selinux-policy/strict/domains/program/radius.te
2005-09-12 21:40:56 +00:00

67 lines
1.8 KiB
Plaintext

#DESC RADIUS - Radius server
#
# Author: Russell Coker <russell@coker.com.au>
# X-Debian-Packages: radiusd-cistron radiusd-livingston xtradius yardradius radiusd-freeradius
#
#################################
#
# Rules for the radiusd_t domain.
#
# radiusd_exec_t is the type of the radiusd executable.
#
daemon_domain(radiusd, `, auth')
etcdir_domain(radiusd)
system_crond_entry(radiusd_exec_t, radiusd_t)
allow radiusd_t self:process setsched;
allow radiusd_t proc_t:file { read getattr };
dontaudit radiusd_t sysadm_home_dir_t:dir getattr;
# allow pthreads to read kernel version
read_sysctl(radiusd_t)
# read config files
allow radiusd_t etc_t:dir r_dir_perms;
allow radiusd_t { etc_t etc_runtime_t }:file { read getattr };
allow radiusd_t etc_t:lnk_file read;
# write log files
logdir_domain(radiusd)
allow radiusd_t radiusd_log_t:dir create;
allow radiusd_t usr_t:file r_file_perms;
can_exec(radiusd_t, lib_t)
can_exec(radiusd_t, { bin_t shell_exec_t })
allow radiusd_t { bin_t sbin_t }:dir search;
allow radiusd_t bin_t:lnk_file read;
allow radiusd_t devtty_t:chr_file { read write };
allow radiusd_t self:fifo_file rw_file_perms;
# fsetid is for gzip which needs it when run from scripts
# gzip also needs chown access to preserve GID for radwtmp files
allow radiusd_t self:capability { chown dac_override fsetid kill setgid setuid sys_resource sys_tty_config };
can_network_server(radiusd_t)
can_ypbind(radiusd_t)
allow radiusd_t { radius_port_t radacct_port_t }:udp_socket name_bind;
# for RADIUS proxy port
allow radiusd_t port_t:udp_socket name_bind;
ifdef(`snmpd.te', `
can_tcp_connect(radiusd_t, snmpd_t)
')
ifdef(`logrotate.te', `
can_exec(radiusd_t, logrotate_exec_t)
')
can_udp_send(sysadm_t, radiusd_t)
can_udp_send(radiusd_t, sysadm_t)
allow radiusd_t self:unix_stream_socket create_stream_socket_perms;