Blame cjdns.selinux.patch

2f8dfd
diff -up ./contrib/selinux/cjdns.te.selinux ./contrib/selinux/cjdns.te
db9c92
--- ./contrib/selinux/cjdns.te.selinux	2019-05-02 04:02:32.000000000 -0400
db9c92
+++ ./contrib/selinux/cjdns.te	2019-08-15 22:23:18.807845457 -0400
db9c92
@@ -7,8 +7,9 @@ require {
2f8dfd
 	type port_t;
2f8dfd
 	type unreserved_port_t;
2f8dfd
 	type tmp_t;
2f8dfd
-	type kernel_t;
2f8dfd
 	type passwd_file_t;
2f8dfd
+	type net_conf_t;
db9c92
+	type sssd_var_lib_t;
2f8dfd
 }
2f8dfd
 
2f8dfd
 type cjdns_t;
db9c92
@@ -17,24 +18,26 @@ init_daemon_domain(cjdns_t,cjdns_exec_t)
07af32
 
2f8dfd
 #============= cjdns_t ==============
2f8dfd
 # Let master process run further restricted subprocess
07af32
-allow cjdns_t cjdns_exec_t:file { execute_no_trans execmod };
2f8dfd
-allow cjdns_t self:capability { net_admin net_raw setuid setgid sys_chroot sys_module };
e80e13
+allow cjdns_t cjdns_exec_t:file { execute_no_trans execmod map };
2f8dfd
+allow cjdns_t self:capability { net_admin net_raw setuid setgid sys_chroot };
2f8dfd
 allow cjdns_t self:process { signal getcap setrlimit setcap };
2f8dfd
-allow cjdns_t kernel_t:system module_request;
2f8dfd
 # translate username to uid
2f8dfd
 allow cjdns_t passwd_file_t:file { read getattr open };
db9c92
+# should not need sssd to lookup uid for local uid
db9c92
+dontaudit cjdns_t sssd_var_lib_t:dir search;
2f8dfd
 
2f8dfd
+# translate host names
2f8dfd
+allow cjdns_t net_conf_t:file { read getattr open };
2f8dfd
 # allow network access
2f8dfd
 allow cjdns_t node_t:udp_socket node_bind;
2f8dfd
 allow cjdns_t port_t:udp_socket name_bind;
355953
 allow cjdns_t unreserved_port_t:udp_socket name_bind;
355953
-allow cjdns_t self:netlink_route_socket { bind create getattr nlmsg_read read write };
355953
+allow cjdns_t self:netlink_route_socket { bind create getattr nlmsg_read read write nlmsg_write };
2f8dfd
 allow cjdns_t self:packet_socket { bind create ioctl read write };
2f8dfd
 allow cjdns_t self:tun_socket create;
2f8dfd
-allow cjdns_t self:udp_socket { create setopt bind ioctl getattr read write };
2f8dfd
+allow cjdns_t self:udp_socket { create setopt bind ioctl getattr read write connect };
2f8dfd
 allow cjdns_t tun_tap_device_t:chr_file { read write open ioctl };
2f8dfd
 
2f8dfd
-
2f8dfd
 # management API
2f8dfd
 allow cjdns_t self:unix_stream_socket connectto;
2f8dfd
 allow cjdns_t tmp_t:sock_file { write create unlink };