selinux-policy/strict/domains/program/unused/calamaris.te
2005-04-29 17:45:15 +00:00

73 lines
2.1 KiB
Plaintext

#DESC Calamaris - Squid log analysis
#
# Author: Russell Coker <russell@coker.com.au>
# X-Debian-Packages: calamaris
# Depends: squid.te
#
#################################
#
# Rules for the calamaris_t domain.
#
# calamaris_t is the domain the calamaris process runs in
system_domain(calamaris, `, privmail')
ifdef(`crond.te', `
system_crond_entry(calamaris_exec_t, calamaris_t)
')
allow calamaris_t { var_t var_run_t }:dir { getattr search };
allow calamaris_t squid_log_t:dir search;
allow calamaris_t squid_log_t:file { getattr read };
allow calamaris_t { usr_t lib_t }:file { getattr read };
allow calamaris_t usr_t:lnk_file { getattr read };
dontaudit calamaris_t usr_t:file ioctl;
type calamaris_www_t, file_type, sysadmfile;
ifdef(`apache.te', `
allow calamaris_t httpd_sys_content_t:dir search;
')
rw_dir_create_file(calamaris_t, calamaris_www_t)
# for when squid has a different UID
allow calamaris_t self:capability dac_override;
logdir_domain(calamaris)
allow calamaris_t device_t:dir search;
allow calamaris_t devtty_t:chr_file { read write };
allow calamaris_t urandom_device_t:chr_file { getattr read };
allow calamaris_t self:process { fork signal_perms setsched };
read_sysctl(calamaris_t)
allow calamaris_t proc_t:dir search;
allow calamaris_t proc_t:file { getattr read };
allow calamaris_t { proc_t self }:lnk_file read;
allow calamaris_t self:dir search;
allow calamaris_t { bin_t sbin_t }:dir search;
allow calamaris_t bin_t:lnk_file read;
allow calamaris_t etc_runtime_t:file { getattr read };
allow calamaris_t self:fifo_file { getattr read write ioctl };
read_locale(calamaris_t)
can_exec(calamaris_t, bin_t)
allow calamaris_t self:unix_stream_socket create_stream_socket_perms;
allow calamaris_t self:udp_socket create_socket_perms;
allow calamaris_t etc_t:file { getattr read };
allow calamaris_t etc_t:lnk_file read;
dontaudit calamaris_t etc_t:file ioctl;
dontaudit calamaris_t sysadm_home_dir_t:dir { getattr search };
can_network_server(calamaris_t)
can_ypbind(calamaris_t)
ifdef(`named.te', `
can_udp_send(calamaris_t, named_t)
can_udp_send(named_t, calamaris_t)
')
ifdef(`apache.te', `
r_dir_file(httpd_t, calamaris_www_t)
')