diff options
Diffstat (limited to 'policy/modules/services/systemtap.te')
| -rw-r--r-- | policy/modules/services/systemtap.te | 101 |
1 files changed, 101 insertions, 0 deletions
diff --git a/policy/modules/services/systemtap.te b/policy/modules/services/systemtap.te new file mode 100644 index 00000000..c0ddb637 --- /dev/null +++ b/policy/modules/services/systemtap.te @@ -0,0 +1,101 @@ +policy_module(systemtap, 1.4.0) + +######################################## +# +# Declarations +# + +type stapserver_t; +type stapserver_exec_t; +init_daemon_domain(stapserver_t, stapserver_exec_t) + +type stapserver_initrc_exec_t; +init_script_file(stapserver_initrc_exec_t) + +type stapserver_conf_t; +files_config_file(stapserver_conf_t) + +type stapserver_var_lib_t; +files_type(stapserver_var_lib_t) + +type stapserver_log_t; +logging_log_file(stapserver_log_t) + +type stapserver_var_run_t; +files_pid_file(stapserver_var_run_t) + +######################################## +# +# Local policy +# + +allow stapserver_t self:capability { dac_override kill setgid setuid }; +allow stapserver_t self:process { setrlimit setsched signal }; +allow stapserver_t self:fifo_file rw_fifo_file_perms; +allow stapserver_t self:key write; +allow stapserver_t self:unix_stream_socket { accept listen }; +allow stapserver_t self:tcp_socket create_stream_socket_perms; + +allow stapserver_t stapserver_conf_t:file read_file_perms; + +manage_dirs_pattern(stapserver_t, stapserver_var_lib_t, stapserver_var_lib_t) +manage_files_pattern(stapserver_t, stapserver_var_lib_t, stapserver_var_lib_t) +files_var_lib_filetrans(stapserver_t, stapserver_var_lib_t, dir) + +manage_dirs_pattern(stapserver_t, stapserver_log_t, stapserver_log_t) +append_files_pattern(stapserver_t, stapserver_log_t, stapserver_log_t) +create_files_pattern(stapserver_t, stapserver_log_t, stapserver_log_t) +setattr_files_pattern(stapserver_t, stapserver_log_t, stapserver_log_t) +logging_log_filetrans(stapserver_t, stapserver_log_t, dir ) + +manage_dirs_pattern(stapserver_t, stapserver_var_run_t, stapserver_var_run_t) +manage_files_pattern(stapserver_t, stapserver_var_run_t, stapserver_var_run_t) +files_pid_filetrans(stapserver_t, stapserver_var_run_t, dir ) + +kernel_read_kernel_sysctls(stapserver_t) +kernel_read_system_state(stapserver_t) + +corecmd_exec_bin(stapserver_t) +corecmd_exec_shell(stapserver_t) + +domain_read_all_domains_state(stapserver_t) + +dev_read_rand(stapserver_t) +dev_read_sysfs(stapserver_t) +dev_read_urand(stapserver_t) + +files_list_tmp(stapserver_t) +files_read_usr_files(stapserver_t) +files_search_kernel_modules(stapserver_t) + +auth_use_nsswitch(stapserver_t) + +init_read_utmp(stapserver_t) + +logging_send_audit_msgs(stapserver_t) +logging_send_syslog_msg(stapserver_t) + +miscfiles_read_localization(stapserver_t) +miscfiles_read_hwdata(stapserver_t) + +userdom_use_user_terminals(stapserver_t) + +optional_policy(` + consoletype_exec(stapserver_t) +') + +optional_policy(` + dbus_system_bus_client(stapserver_t) +') + +optional_policy(` + hostname_exec(stapserver_t) +') + +optional_policy(` + plymouthd_exec_plymouth(stapserver_t) +') + +optional_policy(` + rpm_exec(stapserver_t) +') |