172 lines
4.3 KiB
Plaintext
172 lines
4.3 KiB
Plaintext
policy_module(polipo, 1.4.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Determine whether Polipo system
|
|
## daemon can access CIFS file systems.
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(polipo_system_use_cifs, false)
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Determine whether Polipo system
|
|
## daemon can access NFS file systems.
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(polipo_system_use_nfs, false)
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Determine whether calling user domains
|
|
## can execute Polipo daemon in the
|
|
## polipo_session_t domain.
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(polipo_session_users, false)
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Determine whether Polipo session daemon
|
|
## can send syslog messages.
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(polipo_session_send_syslog_msg, false)
|
|
|
|
attribute polipo_daemon;
|
|
|
|
type polipo_system_t, polipo_daemon;
|
|
type polipo_exec_t;
|
|
init_daemon_domain(polipo_system_t, polipo_exec_t)
|
|
|
|
type polipo_initrc_exec_t;
|
|
init_script_file(polipo_initrc_exec_t)
|
|
|
|
type polipo_conf_t;
|
|
files_config_file(polipo_conf_t)
|
|
|
|
type polipo_cache_t;
|
|
files_type(polipo_cache_t)
|
|
|
|
type polipo_log_t;
|
|
logging_log_file(polipo_log_t)
|
|
|
|
type polipo_var_run_t;
|
|
files_pid_file(polipo_var_run_t)
|
|
|
|
type polipo_session_t, polipo_daemon;
|
|
userdom_user_application_domain(polipo_session_t, polipo_exec_t)
|
|
|
|
type polipo_cache_home_t;
|
|
userdom_user_home_content(polipo_cache_home_t)
|
|
|
|
type polipo_config_home_t;
|
|
userdom_user_home_content(polipo_config_home_t)
|
|
|
|
########################################
|
|
#
|
|
# Session local policy
|
|
#
|
|
|
|
allow polipo_session_t polipo_config_home_t:file read_file_perms;
|
|
|
|
manage_dirs_pattern(polipo_session_t, polipo_cache_home_t, polipo_cache_home_t)
|
|
manage_files_pattern(polipo_session_t, polipo_cache_home_t, polipo_cache_home_t)
|
|
userdom_user_home_dir_filetrans(polipo_session_t, polipo_cache_home_t, dir, ".polipo-cache")
|
|
|
|
auth_use_nsswitch(polipo_session_t)
|
|
|
|
userdom_use_user_terminals(polipo_session_t)
|
|
|
|
tunable_policy(`polipo_session_send_syslog_msg',`
|
|
logging_send_syslog_msg(polipo_session_t)
|
|
')
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
fs_read_nfs_files(polipo_session_t)
|
|
',`
|
|
fs_dontaudit_read_nfs_files(polipo_session_t)
|
|
')
|
|
|
|
tunable_policy(`use_samba_home_dirs',`
|
|
fs_read_cifs_files(polipo_session_t)
|
|
',`
|
|
fs_dontaudit_read_cifs_files(polipo_session_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# System local policy
|
|
#
|
|
|
|
read_files_pattern(polipo_system_t, polipo_conf_t, polipo_conf_t)
|
|
|
|
manage_files_pattern(polipo_system_t, polipo_cache_t, polipo_cache_t)
|
|
manage_dirs_pattern(polipo_system_t, polipo_cache_t, polipo_cache_t)
|
|
files_var_filetrans(polipo_system_t, polipo_cache_t, dir)
|
|
|
|
append_files_pattern(polipo_system_t, polipo_log_t, polipo_log_t)
|
|
create_files_pattern(polipo_system_t, polipo_log_t, polipo_log_t)
|
|
setattr_files_pattern(polipo_system_t, polipo_log_t, polipo_log_t)
|
|
logging_log_filetrans(polipo_system_t, polipo_log_t, file)
|
|
|
|
manage_files_pattern(polipo_system_t, polipo_var_run_t, polipo_var_run_t)
|
|
files_pid_filetrans(polipo_system_t, polipo_var_run_t, file)
|
|
|
|
auth_use_nsswitch(polipo_system_t)
|
|
|
|
logging_send_syslog_msg(polipo_system_t)
|
|
|
|
optional_policy(`
|
|
cron_system_entry(polipo_system_t, polipo_exec_t)
|
|
')
|
|
|
|
tunable_policy(`polipo_system_use_cifs',`
|
|
fs_manage_cifs_files(polipo_system_t)
|
|
',`
|
|
fs_dontaudit_read_cifs_files(polipo_system_t)
|
|
')
|
|
|
|
tunable_policy(`polipo_system_use_nfs',`
|
|
fs_manage_nfs_files(polipo_system_t)
|
|
',`
|
|
fs_dontaudit_read_nfs_files(polipo_system_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Polipo global local policy
|
|
#
|
|
|
|
allow polipo_daemon self:fifo_file rw_fifo_file_perms;
|
|
allow polipo_daemon self:tcp_socket { listen accept };
|
|
|
|
corenet_all_recvfrom_unlabeled(polipo_daemon)
|
|
corenet_all_recvfrom_netlabel(polipo_daemon)
|
|
corenet_tcp_sendrecv_generic_if(polipo_daemon)
|
|
corenet_tcp_sendrecv_generic_node(polipo_daemon)
|
|
corenet_tcp_bind_generic_node(polipo_daemon)
|
|
|
|
corenet_sendrecv_http_client_packets(polipo_daemon)
|
|
corenet_tcp_sendrecv_http_port(polipo_daemon)
|
|
corenet_tcp_connect_http_port(polipo_daemon)
|
|
|
|
corenet_sendrecv_http_cache_server_packets(polipo_daemon)
|
|
corenet_tcp_sendrecv_http_cache_port(polipo_daemon)
|
|
corenet_tcp_bind_http_cache_port(polipo_daemon)
|
|
|
|
corenet_sendrecv_tor_client_packets(polipo_daemon)
|
|
corenet_tcp_sendrecv_tor_port(polipo_daemon)
|
|
corenet_tcp_connect_tor_port(polipo_daemon)
|
|
|
|
files_read_usr_files(polipo_daemon)
|
|
|
|
fs_search_auto_mountpoints(polipo_daemon)
|
|
|
|
miscfiles_read_localization(polipo_daemon)
|