73 lines
2.1 KiB
Plaintext
73 lines
2.1 KiB
Plaintext
#DESC Calamaris - Squid log analysis
|
|
#
|
|
# Author: Russell Coker <russell@coker.com.au>
|
|
# X-Debian-Packages: calamaris
|
|
# Depends: squid.te
|
|
#
|
|
|
|
#################################
|
|
#
|
|
# Rules for the calamaris_t domain.
|
|
#
|
|
# calamaris_t is the domain the calamaris process runs in
|
|
|
|
system_domain(calamaris, `, privmail')
|
|
|
|
ifdef(`crond.te', `
|
|
system_crond_entry(calamaris_exec_t, calamaris_t)
|
|
')
|
|
|
|
allow calamaris_t { var_t var_run_t }:dir { getattr search };
|
|
allow calamaris_t squid_log_t:dir search;
|
|
allow calamaris_t squid_log_t:file { getattr read };
|
|
allow calamaris_t { usr_t lib_t }:file { getattr read };
|
|
allow calamaris_t usr_t:lnk_file { getattr read };
|
|
dontaudit calamaris_t usr_t:file ioctl;
|
|
|
|
type calamaris_www_t, file_type, sysadmfile;
|
|
ifdef(`apache.te', `
|
|
allow calamaris_t httpd_sys_content_t:dir search;
|
|
')
|
|
rw_dir_create_file(calamaris_t, calamaris_www_t)
|
|
|
|
# for when squid has a different UID
|
|
allow calamaris_t self:capability dac_override;
|
|
|
|
logdir_domain(calamaris)
|
|
|
|
allow calamaris_t device_t:dir search;
|
|
allow calamaris_t devtty_t:chr_file { read write };
|
|
|
|
allow calamaris_t urandom_device_t:chr_file { getattr read };
|
|
|
|
allow calamaris_t self:process { fork signal_perms setsched };
|
|
read_sysctl(calamaris_t)
|
|
allow calamaris_t proc_t:dir search;
|
|
allow calamaris_t proc_t:file { getattr read };
|
|
allow calamaris_t { proc_t self }:lnk_file read;
|
|
allow calamaris_t self:dir search;
|
|
|
|
allow calamaris_t { bin_t sbin_t }:dir search;
|
|
allow calamaris_t bin_t:lnk_file read;
|
|
allow calamaris_t etc_runtime_t:file { getattr read };
|
|
allow calamaris_t self:fifo_file { getattr read write ioctl };
|
|
read_locale(calamaris_t)
|
|
|
|
can_exec(calamaris_t, bin_t)
|
|
allow calamaris_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow calamaris_t self:udp_socket create_socket_perms;
|
|
allow calamaris_t etc_t:file { getattr read };
|
|
allow calamaris_t etc_t:lnk_file read;
|
|
dontaudit calamaris_t etc_t:file ioctl;
|
|
dontaudit calamaris_t sysadm_home_dir_t:dir { getattr search };
|
|
can_network_server(calamaris_t)
|
|
can_ypbind(calamaris_t)
|
|
ifdef(`named.te', `
|
|
can_udp_send(calamaris_t, named_t)
|
|
can_udp_send(named_t, calamaris_t)
|
|
')
|
|
|
|
ifdef(`apache.te', `
|
|
r_dir_file(httpd_t, calamaris_www_t)
|
|
')
|