selinux-policy/mls/domains/program/unused/gatekeeper.te
2005-11-22 19:28:03 +00:00

52 lines
1.4 KiB
Plaintext

#DESC Gatekeeper - OpenH.323 voice over IP gate-keeper
#
# Author: Russell Coker <russell@coker.com.au>
# X-Debian-Packages: opengate openh323gk
#
#################################
#
# Rules for the gatekeeper_t domain.
#
# gatekeeper_exec_t is the type of the gk executable.
#
daemon_domain(gatekeeper)
# for SSP
allow gatekeeper_t urandom_device_t:chr_file read;
etc_domain(gatekeeper)
allow gatekeeper_t gatekeeper_etc_t:lnk_file { getattr read };
logdir_domain(gatekeeper)
# Use the network.
can_network_server(gatekeeper_t)
can_ypbind(gatekeeper_t)
allow gatekeeper_t gatekeeper_port_t:{ udp_socket tcp_socket } name_bind;
allow gatekeeper_t self:unix_stream_socket create_socket_perms;
# for stupid symlinks
tmp_domain(gatekeeper)
# pthreads wants to know the kernel version
read_sysctl(gatekeeper_t)
allow gatekeeper_t etc_t:file { getattr read };
allow gatekeeper_t etc_t:dir r_dir_perms;
allow gatekeeper_t sbin_t:dir r_dir_perms;
allow gatekeeper_t self:process setsched;
allow gatekeeper_t self:fifo_file rw_file_perms;
allow gatekeeper_t proc_t:file read;
# for local users to run VOIP software
can_udp_send(userdomain, gatekeeper_t)
can_udp_send(gatekeeper_t, userdomain)
can_tcp_connect(gatekeeper_t, userdomain)
# this is crap, gk wants to create symlinks in /etc every time it starts and
# remove them when it exits.
#allow gatekeeper_t etc_t:dir rw_dir_perms;