diff options
Diffstat (limited to 'policy/modules/contrib/ucspitcp.te')
| -rw-r--r-- | policy/modules/contrib/ucspitcp.te | 93 |
1 files changed, 93 insertions, 0 deletions
diff --git a/policy/modules/contrib/ucspitcp.te b/policy/modules/contrib/ucspitcp.te new file mode 100644 index 000000000..a0794bf50 --- /dev/null +++ b/policy/modules/contrib/ucspitcp.te @@ -0,0 +1,93 @@ +policy_module(ucspitcp, 1.3.0) + +######################################## +# +# Declarations +# + +type rblsmtpd_t; +type rblsmtpd_exec_t; +init_system_domain(rblsmtpd_t, rblsmtpd_exec_t) +role system_r types rblsmtpd_t; + +type ucspitcp_t; +type ucspitcp_exec_t; +init_system_domain(ucspitcp_t, ucspitcp_exec_t) +role system_r types ucspitcp_t; + +######################################## +# +# Local policy for rblsmtpd +# + +ucspitcp_service_domain(rblsmtpd_t, rblsmtpd_exec_t) + +corecmd_search_bin(rblsmtpd_t) + +corenet_all_recvfrom_unlabeled(rblsmtpd_t) +corenet_all_recvfrom_netlabel(rblsmtpd_t) +corenet_tcp_sendrecv_generic_if(rblsmtpd_t) +corenet_udp_sendrecv_generic_if(rblsmtpd_t) +corenet_tcp_sendrecv_generic_node(rblsmtpd_t) +corenet_udp_sendrecv_generic_node(rblsmtpd_t) +corenet_tcp_sendrecv_all_ports(rblsmtpd_t) +corenet_udp_sendrecv_all_ports(rblsmtpd_t) +corenet_tcp_bind_generic_node(rblsmtpd_t) +corenet_udp_bind_generic_port(rblsmtpd_t) + +files_read_etc_files(rblsmtpd_t) +files_search_var(rblsmtpd_t) + +optional_policy(` + daemontools_ipc_domain(rblsmtpd_t) +') + +######################################## +# +# Local policy for tcpserver +# + +allow ucspitcp_t self:capability { setgid setuid }; +allow ucspitcp_t self:fifo_file rw_fifo_file_perms; +allow ucspitcp_t self:tcp_socket create_stream_socket_perms; +allow ucspitcp_t self:udp_socket create_socket_perms; + +corecmd_search_bin(ucspitcp_t) + +# base networking: +corenet_all_recvfrom_unlabeled(ucspitcp_t) +corenet_all_recvfrom_netlabel(ucspitcp_t) +corenet_tcp_sendrecv_generic_if(ucspitcp_t) +corenet_udp_sendrecv_generic_if(ucspitcp_t) +corenet_tcp_sendrecv_generic_node(ucspitcp_t) +corenet_udp_sendrecv_generic_node(ucspitcp_t) +corenet_tcp_sendrecv_all_ports(ucspitcp_t) +corenet_udp_sendrecv_all_ports(ucspitcp_t) +corenet_tcp_bind_generic_node(ucspitcp_t) +corenet_udp_bind_generic_node(ucspitcp_t) + +# server ports: +corenet_tcp_bind_ftp_port(ucspitcp_t) +corenet_tcp_bind_ftp_data_port(ucspitcp_t) +corenet_tcp_bind_http_port(ucspitcp_t) +corenet_tcp_bind_smtp_port(ucspitcp_t) +corenet_tcp_bind_dns_port(ucspitcp_t) +corenet_udp_bind_dns_port(ucspitcp_t) +corenet_udp_bind_generic_port(ucspitcp_t) + +# server packets: +corenet_sendrecv_ftp_server_packets(ucspitcp_t) +corenet_sendrecv_http_server_packets(ucspitcp_t) +corenet_sendrecv_smtp_server_packets(ucspitcp_t) +corenet_sendrecv_dns_server_packets(ucspitcp_t) +corenet_sendrecv_generic_server_packets(ucspitcp_t) + +files_search_var(ucspitcp_t) +files_read_etc_files(ucspitcp_t) + +sysnet_read_config(ucspitcp_t) + +optional_policy(` + daemontools_service_domain(ucspitcp_t, ucspitcp_exec_t) + daemontools_read_svc(ucspitcp_t) +') |