Attachment 890476 Details for Bug 1091647 – local1

local1

local1.te (text/plain), 1.95 KB, created by Bruno Wolff III on 2014-04-28 13:31:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bruno Wolff III

Created: 2014-04-28 13:31:22 UTC

Size: 1.95 KB

patch

obsolete

>module local1 1.0;
>
>require {
>	type qmail_local_t;
>	type qmail_send_t;
>	type qmail_start_t;
>	type qmail_spool_t;
>	type initrc_t;
>	type urandom_device_t;
>	type tmp_t;
>	type qmail_clean_t;
>	type httpd_user_content_t;
>	type httpd_sys_content_t;
>	type var_t;
>	type setroubleshootd_t;
>	type qmail_remote_t;
>	type qmail_lspawn_t;
>	class fifo_file { read open };
>	class process { sigchld setpgid };
>	class chr_file { read open };
>	class capability { setuid net_admin };
>	class file { rename execute read lock create getattr execute_no_trans write ioctl unlink open };
>	class lnk_file read;
>	class dir { write search read remove_name open add_name };
>}
>
>#============= qmail_clean_t ==============
>allow qmail_clean_t qmail_spool_t:dir read;
>
>#============= qmail_local_t ==============
>allow qmail_local_t httpd_sys_content_t:dir { write search read remove_name open add_name };
>allow qmail_local_t httpd_sys_content_t:file { rename execute read lock create ioctl execute_no_trans write getattr unlink open };
>allow qmail_local_t httpd_user_content_t:lnk_file read;
>allow qmail_local_t self:capability setuid;
>allow qmail_local_t self:process setpgid;
>allow qmail_local_t tmp_t:file { write create unlink open };
>
>#!!!! This avc can be allowed using one of the these booleans:
>#     authlogin_nsswitch_use_ldap, global_ssp
>allow qmail_local_t urandom_device_t:chr_file { read open };
>
>#============= qmail_lspawn_t ==============
>allow qmail_lspawn_t var_t:file { read open };
>
>#============= qmail_remote_t ==============
>allow qmail_remote_t qmail_spool_t:dir read;
>
>#============= qmail_send_t ==============
>allow qmail_send_t initrc_t:process sigchld;
>
>#============= qmail_start_t ==============
>allow qmail_start_t qmail_spool_t:dir { read write open add_name };
>allow qmail_start_t qmail_spool_t:fifo_file { read open };
>allow qmail_start_t qmail_spool_t:file { read write getattr open create };
>
>#============= setroubleshootd_t ==============
>allow setroubleshootd_t self:capability net_admin;

Actions: View

Attachments on bug 1091647: 890473 | 890474 | 890475 | 890476 | 890490 | 890491 | 890492 | 890493 | 890495 | 890496 | 890498 | 890499 | 890500 | 890502