diff options
| author |   Chris PeBenito <pebenito@ieee.org> | 2018-06-23 10:38:58 -0400 |
|---|---|---|
| committer |   Jason Zaman <jason@perfinion.com> | 2018-06-24 16:33:24 +0800 |
| commit | 751926c0fbba4bf7105622ee65888b66740847a0 (patch) | |
| tree | 6bbdd39cd5becdddc8e4cbc41332c383874c7972 /policy/modules/services/ucspitcp.te | |
| parent | xdg: move compat interfaces to upstream xdg module (diff) | |
| download | hardened-refpolicy-751926c0fbba4bf7105622ee65888b66740847a0.tar.gz hardened-refpolicy-751926c0fbba4bf7105622ee65888b66740847a0.tar.bz2 hardened-refpolicy-751926c0fbba4bf7105622ee65888b66740847a0.zip | |
Move all files out of the old contrib directory.
Diffstat (limited to 'policy/modules/services/ucspitcp.te')
| -rw-r--r-- | policy/modules/services/ucspitcp.te | 93 |
1 files changed, 93 insertions, 0 deletions
diff --git a/policy/modules/services/ucspitcp.te b/policy/modules/services/ucspitcp.te new file mode 100644 index 00000000..7745b72e --- /dev/null +++ b/policy/modules/services/ucspitcp.te @@ -0,0 +1,93 @@ +policy_module(ucspitcp, 1.4.0) + +######################################## +# +# Declarations +# + +type rblsmtpd_t; +type rblsmtpd_exec_t; +init_system_domain(rblsmtpd_t, rblsmtpd_exec_t) + +type ucspitcp_t; +type ucspitcp_exec_t; +init_system_domain(ucspitcp_t, ucspitcp_exec_t) + +######################################## +# +# Smtpd local policy +# + +ucspitcp_service_domain(rblsmtpd_t, rblsmtpd_exec_t) + +corecmd_search_bin(rblsmtpd_t) + +corenet_all_recvfrom_unlabeled(rblsmtpd_t) +corenet_all_recvfrom_netlabel(rblsmtpd_t) +corenet_tcp_sendrecv_generic_if(rblsmtpd_t) +corenet_udp_sendrecv_generic_if(rblsmtpd_t) +corenet_tcp_sendrecv_generic_node(rblsmtpd_t) +corenet_udp_sendrecv_generic_node(rblsmtpd_t) +corenet_tcp_sendrecv_all_ports(rblsmtpd_t) +corenet_udp_sendrecv_all_ports(rblsmtpd_t) +corenet_tcp_bind_generic_node(rblsmtpd_t) +corenet_udp_bind_generic_port(rblsmtpd_t) + +files_read_etc_files(rblsmtpd_t) +files_search_var(rblsmtpd_t) + +optional_policy(` + daemontools_ipc_domain(rblsmtpd_t) +') + +######################################## +# +# Tcp local policy +# + +allow ucspitcp_t self:capability { setgid setuid }; +allow ucspitcp_t self:fifo_file rw_fifo_file_perms; +allow ucspitcp_t self:tcp_socket create_stream_socket_perms; +allow ucspitcp_t self:udp_socket create_socket_perms; + +corecmd_search_bin(ucspitcp_t) + +corenet_all_recvfrom_unlabeled(ucspitcp_t) +corenet_all_recvfrom_netlabel(ucspitcp_t) +corenet_tcp_sendrecv_generic_if(ucspitcp_t) +corenet_udp_sendrecv_generic_if(ucspitcp_t) +corenet_tcp_sendrecv_generic_node(ucspitcp_t) +corenet_udp_sendrecv_generic_node(ucspitcp_t) +corenet_tcp_sendrecv_all_ports(ucspitcp_t) +corenet_udp_sendrecv_all_ports(ucspitcp_t) +corenet_tcp_bind_generic_node(ucspitcp_t) +corenet_udp_bind_generic_node(ucspitcp_t) + +corenet_sendrecv_ftp_server_packets(ucspitcp_t) +corenet_tcp_bind_ftp_port(ucspitcp_t) + +corenet_sendrecv_ftp_data_server_packets(ucspitcp_t) +corenet_tcp_bind_ftp_data_port(ucspitcp_t) + +corenet_sendrecv_http_server_packets(ucspitcp_t) +corenet_tcp_bind_http_port(ucspitcp_t) + +corenet_sendrecv_smtp_server_packets(ucspitcp_t) +corenet_tcp_bind_smtp_port(ucspitcp_t) + +corenet_sendrecv_dns_server_packets(ucspitcp_t) +corenet_tcp_bind_dns_port(ucspitcp_t) +corenet_udp_bind_dns_port(ucspitcp_t) + +corenet_sendrecv_generic_server_packets(ucspitcp_t) +corenet_udp_bind_generic_port(ucspitcp_t) + +files_read_etc_files(ucspitcp_t) +files_search_var(ucspitcp_t) + +sysnet_read_config(ucspitcp_t) + +optional_policy(` + daemontools_service_domain(ucspitcp_t, ucspitcp_exec_t) + daemontools_read_svc(ucspitcp_t) +') |