113 lines
2.3 KiB
Plaintext
113 lines
2.3 KiB
Plaintext
|
policy_module(lego, 1.0.3)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
## <desc>
|
||
|
|
## <p>
|
||
|
|
## Determine whether lego can use
|
||
|
|
## user home directories.
|
||
|
|
## </p>
|
||
|
|
## </desc>
|
||
|
|
gen_tunable(lego_use_homedirs, false)
|
||
|
|
|
||
|
|
attribute_role lego_roles;
|
||
|
|
roleattribute system_r lego_roles;
|
||
|
|
|
||
|
|
type lego_t;
|
||
|
|
type lego_exec_t;
|
||
|
|
application_domain(lego_t, lego_exec_t)
|
||
|
|
role lego_roles types lego_t;
|
||
|
|
|
||
|
|
type lego_data_t;
|
||
|
|
files_type(lego_data_t)
|
||
|
|
ubac_constrained(lego_data_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# lego local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow lego_t self:capability { dac_override dac_read_search };
|
||
|
|
allow lego_t self:process getsched;
|
||
|
|
sysnet_read_config(lego_t)
|
||
|
|
files_search_var_lib(lego_t)
|
||
|
|
|
||
|
|
userdom_use_user_ptys(lego_t)
|
||
|
|
domain_use_interactive_fds(lego_t)
|
||
|
|
|
||
|
|
corenet_tcp_connect_http_port(lego_t)
|
||
|
|
allow lego_t self:tcp_socket create_socket_perms;
|
||
|
|
allow lego_t self:udp_socket create_socket_perms;
|
||
|
|
allow lego_t self:netlink_route_socket r_netlink_socket_perms;
|
||
|
|
|
||
|
|
manage_dirs_pattern(lego_t, lego_data_t, lego_data_t)
|
||
|
|
manage_files_pattern(lego_t, lego_data_t, lego_data_t)
|
||
|
|
manage_lnk_files_pattern(lego_t, lego_data_t, lego_data_t)
|
||
|
|
files_etc_filetrans(lego_t, lego_data_t, { dir file lnk_file })
|
||
|
|
|
||
|
|
miscfiles_read_generic_certs(lego_t)
|
||
|
|
miscfiles_read_localization(lego_t)
|
||
|
|
|
||
|
|
tunable_policy(`lego_use_homedirs',`
|
||
|
|
userdom_manage_user_home_content_dirs(lego_t)
|
||
|
|
userdom_manage_user_home_content_files(lego_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gen_require(`
|
||
|
|
type sysadm_t;
|
||
|
|
role sysadm_r;
|
||
|
|
')
|
||
|
|
lego_role(sysadm_r, sysadm_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gen_require(`
|
||
|
|
role user_r;
|
||
|
|
type user_t;
|
||
|
|
')
|
||
|
|
lego_role(user_r, user_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gen_require(`
|
||
|
|
role staff_r;
|
||
|
|
type staff_t;
|
||
|
|
')
|
||
|
|
lego_role(staff_r, staff_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gen_require(`
|
||
|
|
type nginx_t;
|
||
|
|
')
|
||
|
|
lego_read_data_files(nginx_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gen_require(`
|
||
|
|
type dovecot_t;
|
||
|
|
')
|
||
|
|
lego_read_data_files(dovecot_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gen_require(`
|
||
|
|
type exim_t;
|
||
|
|
')
|
||
|
|
lego_read_data_files(exim_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gen_require(`
|
||
|
|
type system_cronjob_t, system_cronjob_tmp_t;
|
||
|
|
')
|
||
|
|
cron_system_entry(lego_t, lego_exec_t)
|
||
|
|
allow system_cronjob_t lego_data_t:file setattr;
|
||
|
|
allow lego_t system_cronjob_tmp_t:file write;
|
||
|
|
')
|
||
|
|
|