7d1f5642b0
Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible.
121 lines
2.9 KiB
Plaintext
121 lines
2.9 KiB
Plaintext
policy_module(stunnel, 1.9.1)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type stunnel_t;
|
|
type stunnel_exec_t;
|
|
|
|
type stunnel_etc_t;
|
|
files_config_file(stunnel_etc_t)
|
|
|
|
type stunnel_tmp_t;
|
|
files_tmp_file(stunnel_tmp_t)
|
|
|
|
type stunnel_var_run_t;
|
|
files_pid_file(stunnel_var_run_t)
|
|
|
|
ifdef(`distro_gentoo',`
|
|
init_daemon_domain(stunnel_t, stunnel_exec_t)
|
|
',`
|
|
inetd_tcp_service_domain(stunnel_t, stunnel_exec_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow stunnel_t self:capability { setgid setuid sys_chroot };
|
|
allow stunnel_t self:process signal_perms;
|
|
allow stunnel_t self:fifo_file rw_fifo_file_perms;
|
|
allow stunnel_t self:tcp_socket create_stream_socket_perms;
|
|
allow stunnel_t self:udp_socket create_socket_perms;
|
|
|
|
allow stunnel_t stunnel_etc_t:dir list_dir_perms;
|
|
allow stunnel_t stunnel_etc_t:file read_file_perms;
|
|
allow stunnel_t stunnel_etc_t:lnk_file read_lnk_file_perms;
|
|
|
|
manage_dirs_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t)
|
|
manage_files_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t)
|
|
files_tmp_filetrans(stunnel_t, stunnel_tmp_t, { file dir })
|
|
|
|
manage_dirs_pattern(stunnel_t, stunnel_var_run_t, stunnel_var_run_t)
|
|
manage_files_pattern(stunnel_t, stunnel_var_run_t, stunnel_var_run_t)
|
|
files_pid_filetrans(stunnel_t, stunnel_var_run_t, { dir file })
|
|
|
|
kernel_read_kernel_sysctls(stunnel_t)
|
|
kernel_read_system_state(stunnel_t)
|
|
kernel_read_network_state(stunnel_t)
|
|
|
|
corecmd_exec_bin(stunnel_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(stunnel_t)
|
|
corenet_all_recvfrom_netlabel(stunnel_t)
|
|
corenet_tcp_sendrecv_generic_if(stunnel_t)
|
|
corenet_udp_sendrecv_generic_if(stunnel_t)
|
|
corenet_tcp_sendrecv_generic_node(stunnel_t)
|
|
corenet_udp_sendrecv_generic_node(stunnel_t)
|
|
corenet_tcp_sendrecv_all_ports(stunnel_t)
|
|
corenet_udp_sendrecv_all_ports(stunnel_t)
|
|
corenet_tcp_bind_generic_node(stunnel_t)
|
|
corenet_tcp_connect_all_ports(stunnel_t)
|
|
|
|
fs_getattr_all_fs(stunnel_t)
|
|
|
|
auth_use_nsswitch(stunnel_t)
|
|
|
|
logging_send_syslog_msg(stunnel_t)
|
|
|
|
miscfiles_read_localization(stunnel_t)
|
|
|
|
sysnet_read_config(stunnel_t)
|
|
|
|
ifdef(`distro_gentoo',`
|
|
dontaudit stunnel_t self:capability sys_tty_config;
|
|
allow stunnel_t self:udp_socket create_socket_perms;
|
|
|
|
dev_read_sysfs(stunnel_t)
|
|
|
|
fs_search_auto_mountpoints(stunnel_t)
|
|
|
|
domain_use_interactive_fds(stunnel_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(stunnel_t)
|
|
userdom_dontaudit_search_user_home_dirs(stunnel_t)
|
|
|
|
optional_policy(`
|
|
daemontools_service_domain(stunnel_t, stunnel_exec_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(stunnel_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(stunnel_t)
|
|
')
|
|
',`
|
|
allow stunnel_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
|
|
|
|
dev_read_urand(stunnel_t)
|
|
|
|
files_read_etc_files(stunnel_t)
|
|
files_read_etc_runtime_files(stunnel_t)
|
|
files_search_home(stunnel_t)
|
|
|
|
optional_policy(`
|
|
kerberos_use(stunnel_t)
|
|
')
|
|
')
|
|
|
|
# hack since this port has no interfaces since it doesnt
|
|
# have net_contexts
|
|
gen_require(`
|
|
type stunnel_port_t;
|
|
')
|
|
|
|
allow stunnel_t stunnel_port_t:tcp_socket name_bind;
|