1e2abee10b
Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.
177 lines
4.4 KiB
Plaintext
177 lines
4.4 KiB
Plaintext
policy_module(snmp, 1.11.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type snmpd_t;
|
|
type snmpd_exec_t;
|
|
init_daemon_domain(snmpd_t, snmpd_exec_t)
|
|
|
|
type snmpd_initrc_exec_t;
|
|
init_script_file(snmpd_initrc_exec_t)
|
|
|
|
type snmpd_log_t;
|
|
logging_log_file(snmpd_log_t)
|
|
|
|
type snmpd_var_run_t;
|
|
files_pid_file(snmpd_var_run_t)
|
|
|
|
type snmpd_var_lib_t;
|
|
files_type(snmpd_var_lib_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow snmpd_t self:capability { chown dac_override kill ipc_lock setgid setuid sys_ptrace net_admin sys_nice sys_tty_config };
|
|
dontaudit snmpd_t self:capability { sys_module sys_tty_config };
|
|
allow snmpd_t self:process { signal_perms getsched setsched };
|
|
allow snmpd_t self:fifo_file rw_fifo_file_perms;
|
|
allow snmpd_t self:unix_dgram_socket create_socket_perms;
|
|
allow snmpd_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow snmpd_t self:tcp_socket create_stream_socket_perms;
|
|
allow snmpd_t self:udp_socket connected_stream_socket_perms;
|
|
|
|
allow snmpd_t snmpd_log_t:file manage_file_perms;
|
|
logging_log_filetrans(snmpd_t, snmpd_log_t, file)
|
|
|
|
manage_dirs_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
|
|
manage_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
|
|
manage_sock_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
|
|
files_usr_filetrans(snmpd_t, snmpd_var_lib_t, file)
|
|
files_var_filetrans(snmpd_t, snmpd_var_lib_t, { file dir sock_file })
|
|
files_var_lib_filetrans(snmpd_t, snmpd_var_lib_t, file)
|
|
|
|
manage_dirs_pattern(snmpd_t, snmpd_var_run_t, snmpd_var_run_t)
|
|
manage_files_pattern(snmpd_t, snmpd_var_run_t, snmpd_var_run_t)
|
|
files_pid_filetrans(snmpd_t, snmpd_var_run_t, { file dir })
|
|
|
|
kernel_read_device_sysctls(snmpd_t)
|
|
kernel_read_kernel_sysctls(snmpd_t)
|
|
kernel_read_fs_sysctls(snmpd_t)
|
|
kernel_read_net_sysctls(snmpd_t)
|
|
kernel_read_proc_symlinks(snmpd_t)
|
|
kernel_read_system_state(snmpd_t)
|
|
kernel_read_network_state(snmpd_t)
|
|
|
|
corecmd_exec_bin(snmpd_t)
|
|
corecmd_exec_shell(snmpd_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(snmpd_t)
|
|
corenet_all_recvfrom_netlabel(snmpd_t)
|
|
corenet_tcp_sendrecv_generic_if(snmpd_t)
|
|
corenet_udp_sendrecv_generic_if(snmpd_t)
|
|
corenet_tcp_sendrecv_generic_node(snmpd_t)
|
|
corenet_udp_sendrecv_generic_node(snmpd_t)
|
|
corenet_tcp_sendrecv_all_ports(snmpd_t)
|
|
corenet_udp_sendrecv_all_ports(snmpd_t)
|
|
corenet_tcp_bind_generic_node(snmpd_t)
|
|
corenet_udp_bind_generic_node(snmpd_t)
|
|
corenet_tcp_bind_snmp_port(snmpd_t)
|
|
corenet_udp_bind_snmp_port(snmpd_t)
|
|
corenet_sendrecv_snmp_server_packets(snmpd_t)
|
|
corenet_tcp_connect_agentx_port(snmpd_t)
|
|
corenet_tcp_bind_agentx_port(snmpd_t)
|
|
corenet_udp_bind_agentx_port(snmpd_t)
|
|
|
|
dev_list_sysfs(snmpd_t)
|
|
dev_read_sysfs(snmpd_t)
|
|
dev_read_urand(snmpd_t)
|
|
dev_read_rand(snmpd_t)
|
|
dev_getattr_usbfs_dirs(snmpd_t)
|
|
|
|
domain_use_interactive_fds(snmpd_t)
|
|
domain_signull_all_domains(snmpd_t)
|
|
domain_read_all_domains_state(snmpd_t)
|
|
domain_dontaudit_ptrace_all_domains(snmpd_t)
|
|
domain_exec_all_entry_files(snmpd_t)
|
|
|
|
files_read_etc_files(snmpd_t)
|
|
files_read_usr_files(snmpd_t)
|
|
files_read_etc_runtime_files(snmpd_t)
|
|
files_search_home(snmpd_t)
|
|
|
|
fs_getattr_all_dirs(snmpd_t)
|
|
fs_getattr_all_fs(snmpd_t)
|
|
fs_search_auto_mountpoints(snmpd_t)
|
|
|
|
storage_dontaudit_read_fixed_disk(snmpd_t)
|
|
storage_dontaudit_read_removable_device(snmpd_t)
|
|
storage_dontaudit_write_removable_device(snmpd_t)
|
|
|
|
auth_use_nsswitch(snmpd_t)
|
|
auth_read_all_dirs_except_shadow(snmpd_t)
|
|
|
|
init_read_utmp(snmpd_t)
|
|
init_dontaudit_write_utmp(snmpd_t)
|
|
|
|
logging_send_syslog_msg(snmpd_t)
|
|
|
|
miscfiles_read_localization(snmpd_t)
|
|
|
|
seutil_dontaudit_search_config(snmpd_t)
|
|
|
|
sysnet_read_config(snmpd_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(snmpd_t)
|
|
userdom_dontaudit_search_user_home_dirs(snmpd_t)
|
|
|
|
ifdef(`distro_redhat',`
|
|
optional_policy(`
|
|
rpm_read_db(snmpd_t)
|
|
rpm_dontaudit_manage_db(snmpd_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
amanda_dontaudit_read_dumpdates(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
consoletype_exec(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
cups_read_rw_config(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
mta_read_config(snmpd_t)
|
|
mta_search_queue(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
rpc_search_nfs_state_data(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
sendmail_read_log(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
squid_read_config(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
virt_stream_connect(snmpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
kernel_read_xen_state(snmpd_t)
|
|
kernel_write_xen_state(snmpd_t)
|
|
|
|
xen_stream_connect(snmpd_t)
|
|
xen_stream_connect_xenstore(snmpd_t)
|
|
')
|