type enforcement

clockspeed.te (text/plain), 1.47 KB, created by petre rodan (RETIRED) on 2003-12-12 01:56:54 UTC

# $Id: clockspeed.te,v 1.11 2003/12/12 09:54:26 peter Exp $
#
# author Petre Rodan <[e-mail]>
#
# the clockspeed infrastructure is taken from the latest gentoo ebuid +
# http://foo42.de/devel/sysutils/clockspeed-conf/
#

type var_lib_clockspeed_t, file_type, sysadmfile;
type clockspeed_port_t, port_type;

daemon_base_domain(clockspeed)
can_network(clockspeed_t)
read_locale(clockspeed_t)

allow clockspeed_t self:capability { sys_time net_bind_service };
allow clockspeed_t self:unix_dgram_socket create_socket_perms;
allow clockspeed_t self:unix_stream_socket create_socket_perms;
allow clockspeed_t clockspeed_port_t:udp_socket name_bind;
allow clockspeed_t domain:packet_socket recvfrom;

file_type_auto_trans(clockspeed_t, var_lib_t, var_lib_clockspeed_t);
allow clockspeed_t var_lib_clockspeed_t:file create_file_perms;
allow clockspeed_t var_lib_clockspeed_t:fifo_file create_file_perms;

# sysadm can play with clockspeed
role sysadm_r types clockspeed_t;
allow sysadm_t clockspeed_exec_t:file { execute execute_no_trans };
domain_auto_trans( sysadm_t, clockspeed_exec_t, clockspeed_t);

# if started by daemontools
ifdef(`daemontools.te', `
domain_auto_trans( svc_run_t, clockspeed_exec_t, clockspeed_t);
allow svc_run_t var_lib_clockspeed_t:dir r_dir_perms;
allow svc_run_t var_lib_clockspeed_t:file r_file_perms;
allow svc_run_t var_lib_clockspeed_t:fifo_file { rw_file_perms setattr };
allow svc_start_t clockspeed_t:process { signal };
svc_ipc_domain(clockspeed_t)
')