generated from demus/selinux-rpm-template
80 lines
2.3 KiB
Plaintext
80 lines
2.3 KiB
Plaintext
policy_module(ntfy, 2.14.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type ntfy_t;
|
|
type ntfy_exec_t;
|
|
type ntfy_cache_t;
|
|
inetd_service_domain(ntfy_t, ntfy_exec_t)
|
|
|
|
type ntfy_var_lib_t;
|
|
files_type(ntfy_var_lib_t)
|
|
|
|
########################################
|
|
#
|
|
# ntfy local policy
|
|
#
|
|
|
|
|
|
manage_dirs_pattern(ntfy_t, ntfy_var_lib_t, ntfy_var_lib_t)
|
|
manage_files_pattern(ntfy_t, ntfy_var_lib_t, ntfy_var_lib_t)
|
|
manage_lnk_files_pattern(ntfy_t, ntfy_var_lib_t, ntfy_var_lib_t)
|
|
files_var_lib_filetrans(ntfy_t, ntfy_var_lib_t, { dir file lnk_file })
|
|
|
|
domain_use_interactive_fds(ntfy_t)
|
|
|
|
files_read_etc_files(ntfy_t)
|
|
|
|
miscfiles_read_localization(ntfy_t)
|
|
|
|
require {
|
|
type ntfy_t;
|
|
type httpd_t;
|
|
type http_port_t;
|
|
type unconfined_service_t;
|
|
type system_cronjob_t;
|
|
class tcp_socket { accept bind create getattr listen setopt };
|
|
class udp_socket { connect create getattr setopt };
|
|
class capability net_bind_service;
|
|
class file { getattr lock open read write };
|
|
}
|
|
|
|
#============= ntfy_t ==============
|
|
allow ntfy_t self:capability { net_bind_service net_admin sys_module };
|
|
allow ntfy_t self:tcp_socket { accept bind create getattr listen setopt read write };
|
|
|
|
allow ntfy_t self:udp_socket { connect create getattr setopt listen };
|
|
allow ntfy_t auth_cache_t:file { create getattr open read unlink write };
|
|
allow ntfy_t http_port_t:tcp_socket name_bind;
|
|
allow ntfy_t init_t:unix_stream_socket write;
|
|
allow ntfy_t ntfy_var_lib_t:sock_file { create setattr unlink };
|
|
allow ntfy_t ntfy_cache_t:file { getattr lock open read write };
|
|
|
|
corecmd_exec_bin(ntfy_t)
|
|
corecmd_mmap_bin_files(ntfy_t)
|
|
corenet_tcp_bind_generic_node(ntfy_t)
|
|
corenet_tcp_bind_reserved_port(ntfy_t)
|
|
dev_read_sysfs(ntfy_t)
|
|
files_list_isid_type_dirs(ntfy_t)
|
|
kernel_read_net_sysctls(ntfy_t)
|
|
kernel_rw_unlabeled_files(ntfy_t)
|
|
kernel_search_network_sysctl(ntfy_t)
|
|
sysnet_read_config(ntfy_t)
|
|
|
|
auth_var_filetrans_cache(ntfy_t)
|
|
files_manage_var_files(ntfy_t)
|
|
auth_manage_cache(ntfy_t)
|
|
|
|
#============= httpd_t ==============
|
|
allow httpd_t ntfy_t:unix_stream_socket connectto;
|
|
allow httpd_t ntfy_var_lib_t:sock_file write;
|
|
|
|
#============= unconfined_service_t ==============
|
|
allow unconfined_service_t ntfy_cache_t:file { getattr lock read open write };
|
|
|
|
#============= system_cronjob_t ==============
|
|
allow system_cronjob_t ntfy_cache_t:file getattr;
|