gentoo-overlay/sec-policy/selinux-knot/files/knot.if

109 lines
2.3 KiB
Plaintext
Raw Normal View History

2019-07-10 11:05:57 +03:00
## <summary>high-performance authoritative-only DNS server.</summary>
2019-05-08 14:53:59 +03:00
########################################
## <summary>
2019-07-10 11:05:57 +03:00
## Execute knotc in the knotc domain.
2019-05-08 14:53:59 +03:00
## </summary>
## <param name="domain">
## <summary>
2019-07-10 11:05:57 +03:00
## Domain allowed to transition.
2019-05-08 14:53:59 +03:00
## </summary>
## </param>
#
2019-07-10 11:05:57 +03:00
interface(`knot_domtrans_client',`
2019-05-08 14:53:59 +03:00
gen_require(`
2019-07-10 11:05:57 +03:00
type knotc_t, knotc_exec_t;
2019-05-08 14:53:59 +03:00
')
corecmd_search_bin($1)
2019-07-10 11:05:57 +03:00
domtrans_pattern($1, knotc_exec_t, knotc_t)
2019-05-08 14:53:59 +03:00
')
########################################
## <summary>
2019-07-10 11:05:57 +03:00
## Execute knotc in the knotc domain, and
## allow the specified role the knotc domain.
2019-05-08 14:53:59 +03:00
## </summary>
## <param name="domain">
## <summary>
2019-07-10 11:05:57 +03:00
## Domain allowed to transition.
2019-05-08 14:53:59 +03:00
## </summary>
## </param>
2019-07-10 11:05:57 +03:00
## <param name="role">
2019-05-08 14:53:59 +03:00
## <summary>
2019-07-10 11:05:57 +03:00
## Role allowed access.
2019-05-08 14:53:59 +03:00
## </summary>
## </param>
2019-07-10 11:05:57 +03:00
## <rolecap/>
2019-05-08 14:53:59 +03:00
#
2019-07-10 11:05:57 +03:00
interface(`knot_run_client',`
gen_require(`
2019-07-10 11:21:54 +03:00
attribute_role knot_roles;
2019-07-10 11:05:57 +03:00
')
2019-05-08 14:53:59 +03:00
2019-07-10 11:05:57 +03:00
knot_domtrans_client($1)
roleattribute $2 knot_roles;
2019-05-08 14:53:59 +03:00
')
########################################
## <summary>
2019-07-10 11:05:57 +03:00
## Read knot config files.
2019-05-08 14:53:59 +03:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
2019-07-10 11:05:57 +03:00
interface(`knot_read_config_file',`
gen_require(`
type knot_conf_t;
')
2019-05-08 14:53:59 +03:00
2019-07-10 11:05:57 +03:00
read_files_pattern($1, knot_conf_t, knot_conf_t)
files_search_etc($1)
2019-05-08 14:53:59 +03:00
')
########################################
## <summary>
2019-07-10 11:05:57 +03:00
## All of the rules required to
## administrate an knot environment.
2019-05-08 14:53:59 +03:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
2019-07-10 11:05:57 +03:00
## <param name="role">
2019-05-08 14:53:59 +03:00
## <summary>
2019-07-10 11:05:57 +03:00
## Role allowed access.
2019-05-08 14:53:59 +03:00
## </summary>
## </param>
2019-07-10 11:05:57 +03:00
## <rolecap/>
2019-05-08 14:53:59 +03:00
#
2019-07-10 11:05:57 +03:00
interface(`knot_admin',`
gen_require(`
type knotc_t, knotd_t, knot_conf_t, knot_initrc_exec_t;
type knot_runtime_t, knot_tmp_t, knot_var_lib_t;
')
2019-05-08 14:53:59 +03:00
2019-07-10 11:21:54 +03:00
allow $1 knotc_t:process signal_perms;
2019-07-10 11:05:57 +03:00
allow $1 knotd_t:process { ptrace signal_perms };
2019-07-10 11:21:54 +03:00
ps_process_pattern($1, knotc_t)
2019-07-10 11:05:57 +03:00
ps_process_pattern($1, knotd_t)
2019-05-08 14:53:59 +03:00
2019-07-10 11:05:57 +03:00
init_startstop_service($1, $2, knotd_t, knot_initrc_exec_t)
2019-05-08 14:53:59 +03:00
2019-07-10 11:05:57 +03:00
files_search_etc($1)
admin_pattern($1, knot_conf_t)
2019-05-08 14:53:59 +03:00
2019-07-10 11:05:57 +03:00
files_search_pids($1)
admin_pattern($1, knot_runtime_t)
2019-05-08 14:53:59 +03:00
2019-07-10 11:05:57 +03:00
files_search_tmp($1)
admin_pattern($1, knot_tmp_t)
2019-05-08 14:53:59 +03:00
2019-07-10 11:05:57 +03:00
files_search_var_lib($1)
admin_pattern($1, knot_var_lib_t)
2019-05-08 14:53:59 +03:00
')