diff options
Diffstat (limited to 'policy/modules/services/portreserve.te')
| -rw-r--r-- | policy/modules/services/portreserve.te | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/policy/modules/services/portreserve.te b/policy/modules/services/portreserve.te new file mode 100644 index 000000000..4a42d7ceb --- /dev/null +++ b/policy/modules/services/portreserve.te @@ -0,0 +1,61 @@ +policy_module(portreserve, 1.7.0) + +######################################## +# +# Declarations +# + +type portreserve_t; +type portreserve_exec_t; +init_daemon_domain(portreserve_t, portreserve_exec_t) + +type portreserve_initrc_exec_t; +init_script_file(portreserve_initrc_exec_t) + +type portreserve_etc_t; +files_config_file(portreserve_etc_t) + +type portreserve_var_run_t; +files_pid_file(portreserve_var_run_t) + +######################################## +# +# Local policy +# + +allow portreserve_t self:capability { dac_override dac_read_search }; +allow portreserve_t self:fifo_file rw_fifo_file_perms; +allow portreserve_t self:unix_stream_socket create_stream_socket_perms; +allow portreserve_t self:unix_dgram_socket { create_socket_perms sendto }; +allow portreserve_t self:tcp_socket create_socket_perms; +allow portreserve_t self:udp_socket create_socket_perms; + +allow portreserve_t portreserve_etc_t:dir list_dir_perms; +allow portreserve_t portreserve_etc_t:file read_file_perms; +allow portreserve_t portreserve_etc_t:lnk_file read_lnk_file_perms; + +manage_dirs_pattern(portreserve_t, portreserve_var_run_t, portreserve_var_run_t) +manage_files_pattern(portreserve_t, portreserve_var_run_t, portreserve_var_run_t) +manage_sock_files_pattern(portreserve_t, portreserve_var_run_t, portreserve_var_run_t) +files_pid_filetrans(portreserve_t, portreserve_var_run_t, { file sock_file dir }) + +corecmd_getattr_bin_files(portreserve_t) + +corenet_all_recvfrom_unlabeled(portreserve_t) +corenet_all_recvfrom_netlabel(portreserve_t) +corenet_tcp_sendrecv_generic_if(portreserve_t) +corenet_udp_sendrecv_generic_if(portreserve_t) +corenet_tcp_sendrecv_generic_node(portreserve_t) +corenet_udp_sendrecv_generic_node(portreserve_t) +corenet_tcp_sendrecv_all_ports(portreserve_t) +corenet_udp_sendrecv_all_ports(portreserve_t) +corenet_tcp_bind_generic_node(portreserve_t) +corenet_udp_bind_generic_node(portreserve_t) + +corenet_sendrecv_all_server_packets(portreserve_t) +corenet_tcp_bind_all_ports(portreserve_t) +corenet_udp_bind_all_ports(portreserve_t) + +files_read_etc_files(portreserve_t) + +userdom_dontaudit_search_user_home_content(portreserve_t) |