86 lines
2.1 KiB
Plaintext
86 lines
2.1 KiB
Plaintext
#
|
|
# Macros for irc domains.
|
|
#
|
|
|
|
#
|
|
# Author: Russell Coker <russell@coker.com.au>
|
|
#
|
|
|
|
#
|
|
# irc_domain(domain_prefix)
|
|
#
|
|
# Define a derived domain for the irc program when executed
|
|
# by a user domain.
|
|
#
|
|
# The type declaration for the executable type for this program is
|
|
# provided separately in domains/program/irc.te.
|
|
#
|
|
undefine(`irc_domain')
|
|
ifdef(`irc.te', `
|
|
define(`irc_domain',`
|
|
|
|
# Home domain
|
|
home_domain($1, irc)
|
|
file_type_auto_trans($1_irc_t, $1_home_dir_t, $1_irc_home_t, dir)
|
|
|
|
# Derived domain based on the calling user domain and the program.
|
|
type $1_irc_t, domain;
|
|
type $1_irc_exec_t, file_type, sysadmfile, $1_file_type;
|
|
|
|
allow $1_t $1_irc_exec_t:file { relabelfrom relabelto create_file_perms };
|
|
|
|
# Transition from the user domain to this domain.
|
|
domain_auto_trans($1_t, { irc_exec_t $1_irc_exec_t }, $1_irc_t)
|
|
|
|
# The user role is authorized for this domain.
|
|
role $1_r types $1_irc_t;
|
|
|
|
# Inherit and use descriptors from gnome-pty-helper.
|
|
ifdef(`gnome-pty-helper.te', `allow $1_irc_t $1_gph_t:fd use;')
|
|
|
|
# Inherit and use descriptors from newrole.
|
|
ifdef(`newrole.te', `allow $1_irc_t newrole_t:fd use;')
|
|
|
|
# allow ps to show irc
|
|
can_ps($1_t, $1_irc_t)
|
|
allow $1_t $1_irc_t:process signal;
|
|
|
|
# Use the network.
|
|
can_network_client($1_irc_t)
|
|
allow $1_irc_t port_type:tcp_socket name_connect;
|
|
can_ypbind($1_irc_t)
|
|
|
|
allow $1_irc_t usr_t:file { getattr read };
|
|
|
|
access_terminal($1_irc_t, $1)
|
|
uses_shlib($1_irc_t)
|
|
allow $1_irc_t etc_t:file { read getattr };
|
|
read_locale($1_irc_t)
|
|
allow $1_irc_t fs_t:filesystem getattr;
|
|
allow $1_irc_t var_t:dir search;
|
|
allow $1_irc_t device_t:dir search;
|
|
allow $1_irc_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow $1_irc_t privfd:fd use;
|
|
allow $1_irc_t proc_t:dir search;
|
|
allow $1_irc_t { self proc_t }:lnk_file read;
|
|
allow $1_irc_t self:dir search;
|
|
dontaudit $1_irc_t var_run_t:dir search;
|
|
|
|
# allow utmp access
|
|
allow $1_irc_t initrc_var_run_t:file { getattr read };
|
|
dontaudit $1_irc_t initrc_var_run_t:file lock;
|
|
|
|
# access files under /tmp
|
|
file_type_auto_trans($1_irc_t, tmp_t, $1_tmp_t)
|
|
|
|
ifdef(`ircd.te', `
|
|
can_tcp_connect($1_irc_t, ircd_t)
|
|
')dnl end ifdef irc.te
|
|
')dnl end macro definition
|
|
|
|
', `
|
|
|
|
define(`irc_domain',`')
|
|
|
|
')dnl end ifdef irc.te
|