selinux-policy/strict/domains/program/prelink.te
2005-04-29 17:45:15 +00:00

56 lines
1.9 KiB
Plaintext

#DESC PRELINK - Security Enhanced version of the GNU Prelink
#
# Author: Dan Walsh <dwalsh@redhat.com>
#
#################################
#
# Rules for the prelink_t domain.
#
# prelink_exec_t is the type of the prelink executable.
#
daemon_base_domain(prelink, `, admin')
if (allow_execmem) {
allow prelink_t self:process execmem;
}
if (allow_execmod) {
allow prelink_t texrel_shlib_t:file execmod;
}
allow prelink_t fs_t:filesystem getattr;
ifdef(`crond.te', `
system_crond_entry(prelink_exec_t, prelink_t)
allow system_crond_t prelink_log_t:dir rw_dir_perms;
allow system_crond_t prelink_log_t:file create_file_perms;
allow system_crond_t prelink_cache_t:file { getattr read unlink };
allow prelink_t crond_log_t:file append;
')
logdir_domain(prelink)
type etc_prelink_t, file_type, sysadmfile;
type var_lock_prelink_t, file_type, sysadmfile, lockfile;
allow prelink_t etc_prelink_t:file { getattr read };
allow prelink_t file_type:dir rw_dir_perms;
allow prelink_t file_type:lnk_file r_file_perms;
allow prelink_t file_type:file getattr;
allow prelink_t { ifdef(`amanda.te', `amanda_usr_lib_t') admin_passwd_exec_t ifdef(`apache.te', `httpd_modules_t') ifdef(`xserver.te', `var_lib_xkb_t') ld_so_t su_exec_t texrel_shlib_t shlib_t sbin_t bin_t lib_t exec_type }:file { create_file_perms execute relabelto relabelfrom };
allow prelink_t ld_so_t:file execute_no_trans;
allow prelink_t self:capability { chown dac_override fowner fsetid };
allow prelink_t self:fifo_file rw_file_perms;
allow prelink_t self:file { getattr read };
dontaudit prelink_t sysctl_kernel_t:dir search;
dontaudit prelink_t sysctl_t:dir search;
allow prelink_t etc_runtime_t:file { getattr read };
read_locale(prelink_t)
allow prelink_t urandom_device_t:chr_file read;
allow prelink_t proc_t:file { getattr read };
#
# prelink_cache_t is the type of /etc/prelink.cache.
#
type prelink_cache_t, file_type, sysadmfile;
file_type_auto_trans(prelink_t, etc_t, prelink_cache_t, file)