add authbind, bug 1516

refpolicy/Changelog

@@ -37,6 +37,7 @@
 	apt (Erich Schubert)
 	asterisk
 	audioentropy
+	authbind
 	backup
 	calamaris
 	cipe

refpolicy/policy/modules/apps/authbind.fc

@@ -0,0 +1,3 @@
+/etc/authbind(/.*)?			gen_require(system_u:object_r:authbind_etc_t,s0)
+
+/usr/lib(64)?/authbind/helper	--	gen_require(system_u:object_r:authbind_exec_t,s0)

refpolicy/policy/modules/apps/authbind.if

@@ -0,0 +1,23 @@
+## <summary>Tool for non-root processes to bind to reserved ports</summary>
+
+########################################
+## <summary>
+##	Use authbind to bind to a reserved port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`authbind_domtrans',`
+	gen_require(`
+		type authbind_t, authbind_exec_t;
+	')
+
+	domain_auto_trans($1,authbind_exec_t,authbind_t)
+	allow authbind_t $1:fd use;
+	allow authbind_t $1:fifo_file rw_file_perms;
+	allow authbind_t $1:process sigchld;
+	allow authbind_t $1:{ tcp_socket udp_socket } rw_socket_perms;
+')

refpolicy/policy/modules/apps/authbind.te

@@ -0,0 +1,36 @@
+
+policy_module(authbind,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type authbind_t;
+type authbind_exec_t;
+domain_type(authbind_t)
+domain_entry_file(authbind_t,authbind_exec_t)
+role system_r types authbind_t;
+
+type authbind_etc_t;
+files_config_file(authbind_etc_t)
+
+########################################
+#
+# Local policy
+#
+
+allow authbind_t self:capability net_bind_service;
+
+can_exec(authbind_t, authbind_etc_t)
+allow authbind_t authbind_etc_t:file r_file_perms;
+allow authbind_t authbind_etc_t:dir r_dir_perms;
+allow authbind_t authbind_etc_t:lnk_file { getattr read };
+files_list_etc(authbind_t)
+
+term_use_console(authbind_t)
+
+logging_send_syslog_msg(authbind_t)
+
+libs_use_ld_so(authbind_t)
+libs_use_shared_libs(authbind_t)