2020-05-06 18:35:36 +02:00
|
|
|
policy_module(sau, 0.9.1)
|
2019-04-07 19:20:24 +02:00
|
|
|
|
|
|
|
|
gen_require(`
|
|
|
|
|
type system_cronjob_t;
|
|
|
|
|
type sysadm_t;
|
|
|
|
|
|
|
|
|
|
role sysadm_r;
|
2019-04-07 19:36:12 +02:00
|
|
|
role system_r;
|
2019-04-07 19:20:24 +02:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
type sau_t;
|
|
|
|
|
type sau_exec_t;
|
|
|
|
|
type sau_config_t;
|
|
|
|
|
|
|
|
|
|
domain_type(sau_t)
|
|
|
|
|
domain_entry_file(sau_t, sau_exec_t)
|
|
|
|
|
files_config_file(sau_config_t)
|
|
|
|
|
read_files_pattern(sau_t, etc_t, sau_config_t);
|
2020-04-13 10:22:05 +02:00
|
|
|
read_files_pattern(sau_t, etc_t, etc_t)
|
|
|
|
|
files_read_etc_runtime_files(sau_t);
|
|
|
|
|
search_dirs_pattern(sau_t, etc_t, etc_runtime_t);
|
|
|
|
|
files_manage_generic_tmp_files(sau_t)
|
|
|
|
|
files_manage_generic_tmp_dirs(sau_t)
|
2019-04-07 19:20:24 +02:00
|
|
|
|
|
|
|
|
role sysadm_r types sau_t;
|
|
|
|
|
role system_r types sau_t;
|
|
|
|
|
|
|
|
|
|
domain_auto_transition_pattern(sysadm_t, sau_exec_t, sau_t)
|
|
|
|
|
domain_auto_transition_pattern(system_cronjob_t, sau_exec_t, sau_t)
|
|
|
|
|
|
2020-03-01 08:20:41 +01:00
|
|
|
domain_use_interactive_fds(sau_t)
|
|
|
|
|
userdom_use_user_ptys(sau_t)
|
|
|
|
|
userdom_use_all_users_fds(sau_t)
|
|
|
|
|
|
|
|
|
|
# required for python
|
|
|
|
|
corecmd_mmap_bin_files(sau_t)
|
2020-04-13 10:22:05 +02:00
|
|
|
mmap_exec_files_pattern(sau_t, tmp_t, tmp_t);
|
2020-03-01 08:20:41 +01:00
|
|
|
|
|
|
|
|
|
2020-04-13 10:22:05 +02:00
|
|
|
read_files_pattern(sau_t, usr_t, usr_t)
|
2020-03-01 08:20:41 +01:00
|
|
|
miscfiles_read_localization(sau_t)
|
|
|
|
|
logging_send_syslog_msg(sau_t)
|
|
|
|
|
allow sau_t self:fifo_file { read write };
|
|
|
|
|
corecmd_exec_shell(sau_t)
|
|
|
|
|
corecmd_exec_bin(sau_t)
|
|
|
|
|
|
2020-04-13 10:22:05 +02:00
|
|
|
# list processes
|
|
|
|
|
kernel_read_system_state(sau_t)
|
|
|
|
|
domain_read_all_domains_state(sau_t)
|
|
|
|
|
allow sau_t self:capability sys_ptrace;
|
|
|
|
|
|
|
|
|
|
# I've tried it all; I don't know how to give sau permission to
|
|
|
|
|
# run init-scripts :(
|
2020-04-13 10:31:57 +02:00
|
|
|
init_all_labeled_script_domtrans(sau_t)
|
|
|
|
|
init_domtrans_script(sau_t)
|
|
|
|
|
init_read_utmp(sau_t)
|
|
|
|
|
init_signull_script(sau_t)
|
2020-04-13 10:22:05 +02:00
|
|
|
#init_startstop_all_script_services(sau_t)
|
|
|
|
|
#init_use_script_ptys(sau_t)
|
|
|
|
|
#init_domtrans_labeled_script(sau_t)
|
|
|
|
|
#init_manage_script_service(sau_t)
|
|
|
|
|
#init_read_script_status_files(sau_t)
|
|
|
|
|
#allow sau_t initrc_state_t:lnk_file { getattr read };
|
|
|
|
|
#allow sau_t initrc_state_t:dir { search read };
|
|
|
|
|
#init_admin(sau_t)
|
|
|
|
|
# FIXME: shouldn't have to be unconfined...
|
|
|
|
|
unconfined_domain(sau_t)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# allow during troubleshooting...
|
|
|
|
|
#files_getattr_all_dirs(sau_t)
|
|
|
|
|
#files_getattr_all_files(sau_t)
|
2019-04-07 19:20:24 +02:00
|
|
|
|
|
|
|
|
# Gentoo specific
|
2020-04-13 10:22:05 +02:00
|
|
|
portage_read_config(sau_t)
|
|
|
|
|
portage_read_ebuild(sau_t)
|
|
|
|
|
portage_read_db(sau_t)
|
|
|
|
|
portage_read_cache(sau_t)
|
2019-04-07 19:20:24 +02:00
|
|
|
portage_domtrans(sau_t)
|
|
|
|
|
|
2019-07-08 17:53:44 +02:00
|
|
|
|
