18f2a72d7f
Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.
104 lines
2.7 KiB
Plaintext
104 lines
2.7 KiB
Plaintext
policy_module(privoxy, 1.10.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Allow privoxy to connect to all ports, not just
|
|
## HTTP, FTP, and Gopher ports.
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(privoxy_connect_any, false)
|
|
|
|
type privoxy_t; # web_client_domain
|
|
type privoxy_exec_t;
|
|
init_daemon_domain(privoxy_t, privoxy_exec_t)
|
|
|
|
type privoxy_initrc_exec_t;
|
|
init_script_file(privoxy_initrc_exec_t)
|
|
|
|
type privoxy_etc_rw_t;
|
|
files_type(privoxy_etc_rw_t)
|
|
|
|
type privoxy_log_t;
|
|
logging_log_file(privoxy_log_t)
|
|
|
|
type privoxy_var_run_t;
|
|
files_pid_file(privoxy_var_run_t)
|
|
|
|
########################################
|
|
#
|
|
# Local Policy
|
|
#
|
|
|
|
allow privoxy_t self:capability { setgid setuid };
|
|
dontaudit privoxy_t self:capability sys_tty_config;
|
|
allow privoxy_t self:tcp_socket create_stream_socket_perms;
|
|
|
|
allow privoxy_t privoxy_etc_rw_t:file rw_file_perms;
|
|
|
|
manage_files_pattern(privoxy_t, privoxy_log_t, privoxy_log_t)
|
|
logging_log_filetrans(privoxy_t, privoxy_log_t, file)
|
|
|
|
manage_files_pattern(privoxy_t, privoxy_var_run_t, privoxy_var_run_t)
|
|
files_pid_filetrans(privoxy_t, privoxy_var_run_t, file)
|
|
|
|
kernel_read_system_state(privoxy_t)
|
|
kernel_read_kernel_sysctls(privoxy_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(privoxy_t)
|
|
corenet_all_recvfrom_netlabel(privoxy_t)
|
|
corenet_tcp_sendrecv_generic_if(privoxy_t)
|
|
corenet_tcp_sendrecv_generic_node(privoxy_t)
|
|
corenet_tcp_sendrecv_all_ports(privoxy_t)
|
|
corenet_tcp_bind_generic_node(privoxy_t)
|
|
corenet_tcp_bind_http_cache_port(privoxy_t)
|
|
corenet_tcp_connect_http_port(privoxy_t)
|
|
corenet_tcp_connect_http_cache_port(privoxy_t)
|
|
corenet_tcp_connect_squid_port(privoxy_t)
|
|
corenet_tcp_connect_ftp_port(privoxy_t)
|
|
corenet_tcp_connect_pgpkeyserver_port(privoxy_t)
|
|
corenet_tcp_connect_tor_port(privoxy_t)
|
|
corenet_sendrecv_http_cache_client_packets(privoxy_t)
|
|
corenet_sendrecv_squid_client_packets(privoxy_t)
|
|
corenet_sendrecv_http_cache_server_packets(privoxy_t)
|
|
corenet_sendrecv_http_client_packets(privoxy_t)
|
|
corenet_sendrecv_ftp_client_packets(privoxy_t)
|
|
corenet_sendrecv_tor_client_packets(privoxy_t)
|
|
|
|
dev_read_sysfs(privoxy_t)
|
|
|
|
fs_getattr_all_fs(privoxy_t)
|
|
fs_search_auto_mountpoints(privoxy_t)
|
|
|
|
domain_use_interactive_fds(privoxy_t)
|
|
|
|
files_read_etc_files(privoxy_t)
|
|
|
|
auth_use_nsswitch(privoxy_t)
|
|
|
|
logging_send_syslog_msg(privoxy_t)
|
|
|
|
miscfiles_read_localization(privoxy_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(privoxy_t)
|
|
userdom_dontaudit_search_user_home_dirs(privoxy_t)
|
|
# cjp: this should really not be needed
|
|
userdom_use_user_terminals(privoxy_t)
|
|
|
|
tunable_policy(`privoxy_connect_any',`
|
|
corenet_tcp_connect_all_ports(privoxy_t)
|
|
corenet_sendrecv_all_client_packets(privoxy_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(privoxy_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(privoxy_t)
|
|
')
|