type_enforcement

ucspi-tcp.te (text/plain), 1.41 KB, created by petre rodan (RETIRED) on 2003-11-28 23:28:55 UTC

# $Id: ucspi-tcp.te,v 1.2 2003/11/28 14:15:52 peter Exp $
#
# author Petre Rodan <[e-mail]>
#
# get the latest version of this file from
# http://team.rav.ro/peter/policy.tar.gz
#

# _minimal_ selinux policy for ucspi-tcp
# http://cr.yp.to/ucspi-tcp.html
#
#


type utcpserver_exec_t, file_type, exec_type, sysadmfile;
type utcpserver_t, domain;

role system_r types utcpserver_t;

domain_auto_trans(initrc_t, utcpserver_exec_t, utcpserver_t)

ifdef(`svc.te', `
domain_auto_trans( svc_t, utcpserver_exec_t, utcpserver_t)
')

can_network(utcpserver_t)
uses_shlib(utcpserver_t);

#reads /etc/nsswitch.conf and resolv.conf
allow utcpserver_t etc_t:file { getattr read };
allow utcpserver_t resolv_conf_t:file { read };

allow utcpserver_t bin_t:dir { search };

allow utcpserver_t self:capability { net_bind_service setgid setuid };
allow utcpserver_t self:fifo_file { read write };
allow utcpserver_t self:process { fork sigchld };

ifdef(`qmail.te', `
allow utcpserver_t etc_qmail_t:dir { search };
allow utcpserver_t etc_qmail_t:file { getattr read };
allow utcpserver_t qmail_queue_exec_t:file { execute execute_no_trans read };
allow utcpserver_t qmail_smtpd_exec_t:file { execute execute_no_trans read };
allow utcpserver_t qmail_spool_t:dir { add_name remove_name search write };
allow utcpserver_t qmail_spool_t:fifo_file { write };
allow utcpserver_t qmail_spool_t:file { create getattr link read unlink write };
')