diff options
| author |   Sven Vermeulen <sven.vermeulen@siphos.be> | 2013-09-23 08:28:32 +0200 |
|---|---|---|
| committer | Sven Vermeulen <sven.vermeulen@siphos.be> | 2013-09-23 08:28:32 +0200 |
| commit | fc59b320f3810020c99f266567d2fa05517a8972 (patch) | |
| tree | 512bddd3b67f51098e3a8534d4e863091a3789e2 /policy/modules/contrib/redis.te | |
| parent | Add policy for redis-server (diff) | |
| download | hardened-refpolicy-fc59b320f3810020c99f266567d2fa05517a8972.tar.gz hardened-refpolicy-fc59b320f3810020c99f266567d2fa05517a8972.tar.bz2 hardened-refpolicy-fc59b320f3810020c99f266567d2fa05517a8972.zip | |
Move redis policy to contrib
Diffstat (limited to 'policy/modules/contrib/redis.te')
| -rw-r--r-- | policy/modules/contrib/redis.te | 62 |
1 files changed, 62 insertions, 0 deletions
diff --git a/policy/modules/contrib/redis.te b/policy/modules/contrib/redis.te new file mode 100644 index 000000000..e5e9cf772 --- /dev/null +++ b/policy/modules/contrib/redis.te @@ -0,0 +1,62 @@ +policy_module(redis, 1.0.0) + +######################################## +# +# Declarations +# + +type redis_t; +type redis_exec_t; +init_daemon_domain(redis_t, redis_exec_t) + +type redis_initrc_exec_t; +init_script_file(redis_initrc_exec_t) + +type redis_log_t; +logging_log_file(redis_log_t) + +type redis_var_lib_t; +files_type(redis_var_lib_t) + +type redis_var_run_t; +files_pid_file(redis_var_run_t) + +type redis_unit_file_t; +systemd_unit_file(redis_unit_file_t) + +######################################## +# +# redis local policy +# + +allow redis_t self:process { setrlimit signal_perms }; +allow redis_t self:fifo_file rw_fifo_file_perms; +allow redis_t self:unix_stream_socket create_stream_socket_perms; +allow redis_t self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(redis_t, redis_log_t, redis_log_t) +manage_files_pattern(redis_t, redis_log_t, redis_log_t) +manage_lnk_files_pattern(redis_t, redis_log_t, redis_log_t) + +manage_dirs_pattern(redis_t, redis_var_lib_t, redis_var_lib_t) +manage_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t) +manage_lnk_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t) + +manage_dirs_pattern(redis_t, redis_var_run_t, redis_var_run_t) +manage_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) +manage_lnk_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) + +kernel_read_system_state(redis_t) + +corenet_tcp_bind_generic_node(redis_t) +corenet_tcp_bind_redis_port(redis_t) + +dev_read_sysfs(redis_t) +dev_read_urand(redis_t) + +logging_send_syslog_msg(redis_t) + +miscfiles_read_localization(redis_t) + +sysnet_dns_name_resolve(redis_t) + |