1dfc76f76b
Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible.
94 lines
2.4 KiB
Plaintext
94 lines
2.4 KiB
Plaintext
policy_module(canna, 1.10.1)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type canna_t;
|
|
type canna_exec_t;
|
|
init_daemon_domain(canna_t, canna_exec_t)
|
|
|
|
type canna_initrc_exec_t;
|
|
init_script_file(canna_initrc_exec_t)
|
|
|
|
type canna_log_t;
|
|
logging_log_file(canna_log_t)
|
|
|
|
type canna_var_lib_t;
|
|
files_type(canna_var_lib_t)
|
|
|
|
type canna_var_run_t;
|
|
files_pid_file(canna_var_run_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow canna_t self:capability { setgid setuid net_bind_service };
|
|
dontaudit canna_t self:capability sys_tty_config;
|
|
allow canna_t self:process signal_perms;
|
|
allow canna_t self:unix_stream_socket { connectto create_stream_socket_perms};
|
|
allow canna_t self:unix_dgram_socket create_stream_socket_perms;
|
|
allow canna_t self:tcp_socket create_stream_socket_perms;
|
|
|
|
manage_files_pattern(canna_t, canna_log_t, canna_log_t)
|
|
allow canna_t canna_log_t:dir setattr_dir_perms;
|
|
logging_log_filetrans(canna_t, canna_log_t, { file dir })
|
|
|
|
manage_dirs_pattern(canna_t, canna_var_lib_t, canna_var_lib_t)
|
|
manage_files_pattern(canna_t, canna_var_lib_t, canna_var_lib_t)
|
|
manage_lnk_files_pattern(canna_t, canna_var_lib_t, canna_var_lib_t)
|
|
files_var_lib_filetrans(canna_t, canna_var_lib_t, file)
|
|
|
|
manage_dirs_pattern(canna_t, canna_var_run_t, canna_var_run_t)
|
|
manage_files_pattern(canna_t, canna_var_run_t, canna_var_run_t)
|
|
manage_sock_files_pattern(canna_t, canna_var_run_t, canna_var_run_t)
|
|
files_pid_filetrans(canna_t, canna_var_run_t, { dir file sock_file })
|
|
|
|
kernel_read_kernel_sysctls(canna_t)
|
|
kernel_read_system_state(canna_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(canna_t)
|
|
corenet_all_recvfrom_netlabel(canna_t)
|
|
corenet_tcp_sendrecv_generic_if(canna_t)
|
|
corenet_tcp_sendrecv_generic_node(canna_t)
|
|
corenet_tcp_sendrecv_all_ports(canna_t)
|
|
corenet_tcp_connect_all_ports(canna_t)
|
|
corenet_sendrecv_all_client_packets(canna_t)
|
|
|
|
dev_read_sysfs(canna_t)
|
|
|
|
fs_getattr_all_fs(canna_t)
|
|
fs_search_auto_mountpoints(canna_t)
|
|
|
|
domain_use_interactive_fds(canna_t)
|
|
|
|
files_read_etc_files(canna_t)
|
|
files_read_etc_runtime_files(canna_t)
|
|
files_read_usr_files(canna_t)
|
|
files_search_tmp(canna_t)
|
|
files_dontaudit_read_root_files(canna_t)
|
|
|
|
logging_send_syslog_msg(canna_t)
|
|
|
|
miscfiles_read_localization(canna_t)
|
|
|
|
sysnet_read_config(canna_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(canna_t)
|
|
userdom_dontaudit_search_user_home_dirs(canna_t)
|
|
|
|
optional_policy(`
|
|
nis_use_ypbind(canna_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(canna_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(canna_t)
|
|
')
|