Attachment 304847 Details for Bug 444670 – Updated SELinux Policy

Updated SELinux Policy

podsleuth.te (text/plain), 2.36 KB, created by Nigel Jones on 2008-05-08 10:53:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nigel Jones

Created: 2008-05-08 10:53:11 UTC

Size: 2.36 KB

patch

obsolete

>policy_module(podsleuth,1.0.0)
>
>########################################
>#
># Declarations
>#
>
>type podsleuth_t;
>type podsleuth_exec_t;
>
>type podsleuth_var_run_t;
>files_pid_file(podsleuth_var_run_t)
>manage_dirs_pattern(podsleuth_t,podsleuth_var_run_t,podsleuth_var_run_t)
>manage_files_pattern(podsleuth_t,podsleuth_var_run_t,podsleuth_var_run_t)
>files_pid_filetrans(podsleuth_t,podsleuth_var_run_t, { dir file })
>
>type podsleuth_tmp_t;
>files_tmp_file(podsleuth_tmp_t)
>type podsleuth_tmpfs_t;
>files_tmpfs_file(podsleuth_tmpfs_t)
>
>application_domain(podsleuth_t, podsleuth_exec_t)
>role system_r types podsleuth_t;
>
>########################################
>#
># podsleuth local policy
>#
>allow podsleuth_t self:process { ptrace signal getsched execheap execmem };
>
>## internal communication is often done using fifo and unix sockets.
>allow podsleuth_t self:fifo_file rw_file_perms;
>allow podsleuth_t self:unix_stream_socket create_stream_socket_perms;
>
>allow podsleuth_t self:sem { unix_read destroy };
>allow podsleuth_t self:tcp_socket {read write};
>allow podsleuth_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
>allow podsleuth_t self:sem { write read create unix_write };
>allow podsleuth_t self:tcp_socket { create setopt shutdown connect };
>allow podsleuth_t self:udp_socket { write create connect read getattr };
>allow podsleuth_t podsleuth_tmp_t:dir mounton;
>
>allow hald_t podsleuth_t:process signal;
>
>dev_read_urand(podsleuth_t)
>
>kernel_read_system_state(podsleuth_t)
>
>files_read_etc_files(podsleuth_t)
>
>libs_use_ld_so(podsleuth_t)
>libs_use_shared_libs(podsleuth_t)
>
>miscfiles_read_localization(podsleuth_t)
>
>hal_dbus_chat(podsleuth_t)
>
>optional_policy(`
>	dbus_system_bus_client_template(podsleuth,podsleuth_t)
>')
>
>gen_require(`
>	type hald_t;
>	type mono_exec_t;
>')
>
>podsleuth_domtrans(hald_t)
>can_exec(podsleuth_t, mono_exec_t)
>corecmd_exec_bin(podsleuth_t)
>fs_mount_dos_fs(podsleuth_t)
>fs_unmount_dos_fs(podsleuth_t)
>fs_getattr_dos_fs(podsleuth_t)
>fs_read_dos_files(podsleuth_t)
>fs_search_dos(podsleuth_t)
>
>manage_files_pattern(podsleuth_t,podsleuth_tmp_t,podsleuth_tmp_t)
>files_tmp_filetrans(podsleuth_t,podsleuth_tmp_t,{ file dir })
>manage_dirs_pattern(podsleuth_t,podsleuth_tmp_t,podsleuth_tmp_t)
>fs_getattr_tmpfs(podsleuth_t)
>fs_manage_tmpfs_blk_files(podsleuth_t)
>sysnet_read_config(podsleuth_t)
>corenet_sendrecv_unlabeled_packets(podsleuth_t)
>corenet_tcp_connect_http_port(podsleuth_t)

Actions: View

Attachments on bug 444670: 304202 | 304627 | 304628 | 304639 | 304759 | 304774 | 304776 | 304847 | 305021 | 305238