42 lines
1.1 KiB
Plaintext
42 lines
1.1 KiB
Plaintext
#DESC TFTP - UDP based file server for boot loaders
|
|
#
|
|
# Author: Russell Coker <russell@coker.com.au>
|
|
# X-Debian-Packages: tftpd atftpd
|
|
# Depends: inetd.te
|
|
#
|
|
|
|
#################################
|
|
#
|
|
# Rules for the tftpd_t domain.
|
|
#
|
|
# tftpd_exec_t is the type of the tftpd executable.
|
|
#
|
|
daemon_domain(tftpd)
|
|
|
|
# tftpdir_t is the type of files in the /tftpboot directories.
|
|
type tftpdir_t, file_type, sysadmfile;
|
|
r_dir_file(tftpd_t, tftpdir_t)
|
|
|
|
domain_auto_trans(inetd_t, tftpd_exec_t, tftpd_t)
|
|
|
|
# Use the network.
|
|
can_network_udp(tftpd_t)
|
|
allow tftpd_t tftp_port_t:udp_socket name_bind;
|
|
ifdef(`inetd.te', `
|
|
allow inetd_t tftp_port_t:udp_socket name_bind;
|
|
')
|
|
allow tftpd_t self:unix_dgram_socket create_socket_perms;
|
|
allow tftpd_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
# allow any domain to connect to the TFTP server
|
|
allow tftpd_t inetd_t:udp_socket rw_socket_perms;
|
|
|
|
# Use capabilities
|
|
allow tftpd_t self:capability { setgid setuid net_bind_service sys_chroot };
|
|
|
|
allow tftpd_t etc_t:dir r_dir_perms;
|
|
allow tftpd_t etc_t:file r_file_perms;
|
|
|
|
allow tftpd_t var_t:dir r_dir_perms;
|
|
allow tftpd_t var_t:{ file lnk_file } r_file_perms;
|