type enforcement

snmpd.te (text/plain), 1.33 KB, created by petre rodan (RETIRED) on 2004-07-06 02:28:10 UTC

#DESC SNMPD - Simple Network Management Protocol daemon
#
# Author:  Russell Coker <[e-mail]>
# X-Debian-Packages: snmpd
#

#################################
#
# Rules for the snmpd_t domain.
#
daemon_domain(snmpd)

#temp
allow snmpd_t var_t:dir getattr;

can_network(snmpd_t)

type snmp_port_t, port_type;
allow snmpd_t snmp_port_t:{ udp_socket tcp_socket } name_bind;

type etc_snmpd_t, file_type, sysadmfile;
allow snmpd_t etc_snmpd_t:file { getattr read };

# for the .index file
type snmpd_var_lib_t alias var_lib_snmpd_t, file_type, sysadmfile;
file_type_auto_trans(snmpd_t, { var_lib_t usr_t }, snmpd_var_lib_t, file)
allow snmpd_t snmpd_var_lib_t:dir rw_dir_perms;

# for /usr/share/snmp/mibs
allow snmpd_t usr_t:file { getattr read };

can_udp_send(sysadm_t, snmpd_t)
can_udp_send(snmpd_t, sysadm_t)

allow snmpd_t self:unix_dgram_socket create_socket_perms;
allow snmpd_t self:unix_stream_socket create_socket_perms;
allow snmpd_t etc_t:lnk_file read;
allow snmpd_t { etc_t etc_runtime_t resolv_conf_t }:file { getattr read };
allow snmpd_t random_device_t:chr_file read;
allow snmpd_t self:capability { net_bind_service net_admin };

allow snmpd_t proc_t:dir search;
allow snmpd_t proc_t:file r_file_perms;
allow snmpd_t self:file { getattr read };

allow snmpd_t proc_net_t:dir search;
allow snmpd_t proc_net_t:file r_file_perms;