policy_module(lego, 1.0.3) ######################################## # # Declarations # ## ##

## Determine whether lego can use ## user home directories. ##

##
gen_tunable(lego_use_homedirs, false) attribute_role lego_roles; roleattribute system_r lego_roles; type lego_t; type lego_exec_t; application_domain(lego_t, lego_exec_t) role lego_roles types lego_t; type lego_data_t; files_type(lego_data_t) ubac_constrained(lego_data_t) ######################################## # # lego local policy # allow lego_t self:capability { dac_override dac_read_search }; allow lego_t self:process getsched; sysnet_read_config(lego_t) files_search_var_lib(lego_t) userdom_use_user_ptys(lego_t) domain_use_interactive_fds(lego_t) corenet_tcp_connect_http_port(lego_t) allow lego_t self:tcp_socket create_socket_perms; allow lego_t self:udp_socket create_socket_perms; allow lego_t self:netlink_route_socket r_netlink_socket_perms; manage_dirs_pattern(lego_t, lego_data_t, lego_data_t) manage_files_pattern(lego_t, lego_data_t, lego_data_t) manage_lnk_files_pattern(lego_t, lego_data_t, lego_data_t) files_etc_filetrans(lego_t, lego_data_t, { dir file lnk_file }) miscfiles_read_generic_certs(lego_t) miscfiles_read_localization(lego_t) tunable_policy(`lego_use_homedirs',` userdom_manage_user_home_content_dirs(lego_t) userdom_manage_user_home_content_files(lego_t) ') optional_policy(` gen_require(` type sysadm_t; role sysadm_r; ') lego_role(sysadm_r, sysadm_t) ') optional_policy(` gen_require(` role user_r; type user_t; ') lego_role(user_r, user_t) ') optional_policy(` gen_require(` role staff_r; type staff_t; ') lego_role(staff_r, staff_t) ') optional_policy(` gen_require(` type nginx_t; ') lego_read_data_files(nginx_t) ') optional_policy(` gen_require(` type dovecot_t; ') lego_read_data_files(dovecot_t) ') optional_policy(` gen_require(` type exim_t; ') lego_read_data_files(exim_t) ') optional_policy(` gen_require(` type system_cronjob_t, system_cronjob_tmp_t; ') cron_system_entry(lego_t, lego_exec_t) allow system_cronjob_t lego_data_t:file setattr; allow lego_t system_cronjob_tmp_t:file write; ')