65 lines
1.9 KiB
Plaintext
65 lines
1.9 KiB
Plaintext
#DESC Netutils - Network utilities
|
|
#
|
|
# Authors: Stephen Smalley <sds@epoch.ncsc.mil>
|
|
# X-Debian-Packages: netbase iputils arping tcpdump
|
|
#
|
|
|
|
#
|
|
# Rules for the netutils_t domain.
|
|
# This domain is for network utilities that require access to
|
|
# special protocol families.
|
|
#
|
|
type netutils_t, domain, privlog;
|
|
type netutils_exec_t, file_type, sysadmfile, exec_type;
|
|
role system_r types netutils_t;
|
|
role sysadm_r types netutils_t;
|
|
|
|
uses_shlib(netutils_t)
|
|
can_network(netutils_t)
|
|
allow netutils_t port_type:tcp_socket name_connect;
|
|
can_ypbind(netutils_t)
|
|
tmp_domain(netutils)
|
|
|
|
domain_auto_trans(initrc_t, netutils_exec_t, netutils_t)
|
|
ifdef(`targeted_policy', `', `
|
|
domain_auto_trans(sysadm_t, netutils_exec_t, netutils_t)
|
|
')
|
|
|
|
# Inherit and use descriptors from init.
|
|
allow netutils_t { userdomain init_t }:fd use;
|
|
|
|
allow netutils_t self:process { fork signal_perms };
|
|
|
|
# Perform network administration operations and have raw access to the network.
|
|
allow netutils_t self:capability { net_admin net_raw setuid setgid };
|
|
|
|
# Create and use netlink sockets.
|
|
allow netutils_t self:netlink_route_socket { bind create getattr nlmsg_read nlmsg_write read write };
|
|
|
|
# Create and use packet sockets.
|
|
allow netutils_t self:packet_socket create_socket_perms;
|
|
|
|
# Create and use UDP sockets.
|
|
allow netutils_t self:udp_socket create_socket_perms;
|
|
|
|
# Create and use TCP sockets.
|
|
allow netutils_t self:tcp_socket create_socket_perms;
|
|
|
|
allow netutils_t self:unix_stream_socket create_socket_perms;
|
|
|
|
# Read certain files in /etc
|
|
allow netutils_t etc_t:file r_file_perms;
|
|
read_locale(netutils_t)
|
|
|
|
allow netutils_t fs_t:filesystem getattr;
|
|
|
|
# Access terminals.
|
|
allow netutils_t privfd:fd use;
|
|
can_access_pty(netutils_t, initrc)
|
|
allow netutils_t admin_tty_type:chr_file rw_file_perms;
|
|
ifdef(`gnome-pty-helper.te', `allow netutils_t sysadm_gph_t:fd use;')
|
|
allow netutils_t proc_t:dir search;
|
|
|
|
# for nscd
|
|
dontaudit netutils_t var_t:dir search;
|