Chris PeBenito 17de1b7
Chris PeBenito 9570b28
policy_module(rhgb, 1.9.0)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
########################################
Chris PeBenito 17de1b7
#
Chris PeBenito 17de1b7
# Declarations
Chris PeBenito 17de1b7
#
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
type rhgb_t;
Chris PeBenito 17de1b7
type rhgb_exec_t;
Chris PeBenito 0bfccda
init_daemon_domain(rhgb_t, rhgb_exec_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
type rhgb_tmpfs_t;
Chris PeBenito 17de1b7
files_tmpfs_file(rhgb_tmpfs_t)
Chris PeBenito 17de1b7
Chris PeBenito d9845ae
type rhgb_devpts_t;
Chris PeBenito d9845ae
term_pty(rhgb_devpts_t)
Chris PeBenito 75beb95
Chris PeBenito 17de1b7
########################################
Chris PeBenito 17de1b7
#
Chris PeBenito 17de1b7
# Local policy
Chris PeBenito 17de1b7
#
Chris PeBenito 17de1b7
Chris PeBenito 75beb95
allow rhgb_t self:capability { fsetid setgid setuid sys_admin sys_tty_config };
Chris PeBenito 17de1b7
dontaudit rhgb_t self:capability sys_tty_config;
Chris PeBenito d9845ae
allow rhgb_t self:process { setpgid signal_perms };
Chris PeBenito 17de1b7
allow rhgb_t self:shm create_shm_perms;
Chris PeBenito 17de1b7
allow rhgb_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito c0868a7
allow rhgb_t self:fifo_file rw_fifo_file_perms;
Chris PeBenito 17de1b7
allow rhgb_t self:tcp_socket create_socket_perms;
Chris PeBenito 17de1b7
allow rhgb_t self:udp_socket create_socket_perms;
Chris PeBenito 75beb95
allow rhgb_t self:netlink_route_socket r_netlink_socket_perms;
Chris PeBenito 17de1b7
Chris PeBenito 350b6ab
allow rhgb_t rhgb_devpts_t:chr_file { rw_chr_file_perms setattr };
Chris PeBenito 3f67f72
term_create_pty(rhgb_t, rhgb_devpts_t)
Chris PeBenito 350b6ab
Chris PeBenito 0bfccda
manage_dirs_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
Chris PeBenito 0bfccda
manage_files_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
Chris PeBenito 0bfccda
manage_lnk_files_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
Chris PeBenito 0bfccda
manage_fifo_files_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
Chris PeBenito 0bfccda
manage_sock_files_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t)
Chris PeBenito 0bfccda
fs_tmpfs_filetrans(rhgb_t, rhgb_tmpfs_t, { dir file lnk_file sock_file fifo_file })
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
kernel_read_kernel_sysctls(rhgb_t)
Chris PeBenito 17de1b7
kernel_read_system_state(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
corecmd_exec_bin(rhgb_t)
Chris PeBenito 75beb95
corecmd_exec_shell(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 1900668
corenet_all_recvfrom_unlabeled(rhgb_t)
Chris PeBenito 1900668
corenet_all_recvfrom_netlabel(rhgb_t)
Chris PeBenito 17de1b7
corenet_tcp_sendrecv_generic_if(rhgb_t)
Chris PeBenito 17de1b7
corenet_udp_sendrecv_generic_if(rhgb_t)
Chris PeBenito c126214
corenet_tcp_sendrecv_generic_node(rhgb_t)
Chris PeBenito c126214
corenet_udp_sendrecv_generic_node(rhgb_t)
Chris PeBenito 17de1b7
corenet_tcp_sendrecv_all_ports(rhgb_t)
Chris PeBenito 17de1b7
corenet_udp_sendrecv_all_ports(rhgb_t)
Chris PeBenito 17de1b7
corenet_tcp_connect_all_ports(rhgb_t)
Chris PeBenito 17de1b7
corenet_sendrecv_all_client_packets(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
dev_read_sysfs(rhgb_t)
Chris PeBenito 226c069
dev_read_urand(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
domain_use_interactive_fds(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
files_read_etc_files(rhgb_t)
Chris PeBenito 75beb95
files_read_var_files(rhgb_t)
Chris PeBenito 17de1b7
files_read_etc_runtime_files(rhgb_t)
Chris PeBenito 17de1b7
files_search_tmp(rhgb_t)
Chris PeBenito 17de1b7
files_read_usr_files(rhgb_t)
Chris PeBenito 17de1b7
files_mounton_mnt(rhgb_t)
Chris PeBenito 226c069
files_dontaudit_rw_root_dir(rhgb_t)
Chris PeBenito 17de1b7
files_dontaudit_read_default_files(rhgb_t)
Chris PeBenito 17de1b7
files_dontaudit_search_pids(rhgb_t)
Chris PeBenito 17de1b7
# for nscd
Chris PeBenito 17de1b7
files_dontaudit_search_var(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
fs_search_auto_mountpoints(rhgb_t)
Chris PeBenito 17de1b7
fs_mount_ramfs(rhgb_t)
Chris PeBenito 17de1b7
fs_unmount_ramfs(rhgb_t)
Chris PeBenito 75beb95
fs_getattr_tmpfs(rhgb_t)
Chris PeBenito 17de1b7
# for ramfs file systems
Chris PeBenito 75beb95
fs_manage_ramfs_dirs(rhgb_t)
Chris PeBenito 17de1b7
fs_manage_ramfs_files(rhgb_t)
Chris PeBenito 17de1b7
fs_manage_ramfs_pipes(rhgb_t)
Chris PeBenito 17de1b7
fs_manage_ramfs_sockets(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito d9845ae
selinux_dontaudit_read_fs(rhgb_t)
Chris PeBenito d9845ae
Chris PeBenito 17de1b7
term_use_unallocated_ttys(rhgb_t)
Chris PeBenito 75beb95
term_use_ptmx(rhgb_t)
Chris PeBenito 75beb95
term_getattr_pty_fs(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
init_write_initctl(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
# for localization
Chris PeBenito 17de1b7
libs_read_lib_files(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
logging_send_syslog_msg(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
miscfiles_read_localization(rhgb_t)
Chris PeBenito 17de1b7
miscfiles_read_fonts(rhgb_t)
Chris PeBenito 226c069
miscfiles_dontaudit_write_fonts(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito d9845ae
seutil_search_default_contexts(rhgb_t)
Chris PeBenito d9845ae
seutil_read_config(rhgb_t)
Chris PeBenito d9845ae
Chris PeBenito 17de1b7
sysnet_read_config(rhgb_t)
Chris PeBenito 75beb95
sysnet_domtrans_ifconfig(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
userdom_dontaudit_use_unpriv_user_fds(rhgb_t)
Chris PeBenito 296273a
userdom_dontaudit_search_user_home_content(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 296273a
xserver_read_tmp_files(rhgb_t)
Chris PeBenito 296273a
xserver_kill(rhgb_t)
Chris PeBenito 17de1b7
# for running setxkbmap
Chris PeBenito 17de1b7
xserver_read_xkb_libs(rhgb_t)
Chris PeBenito 296273a
xserver_domtrans(rhgb_t)
Chris PeBenito 296273a
xserver_signal(rhgb_t)
Chris PeBenito 350b6ab
xserver_read_xdm_tmp_files(rhgb_t)
Chris PeBenito 296273a
xserver_stream_connect(rhgb_t)
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
optional_policy(`
Chris PeBenito d9845ae
	consoletype_exec(rhgb_t)
Chris PeBenito d9845ae
')
Chris PeBenito d9845ae
Chris PeBenito d9845ae
optional_policy(`
Chris PeBenito 17de1b7
	nis_use_ypbind(rhgb_t)
Chris PeBenito 17de1b7
')
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
optional_policy(`
Chris PeBenito 17de1b7
	seutil_sigchld_newrole(rhgb_t)
Chris PeBenito 17de1b7
')
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
optional_policy(`
Chris PeBenito 17de1b7
	udev_read_db(rhgb_t)
Chris PeBenito 17de1b7
')
Chris PeBenito 17de1b7
Chris PeBenito 17de1b7
ifdef(`TODO',`
Chris PeBenito 75beb95
	#this seems a bit much
Chris PeBenito 17de1b7
	allow domain rhgb_devpts_t:chr_file { read write };
Chris PeBenito 17de1b7
	allow initrc_t rhgb_gph_t:fd use;
Chris PeBenito 17de1b7
')