selinux-refpolicy/strict/domains/program/ping.te

#DESC Ping - Send ICMP messages to network hosts
#
# Author:  David A. Wheeler <dwheeler@ida.org>
# X-Debian-Packages: iputils-ping netkit-ping iputils-arping arping hping2
#

#################################
#
# Rules for the ping_t domain.
#
# ping_t is the domain for the ping program.
# ping_exec_t is the type of the corresponding program.
#
type ping_t, domain, privlog, nscd_client_domain;
role sysadm_r types ping_t;
role system_r types ping_t;
in_user_role(ping_t)
type ping_exec_t, file_type, sysadmfile, exec_type;

ifdef(`targeted_policy', `
	allow ping_t { devpts_t ttyfile ptyfile }:chr_file rw_file_perms;
', `
bool user_ping false;

if (user_ping) {
	domain_auto_trans(unpriv_userdomain, ping_exec_t, ping_t)
	# allow access to the terminal
	allow ping_t { ttyfile ptyfile }:chr_file rw_file_perms;
	ifdef(`gnome-pty-helper.te', `allow ping_t gphdomain:fd use;')
}
')

# Transition into this domain when you run this program.
domain_auto_trans(sysadm_t, ping_exec_t, ping_t)
domain_auto_trans(initrc_t, ping_exec_t, ping_t)

uses_shlib(ping_t)
can_network_client(ping_t)
can_resolve(ping_t)
allow ping_t dns_port_t:tcp_socket name_connect;
can_ypbind(ping_t)
allow ping_t etc_t:file { getattr read };
allow ping_t self:unix_stream_socket create_socket_perms;

# Let ping create raw ICMP packets.
allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt };

# Use capabilities.
allow ping_t self:capability { net_raw setuid };

# Access the terminal.
allow ping_t admin_tty_type:chr_file rw_file_perms;
ifdef(`gnome-pty-helper.te', `allow ping_t sysadm_gph_t:fd use;')
allow ping_t privfd:fd use;
dontaudit ping_t fs_t:filesystem getattr;

# it tries to access /var/run
dontaudit ping_t var_t:dir search;
dontaudit ping_t devtty_t:chr_file { read write };
dontaudit ping_t self:capability sys_tty_config;
ifdef(`hide_broken_symptoms', `
dontaudit ping_t init_t:fd use;
')