Attachment 890491 Details for Bug 1091647 – local2

local2

local2.te (text/plain), 2.90 KB, created by Bruno Wolff III on 2014-04-28 13:37:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bruno Wolff III

Created: 2014-04-28 13:37:48 UTC

Size: 2.90 KB

patch

obsolete

>
>module local2 1.0;
>
>require {
>	type user_home_t;
>	type initrc_t;
>	type systemd_passwd_agent_t;
>	type setroubleshootd_t;
>	type systemd_tmpfiles_t;
>	type qmail_queue_t;
>	type httpd_user_content_t;
>	type qmail_remote_t;
>	type logwatch_t;
>	type httpd_sys_content_t;
>	type qmail_lspawn_t;
>	type qmail_local_t;
>	type qmail_send_t;
>	type qmail_start_t;
>	type qmail_inject_t;
>	type qmail_spool_t;
>	type qmail_clean_t;
>	type ldconfig_exec_t;
>	type urandom_device_t;
>	type tmp_t;
>	type qmail_alias_home_t;
>	type var_t;
>	type httpd_t;
>	class fifo_file { read open };
>	class process { sigchld setpgid };
>	class chr_file { read open };
>	class capability { setuid dac_read_search net_admin dac_override };
>	class file { rename execute read lock create getattr execute_no_trans write ioctl unlink open append };
>	class lnk_file read;
>	class dir { search read write getattr remove_name open add_name };
>}
>
>#============= httpd_t ==============
>allow httpd_t qmail_alias_home_t:dir search;
>
>#============= logwatch_t ==============
>allow logwatch_t ldconfig_exec_t:file { read execute };
>allow logwatch_t self:capability net_admin;
>
>#============= qmail_clean_t ==============
>allow qmail_clean_t qmail_spool_t:dir read;
>
>#============= qmail_inject_t ==============
>allow qmail_inject_t self:capability { dac_read_search dac_override };
>
>#============= qmail_local_t ==============
>allow qmail_local_t httpd_sys_content_t:dir { write search read remove_name open getattr add_name };
>allow qmail_local_t httpd_sys_content_t:file { rename execute read lock create ioctl execute_no_trans write getattr unlink open };
>allow qmail_local_t httpd_user_content_t:lnk_file read;
>allow qmail_local_t self:capability setuid;
>allow qmail_local_t self:process setpgid;
>allow qmail_local_t tmp_t:file { write create unlink open };
>
>#!!!! This avc can be allowed using one of the these booleans:
>#     authlogin_nsswitch_use_ldap, global_ssp
>allow qmail_local_t urandom_device_t:chr_file { read open };
>
>#============= qmail_lspawn_t ==============
>allow qmail_lspawn_t var_t:file { read open };
>
>#============= qmail_queue_t ==============
>allow qmail_queue_t user_home_t:file { write append };
>
>#============= qmail_remote_t ==============
>allow qmail_remote_t qmail_spool_t:dir read;
>
>#============= qmail_send_t ==============
>allow qmail_send_t initrc_t:process sigchld;
>
>#============= qmail_start_t ==============
>allow qmail_start_t qmail_spool_t:dir { read write search open add_name };
>allow qmail_start_t qmail_spool_t:fifo_file { read open };
>allow qmail_start_t qmail_spool_t:file { read write getattr open create };
>
>#============= setroubleshootd_t ==============
>
>#!!!! This avc has a dontaudit rule in the current policy
>allow setroubleshootd_t self:capability net_admin;
>
>#============= systemd_passwd_agent_t ==============
>allow systemd_passwd_agent_t self:capability net_admin;
>
>#============= systemd_tmpfiles_t ==============
>allow systemd_tmpfiles_t self:capability net_admin;

Actions: View

Attachments on bug 1091647: 890473 | 890474 | 890475 | 890476 | 890490 | 890491 | 890492 | 890493 | 890495 | 890496 | 890498 | 890499 | 890500 | 890502