selinux-refpolicy/policy/modules/admin/vpn.if

141 lines
2.4 KiB
Plaintext

## <summary>Virtual Private Networking client.</summary>
########################################
## <summary>
## Execute vpn clients in the vpnc domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`vpn_domtrans',`
gen_require(`
type vpnc_t, vpnc_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, vpnc_exec_t, vpnc_t)
')
########################################
## <summary>
## Execute vpn clients in the vpnc
## domain, and allow the specified
## role the vpnc domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`vpn_run',`
gen_require(`
attribute_role vpnc_roles;
')
vpn_domtrans($1)
roleattribute $2 vpnc_roles;
')
########################################
## <summary>
## Send kill signals to vpnc.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`vpn_kill',`
gen_require(`
type vpnc_t;
')
allow $1 vpnc_t:process sigkill;
')
########################################
## <summary>
## Send generic signals to vpnc.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`vpn_signal',`
gen_require(`
type vpnc_t;
')
allow $1 vpnc_t:process signal;
')
########################################
## <summary>
## Send null signals to vpnc.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`vpn_signull',`
gen_require(`
type vpnc_t;
')
allow $1 vpnc_t:process signull;
')
########################################
## <summary>
## Send and receive messages from
## vpnc over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`vpn_dbus_chat',`
gen_require(`
type vpnc_t;
class dbus send_msg;
')
allow $1 vpnc_t:dbus send_msg;
allow vpnc_t $1:dbus send_msg;
')
########################################
## <summary>
## Relabelfrom from vpnc socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`vpn_relabelfrom_tun_socket',`
gen_require(`
type vpnc_t;
')
allow $1 vpnc_t:tun_socket relabelfrom;
')