2022-01-06 13:55:54 +00:00
|
|
|
policy_module(guest)
|
2018-06-23 13:00:56 +00:00
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# Declarations
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
role guest_r;
|
|
|
|
|
|
|
|
|
|
userdom_restricted_user_template(guest)
|
|
|
|
|
|
|
|
|
|
kernel_read_system_state(guest_t)
|
|
|
|
|
|
2022-09-06 13:41:09 +00:00
|
|
|
## <desc>
|
|
|
|
|
## <p>
|
|
|
|
|
## Determine whether guest can
|
|
|
|
|
## configure network manager.
|
|
|
|
|
## </p>
|
|
|
|
|
## </desc>
|
|
|
|
|
gen_tunable(guest_connect_network, false)
|
|
|
|
|
|
2018-06-23 13:00:56 +00:00
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# Local policy
|
|
|
|
|
#
|
|
|
|
|
|
2021-03-13 23:22:59 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
dbus_role_template(guest, guest_r, guest_t)
|
|
|
|
|
')
|
|
|
|
|
|
2022-09-06 13:41:09 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
tunable_policy(`guest_connect_network',`
|
|
|
|
|
kernel_read_network_state(guest_t)
|
|
|
|
|
|
|
|
|
|
networkmanager_dbus_chat(guest_t)
|
|
|
|
|
networkmanager_read_lib_files(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_all_recvfrom_netlabel(guest_t)
|
|
|
|
|
corenet_tcp_sendrecv_generic_if(guest_t)
|
|
|
|
|
corenet_raw_sendrecv_generic_if(guest_t)
|
|
|
|
|
corenet_tcp_sendrecv_generic_node(guest_t)
|
|
|
|
|
corenet_raw_sendrecv_generic_node(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_pulseaudio_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_pulseaudio_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_http_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_http_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_http_cache_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_http_cache_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_squid_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_squid_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_ftp_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_ftp_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_ipp_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_ipp_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_generic_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_generic_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_soundd_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_soundd_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_speech_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_speech_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_sendrecv_transproxy_client_packets(guest_t)
|
|
|
|
|
corenet_tcp_connect_transproxy_port(guest_t)
|
|
|
|
|
|
|
|
|
|
corenet_dontaudit_tcp_bind_generic_port(guest_t)
|
|
|
|
|
')
|
|
|
|
|
')
|
|
|
|
|
|
2018-06-23 13:00:56 +00:00
|
|
|
#gen_user(guest_u, user, guest_r, s0, s0)
|
