RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/services/wireguard.fc

9 lines
388 B
Plaintext
Raw Normal View History

Add a policy module for WireGuard VPN WireGuard is a fast, modern, secure VPN tunnel, according to https://www.wireguard.com/. In order to install it, the mostly documented way consists in building and installing an out-of-tree kernel module and using userland tools to configure this module (wg and wg-quick). * WireGuard is like "ip": the userland tool communicates with the kernel module through a netlink socket. * WireGuard is like "iptables": there is no daemon, but some distributions ship systemd units that restores a WireGuard configuration when started. * WireGuard is like other services: its configuration files are in /etc, and it can use /run and /tmp. Create a new policy module which handles all of this. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 20:20:40 +00:00
/etc/wireguard(/.*)? gen_context(system_u:object_r:wireguard_etc_t,s0)
/run/wireguard(/.*)? gen_context(system_u:object_r:wireguard_runtime_t,s0)
/usr/bin/wg -- gen_context(system_u:object_r:wireguard_exec_t,s0)
/usr/bin/wg-quick -- gen_context(system_u:object_r:wireguard_exec_t,s0)
/usr/lib/systemd/system/wg-quick.*\.service -- gen_context(system_u:object_r:wireguard_unit_t,s0)