RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/apps/syncthing.te

68 lines
2.0 KiB
Plaintext
Raw Normal View History

various: Module version bump. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-10-01 00:39:26 +00:00
policy_module(syncthing, 1.2.1)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
########################################
#
# Declarations
#
attribute_role syncthing_roles;
role syncthing_roles types syncthing_t;
type syncthing_t;
type syncthing_exec_t;
init_daemon_domain(syncthing_t, syncthing_exec_t)
userdom_user_application_domain(syncthing_t, syncthing_exec_t)
Remove old aliases. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-11 00:52:54 +00:00
type syncthing_xdg_config_t;
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
xdg_config_content(syncthing_xdg_config_t)
########################################
#
# Declarations
#
Add signal_perms setpgid setsched permissions to syncthing_t. setpgid required because of "WARNING: Failed to lower process priority: set process group: permission denied" setsched required because of "WARNING: Failed to lower process priority: set niceness: permission denied" signal_perms required to launch app.
2018-12-30 14:39:38 +00:00
allow syncthing_t self:process { signal_perms setpgid setsched getsched };
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
allow syncthing_t self:fifo_file rw_fifo_file_perms;
allow syncthing_t self:tcp_socket { listen accept };
can_exec(syncthing_t, syncthing_exec_t)
Add corecmd_exec_bin permissions to syncthing_t. corecmd_exec_bin required to run application.
2018-12-30 14:41:31 +00:00
corecmd_exec_bin(syncthing_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
manage_dirs_pattern(syncthing_t, syncthing_xdg_config_t, syncthing_xdg_config_t)
manage_files_pattern(syncthing_t, syncthing_xdg_config_t, syncthing_xdg_config_t)
manage_lnk_files_pattern(syncthing_t, syncthing_xdg_config_t, syncthing_xdg_config_t)
xdg_config_filetrans(syncthing_t, syncthing_xdg_config_t, dir)
kernel_read_kernel_sysctls(syncthing_t)
kernel_read_net_sysctls(syncthing_t)
kernel_read_system_state(syncthing_t)
Allow syncthing_t to read network state. Allow to read network state (/proc/*/route) and proc_t (/proc/cpuinfo, /proc/meminfo).
2018-12-30 14:42:26 +00:00
kernel_read_network_state(syncthing_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
corenet_tcp_sendrecv_generic_if(syncthing_t)
corenet_udp_sendrecv_generic_if(syncthing_t)
corenet_tcp_bind_generic_node(syncthing_t)
corenet_tcp_sendrecv_generic_node(syncthing_t)
corenet_tcp_sendrecv_all_ports(syncthing_t)
corenet_udp_bind_generic_node(syncthing_t)
corenet_udp_sendrecv_generic_node(syncthing_t)
corenet_udp_sendrecv_all_ports(syncthing_t)
corenet_tcp_connect_all_ports(syncthing_t)
corenet_tcp_bind_syncthing_port(syncthing_t)
corenet_udp_bind_syncthing_discovery_port(syncthing_t)
corenet_tcp_bind_syncthing_admin_port(syncthing_t)
dev_read_rand(syncthing_t)
dev_read_urand(syncthing_t)
fs_getattr_xattr_fs(syncthing_t)
auth_use_nsswitch(syncthing_t)
miscfiles_read_generic_certs(syncthing_t)
miscfiles_read_localization(syncthing_t)
userdom_user_content_access_template(syncthing, syncthing_t)
userdom_use_user_terminals(syncthing_t)