65 lines
1.6 KiB
Plaintext
65 lines
1.6 KiB
Plaintext
|
#DESC usernetctl - User network interface configuration helper
|
||
|
|
#
|
||
|
|
# Author: Colin Walters <walters@redhat.com>
|
||
|
|
|
||
|
|
type usernetctl_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
|
||
|
|
type usernetctl_t, domain, privfd;
|
||
|
|
|
||
|
|
if (user_net_control) {
|
||
|
|
domain_auto_trans(userdomain, usernetctl_exec_t, usernetctl_t)
|
||
|
|
} else {
|
||
|
|
can_exec(userdomain, usernetctl_exec_t)
|
||
|
|
}
|
||
|
|
in_user_role(usernetctl_t)
|
||
|
|
role sysadm_r types usernetctl_t;
|
||
|
|
|
||
|
|
define(`usernetctl_transition',`
|
||
|
|
domain_auto_trans(usernetctl_t, $1_exec_t, $1_t)
|
||
|
|
in_user_role($1_t)
|
||
|
|
allow $1_t userpty_type:chr_file { getattr read write };
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`ifconfig.te',`
|
||
|
|
usernetctl_transition(ifconfig)
|
||
|
|
')
|
||
|
|
ifdef(`iptables.te',`
|
||
|
|
usernetctl_transition(iptables)
|
||
|
|
')
|
||
|
|
ifdef(`dhcpc.te',`
|
||
|
|
usernetctl_transition(dhcpc)
|
||
|
|
allow usernetctl_t dhcp_etc_t:file ra_file_perms;
|
||
|
|
')
|
||
|
|
ifdef(`modutil.te',`
|
||
|
|
usernetctl_transition(insmod)
|
||
|
|
')
|
||
|
|
ifdef(`consoletype.te',`
|
||
|
|
usernetctl_transition(consoletype)
|
||
|
|
')
|
||
|
|
ifdef(`hostname.te',`
|
||
|
|
usernetctl_transition(hostname)
|
||
|
|
')
|
||
|
|
|
||
|
|
allow usernetctl_t self:capability { setuid setgid dac_override };
|
||
|
|
|
||
|
|
base_file_read_access(usernetctl_t)
|
||
|
|
base_pty_perms(usernetctl)
|
||
|
|
allow usernetctl_t devtty_t:chr_file rw_file_perms;
|
||
|
|
uses_shlib(usernetctl_t)
|
||
|
|
read_locale(usernetctl_t)
|
||
|
|
general_domain_access(usernetctl_t)
|
||
|
|
|
||
|
|
r_dir_file(usernetctl_t, proc_t)
|
||
|
|
dontaudit usernetctl_t { domain - usernetctl_t }:dir search;
|
||
|
|
|
||
|
|
allow usernetctl_t userpty_type:chr_file rw_file_perms;
|
||
|
|
|
||
|
|
can_exec(usernetctl_t, { bin_t sbin_t shell_exec_t usernetctl_exec_t})
|
||
|
|
can_exec(usernetctl_t, etc_t)
|
||
|
|
|
||
|
|
r_dir_file(usernetctl_t, etc_t)
|
||
|
|
allow usernetctl_t { var_t var_run_t }:dir { getattr read search };
|
||
|
|
allow usernetctl_t etc_runtime_t:file r_file_perms;
|
||
|
|
allow usernetctl_t net_conf_t:file r_file_perms;
|
||
|
|
|