source: selinux/build/afsd.te @ 28

Last change on this file since 28 was 28, checked in by presbrey, 16 years ago
some SELinux module code
File size: 2.0 KB
Line 
1policy_module(afsd,1.0.0)
2
3########################################
4#
5# Declarations
6#
7
8type afsd_t;
9type afsd_exec_t;
10domain_type(afsd_t)
11init_daemon_domain(afsd_t, afsd_exec_t)
12
13# var/lib files
14type afsd_etc_t;
15type afsd_cache_t;
16files_type(afsd_etc_t)
17files_type(afsd_cache_t)
18
19allow afsd_t { afsd_etc_t afsd_cache_t }:dir manage_dir_perms;
20allow afsd_t { afsd_etc_t afsd_cache_t }:file_class_set manage_file_perms;
21#files_var_lib_filetrans(afsd_t,afsd_cache_t, { file dir sock_file })
22
23########################################
24#
25# AFS local policy
26
27files_read_etc_files(afsd_t)
28files_rw_etc_runtime_files(afsd_t)
29libs_use_ld_so(afsd_t)
30libs_use_shared_libs(afsd_t)
31miscfiles_read_localization(afsd_t)
32
33# Init script handling
34init_use_fds(afsd_t)
35init_use_script_ptys(afsd_t)
36domain_use_interactive_fds(afsd_t)
37
38files_mounton_default(afsd_t)
39kernel_read_system_state(afsd_t)
40kernel_write_proc_files(afsd_t)
41fs_mount_nfs(afsd_t)
42fs_remount_nfs(afsd_t)
43fs_unmount_nfs(afsd_t)
44fs_manage_nfs_files(afsd_t)
45fs_manage_nfs_symlinks(afsd_t)
46fs_manage_nfs_named_pipes(afsd_t)
47fs_manage_nfs_named_sockets(afsd_t)
48
49fs_getattr_xattr_fs(afsd_t);
50
51allow afsd_t self:dir mounton;
52allow afsd_t self:process setsched;
53allow afsd_t self:capability { sys_admin sys_nice sys_tty_config};
54
55require {
56        type afs_bos_port_t,afs_fs_port_t,afs_fs_port_t,afs_ka_port_t,afs_pt_port_t,afs_vl_port_t;
57        type netif_t, node_t;
58}
59allow afsd_t { self afs_bos_port_t afs_fs_port_t afs_fs_port_t afs_ka_port_t afs_pt_port_t afs_vl_port_t }:tcp_socket all_tcp_socket_perms;
60allow afsd_t { self afs_bos_port_t afs_fs_port_t afs_fs_port_t afs_ka_port_t afs_pt_port_t afs_vl_port_t }:udp_socket all_udp_socket_perms;
61allow afsd_t netif_t:netif { udp_recv udp_send };
62allow afsd_t node_t:node { udp_recv udp_send };
63
64require {
65        type crond_t, kernel_t, sshd_t, user_t;
66}
67afs_access(afsd_t);
68afs_access(crond_t);
69afs_access(kernel_t);
70afs_access(sshd_t);
71afs_access(user_t);
72
73require {
74        type initrc_t;
75}
76# init.d script sets up cell files:
77allow initrc_t afsd_etc_t:file { setattr write };
78# permit aklog:
79allow user_t proc_t:file write;
Note: See TracBrowser for help on using the repository browser.