74 lines
2.2 KiB
Plaintext
74 lines
2.2 KiB
Plaintext
#DESC Ifconfig - Configure network interfaces
|
|
#
|
|
# Authors: Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser
|
|
# X-Debian-Packages: net-tools
|
|
#
|
|
|
|
#################################
|
|
#
|
|
# Rules for the ifconfig_t domain.
|
|
#
|
|
# ifconfig_t is the domain for the ifconfig program.
|
|
# ifconfig_exec_t is the type of the corresponding program.
|
|
#
|
|
type ifconfig_t, domain, privlog, privmodule;
|
|
type ifconfig_exec_t, file_type, sysadmfile, exec_type;
|
|
|
|
role system_r types ifconfig_t;
|
|
role sysadm_r types ifconfig_t;
|
|
|
|
uses_shlib(ifconfig_t)
|
|
general_domain_access(ifconfig_t)
|
|
|
|
domain_auto_trans(initrc_t, ifconfig_exec_t, ifconfig_t)
|
|
ifdef(`targeted_policy', `', `
|
|
domain_auto_trans(sysadm_t, ifconfig_exec_t, ifconfig_t)
|
|
')
|
|
|
|
# for /sbin/ip
|
|
allow ifconfig_t self:packet_socket create_socket_perms;
|
|
allow ifconfig_t self:netlink_route_socket rw_netlink_socket_perms;
|
|
allow ifconfig_t self:tcp_socket { create ioctl };
|
|
allow ifconfig_t etc_t:file { getattr read };
|
|
|
|
allow ifconfig_t self:socket create_socket_perms;
|
|
|
|
# Use capabilities.
|
|
allow ifconfig_t self:capability { net_raw net_admin };
|
|
dontaudit ifconfig_t self:capability sys_module;
|
|
allow ifconfig_t self:capability sys_tty_config;
|
|
|
|
# Inherit and use descriptors from init.
|
|
allow ifconfig_t { kernel_t init_t }:fd use;
|
|
|
|
# Access /proc
|
|
r_dir_file(ifconfig_t, proc_t)
|
|
r_dir_file(ifconfig_t, proc_net_t)
|
|
|
|
allow ifconfig_t privfd:fd use;
|
|
allow ifconfig_t run_init_t:fd use;
|
|
|
|
# Create UDP sockets, necessary when called from dhcpc
|
|
allow ifconfig_t self:udp_socket create_socket_perms;
|
|
|
|
# Access terminals.
|
|
allow ifconfig_t { user_tty_type initrc_devpts_t admin_tty_type }:chr_file rw_file_perms;
|
|
ifdef(`gnome-pty-helper.te', `allow ifconfig_t sysadm_gph_t:fd use;')
|
|
|
|
allow ifconfig_t tun_tap_device_t:chr_file { read write };
|
|
|
|
# ifconfig attempts to search some sysctl entries.
|
|
# Do not audit those attempts; comment out these rules if it is desired to
|
|
# see the denials.
|
|
dontaudit ifconfig_t { sysctl_t sysctl_net_t }:dir search;
|
|
|
|
allow ifconfig_t fs_t:filesystem getattr;
|
|
|
|
read_locale(ifconfig_t)
|
|
allow ifconfig_t lib_t:file { getattr read };
|
|
|
|
rhgb_domain(ifconfig_t)
|
|
allow ifconfig_t userdomain:fd use;
|
|
dontaudit ifconfig_t root_t:file read;
|
|
r_dir_file(ifconfig_t, sysfs_t)
|