dd14d0d892
permission is checked when using shared libs to execute code in them, which is not the same as just reading the shared libs.
105 lines
2.6 KiB
Plaintext
105 lines
2.6 KiB
Plaintext
# Copyright (C) 2005 Tresys Technology, LLC
|
|
|
|
policy_module(hostname,1.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type hostname_t;
|
|
type hostname_exec_t;
|
|
init_make_system_domain(hostname_t,hostname_exec_t)
|
|
role system_r types hostname_t;
|
|
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
# for setting the hostname
|
|
allow hostname_t self:process { sigchld sigkill sigstop signull signal };
|
|
|
|
allow hostname_t self:capability sys_admin;
|
|
dontaudit hostname_t self:capability sys_tty_config;
|
|
|
|
sysnetwork_read_network_config(hostname_t)
|
|
|
|
kernel_read_kernel_sysctl(hostname_t)
|
|
kernel_read_hardware_state(hostname_t)
|
|
kernel_ignore_use_file_descriptors(hostname_t)
|
|
|
|
files_read_general_system_config(hostname_t)
|
|
files_ignore_search_system_state_data_directory(hostname_t)
|
|
filesystem_get_persistent_filesystem_attributes(hostname_t)
|
|
|
|
terminal_ignore_use_console(hostname_t)
|
|
terminal_use_all_private_physical_terminals(hostname_t)
|
|
terminal_use_all_private_pseudoterminals(hostname_t)
|
|
|
|
init_use_file_descriptors(hostname_t)
|
|
init_script_use_pseudoterminal(hostname_t)
|
|
|
|
domain_use_widely_inheritable_file_descriptors(hostname_t)
|
|
|
|
libraries_use_dynamic_loader(hostname_t)
|
|
libraries_use_shared_libraries(hostname_t)
|
|
|
|
logging_send_system_log_message(hostname_t)
|
|
|
|
miscfiles_read_localization(hostname_t)
|
|
|
|
tunable_policy(`targeted_policy', `
|
|
terminal_ignore_use_general_physical_terminal(hostname_t)
|
|
terminal_ignore_use_general_pseudoterminal(hostname_t)
|
|
files_ignore_read_rootfs_file(hostname_t)
|
|
')dnl end targeted_policy tunable
|
|
|
|
optional_policy(`hotplug.te',`
|
|
hotplug_ignore_use_file_descriptors(hostname_t)
|
|
')
|
|
|
|
optional_policy(`selinux.te',`
|
|
selinux_newrole_sigchld(hostname_t)
|
|
')
|
|
|
|
optional_policy(`udev.te', `
|
|
udev_read_database(hostname_t)
|
|
')
|
|
|
|
ifdef(`TODO',`
|
|
|
|
##daemon_base_domain(hostname, , nosysadm)
|
|
##must remembe to go back and take care of the nosysadm part
|
|
allow hostname_t proc_t:dir { read getattr lock search ioctl };
|
|
allow hostname_t proc_t:lnk_file read;
|
|
|
|
optional_policy(`rhgb.te', `
|
|
allow hostname_t rhgb_t:process sigchld;
|
|
allow hostname_t rhgb_t:fd use;
|
|
allow hostname_t rhgb_t:fifo_file { read write };
|
|
')
|
|
|
|
dontaudit hostname_t unpriv_userdomain:fd use;
|
|
allow hostname_t autofs_t:dir { search getattr };
|
|
##end daemon_base_domain
|
|
|
|
##can_resolve(hostname_t)
|
|
ifdef(`use_dns',`
|
|
base_can_network(hostname_t, udp, `dns_port_t')
|
|
allow hostname_t self:udp_socket { connect };
|
|
')
|
|
##end can_resolve
|
|
|
|
allow hostname_t userdomain:fd use;
|
|
|
|
# for when /usr is not mounted
|
|
dontaudit hostname_t file_t:dir search;
|
|
|
|
tunable_policy(`distro_redhat', `
|
|
allow hostname_t tmpfs_t:chr_file { ioctl read getattr lock write append };
|
|
')
|
|
|
|
') dnl end TODO
|