Attachment 305021 Details for Bug 444670 – Updated SELinux Policy

Updated SELinux Policy

podsleuth.te (text/plain), 2.30 KB, created by Nigel Jones on 2008-05-10 13:20:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nigel Jones

Created: 2008-05-10 13:20:56 UTC

Size: 2.30 KB

patch

obsolete

>policy_module(podsleuth,1.0.0)
>
>########################################
>#
># Declarations
>#
>
>type podsleuth_t;
>type podsleuth_exec_t;
>type podsleuth_tmp_t;
>
>files_tmp_file(podsleuth_tmp_t)
>
>type podsleuth_cache_t;
>files_type(podsleuth_cache_t)
>
>application_domain(podsleuth_t, podsleuth_exec_t)
>role system_r types podsleuth_t;
>
>########################################
>#
># podsleuth local policy
>#
>allow podsleuth_t self:process { ptrace signal getsched execheap execmem };
>allow podsleuth_t self:fifo_file rw_file_perms;
>allow podsleuth_t self:capability sys_admin;
>allow podsleuth_t self:unix_stream_socket create_stream_socket_perms;
>allow podsleuth_t self:sem { write read create unix_write unix_read destroy associate};
>allow podsleuth_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
>allow podsleuth_t self:tcp_socket { read write create setopt shutdown connect };
>allow podsleuth_t self:udp_socket { write create connect read getattr };
>allow podsleuth_t podsleuth_tmp_t:dir mounton;
>
># Because we ain't merged, kinda gotta do this
>allow hald_t podsleuth_t:process signal;
>
>dev_read_urand(podsleuth_t)
>
>kernel_read_system_state(podsleuth_t)
>
>files_read_etc_files(podsleuth_t)
>
>libs_use_ld_so(podsleuth_t)
>libs_use_shared_libs(podsleuth_t)
>
>miscfiles_read_localization(podsleuth_t)
>
>hal_dbus_chat(podsleuth_t)
>
>optional_policy(`
>        dbus_system_bus_client_template(podsleuth,podsleuth_t)
>')
>
>gen_require(`
>        type hald_t;
>        type mono_exec_t;
>')
>
>podsleuth_domtrans(hald_t)
>can_exec(podsleuth_t, mono_exec_t)
>corecmd_exec_bin(podsleuth_t)
>
>fs_mount_dos_fs(podsleuth_t)
>fs_unmount_dos_fs(podsleuth_t)
>fs_getattr_dos_fs(podsleuth_t)
>fs_read_dos_files(podsleuth_t)
>fs_search_dos(podsleuth_t)
>
>manage_files_pattern(podsleuth_t,podsleuth_tmp_t,podsleuth_tmp_t)
>files_tmp_filetrans(podsleuth_t,podsleuth_tmp_t,{ file dir })
>manage_dirs_pattern(podsleuth_t,podsleuth_tmp_t,podsleuth_tmp_t)
>
>manage_dirs_pattern(podsleuth_t,podsleuth_cache_t,podsleuth_cache_t)
>manage_files_pattern(podsleuth_t,podsleuth_cache_t,podsleuth_cache_t)
>files_var_filetrans(podsleuth_t,podsleuth_cache_t,{ file dir })
>
>corenet_tcp_connect_http_port(podsleuth_t)
># Need to find a better alternative to allow connecting to dns
>corenet_all_recvfrom_unlabeled(podsleuth_t)
>sysnet_read_config(podsleuth_t)
>storage_raw_rw_fixed_disk(podsleuth_t)

Actions: View

Attachments on bug 444670: 304202 | 304627 | 304628 | 304639 | 304759 | 304774 | 304776 | 304847 | 305021 | 305238