
|
|
# have net_contexts
|
|
gen_require(`
|
|
type stunnel_port_t;
|
|
')
|
|
|
|
allow stunnel_t stunnel_port_t:tcp_socket name_bind;
|