59 lines
1.5 KiB
Plaintext
59 lines
1.5 KiB
Plaintext
#
|
|
# Macros for clamscan
|
|
#
|
|
# Author: Brian May <bam@snoopy.apana.org.au>
|
|
#
|
|
|
|
#
|
|
# can_clamd_connect(domain_prefix)
|
|
#
|
|
# Define a domain that can access clamd
|
|
#
|
|
define(`can_clamd_connect',`
|
|
allow $1_t clamd_var_run_t:dir search;
|
|
allow $1_t clamd_var_run_t:sock_file write;
|
|
allow $1_t clamd_sock_t:sock_file write;
|
|
can_unix_connect($1_t, clamd_t)
|
|
')
|
|
|
|
# clamscan_domain(domain_prefix)
|
|
#
|
|
# Define a derived domain for the clamscan program when executed
|
|
#
|
|
define(`clamscan_domain', `
|
|
# Derived domain based on the calling user domain and the program.
|
|
type $1_clamscan_t, domain, privlog;
|
|
|
|
# Uses shared librarys
|
|
uses_shlib($1_clamscan_t)
|
|
allow $1_clamscan_t fs_t:filesystem getattr;
|
|
r_dir_file($1_clamscan_t, etc_t)
|
|
read_locale($1_clamscan_t)
|
|
|
|
# Access virus signatures
|
|
allow $1_clamscan_t var_lib_t:dir search;
|
|
r_dir_file($1_clamscan_t, clamav_var_lib_t)
|
|
|
|
# Allow temp files
|
|
tmp_domain($1_clamscan)
|
|
|
|
# Why is this required?
|
|
allow $1_clamscan_t proc_t:dir r_dir_perms;
|
|
allow $1_clamscan_t proc_t:file r_file_perms;
|
|
read_sysctl($1_clamscan_t)
|
|
allow $1_clamscan_t self:unix_stream_socket { connect create read write };
|
|
')
|
|
|
|
define(`user_clamscan_domain',`
|
|
clamscan_domain($1)
|
|
role $1_r types $1_clamscan_t;
|
|
domain_auto_trans($1_t, clamscan_exec_t, $1_clamscan_t)
|
|
access_terminal($1_clamscan_t, $1)
|
|
r_dir_file($1_clamscan_t,$1_home_t);
|
|
r_dir_file($1_clamscan_t,$1_home_dir_t);
|
|
allow $1_clamscan_t $1_home_t:file r_file_perms;
|
|
allow $1_clamscan_t privfd:fd use;
|
|
ifdef(`gnome-pty-helper.te', `allow $1_clamscan_t $1_gph_t:fd use;')
|
|
')
|
|
|