policy_module(ircd, 1.11.0) ######################################## # # Declarations # type ircd_t; type ircd_exec_t; init_daemon_domain(ircd_t, ircd_exec_t) type ircd_initrc_exec_t; init_script_file(ircd_initrc_exec_t) type ircd_etc_t; files_config_file(ircd_etc_t) type ircd_log_t; logging_log_file(ircd_log_t) type ircd_var_lib_t; files_type(ircd_var_lib_t) type ircd_var_run_t; files_pid_file(ircd_var_run_t) ######################################## # # Local policy # dontaudit ircd_t self:capability sys_tty_config; allow ircd_t self:process signal_perms; allow ircd_t self:tcp_socket { accept listen }; read_files_pattern(ircd_t, ircd_etc_t, ircd_etc_t) read_lnk_files_pattern(ircd_t, ircd_etc_t, ircd_etc_t) allow ircd_t ircd_log_t:dir setattr_dir_perms; append_files_pattern(ircd_t, ircd_log_t, ircd_log_t) create_files_pattern(ircd_t, ircd_log_t, ircd_log_t) setattr_files_pattern(ircd_t, ircd_log_t, ircd_log_t) logging_log_filetrans(ircd_t, ircd_log_t, file) manage_files_pattern(ircd_t, ircd_var_lib_t, ircd_var_lib_t) manage_files_pattern(ircd_t, ircd_var_run_t, ircd_var_run_t) files_pid_filetrans(ircd_t, ircd_var_run_t, file) kernel_read_system_state(ircd_t) kernel_read_kernel_sysctls(ircd_t) corecmd_exec_bin(ircd_t) corenet_all_recvfrom_unlabeled(ircd_t) corenet_all_recvfrom_netlabel(ircd_t) corenet_tcp_sendrecv_generic_if(ircd_t) corenet_tcp_sendrecv_generic_node(ircd_t) corenet_tcp_bind_generic_node(ircd_t) corenet_sendrecv_ircd_server_packets(ircd_t) corenet_tcp_bind_ircd_port(ircd_t) corenet_tcp_sendrecv_ircd_port(ircd_t) dev_read_sysfs(ircd_t) domain_use_interactive_fds(ircd_t) files_read_etc_runtime_files(ircd_t) fs_getattr_all_fs(ircd_t) fs_search_auto_mountpoints(ircd_t) auth_use_nsswitch(ircd_t) logging_send_syslog_msg(ircd_t) miscfiles_read_localization(ircd_t) userdom_dontaudit_use_unpriv_user_fds(ircd_t) userdom_dontaudit_search_user_home_dirs(ircd_t) optional_policy(` seutil_sigchld_newrole(ircd_t) ') optional_policy(` udev_read_db(ircd_t) ')