Add mpd from Fedora.
This commit is contained in:
Chris PeBenito
parent
f640bb3e0d
commit
8630e36c5c
@ -143,6 +143,7 @@ network_port(mail, tcp,2000,s0, tcp,3905,s0)
|
||||
network_port(memcache, tcp,11211,s0, udp,11211,s0)
|
||||
network_port(mmcc, tcp,5050,s0, udp,5050,s0)
|
||||
network_port(monopd, tcp,1234,s0)
|
||||
network_port(mpd, tcp,6600,s0)
|
||||
network_port(msnp, tcp,1863,s0, udp,1863,s0)
|
||||
network_port(mssql, tcp,1433-1434,s0, udp,1433-1434,s0)
|
||||
network_port(munin, tcp,4949,s0, udp,4949,s0)
|
||||
|
||||
8
policy/modules/services/mpd.fc
Normal file
8
policy/modules/services/mpd.fc
Normal file
@ -0,0 +1,8 @@
|
||||
/etc/mpd\.conf -- gen_context(system_u:object_r:mpd_etc_t,s0)
|
||||
/etc/rc\.d/init\.d/mpd -- gen_context(system_u:object_r:mpd_initrc_exec_t,s0)
|
||||
|
||||
/usr/bin/mpd -- gen_context(system_u:object_r:mpd_exec_t,s0)
|
||||
|
||||
/var/lib/mpd(/.*)? gen_context(system_u:object_r:mpd_var_lib_t,s0)
|
||||
/var/lib/mpd/music(/.*)? gen_context(system_u:object_r:mpd_data_t,s0)
|
||||
/var/lib/mpd/playlists(/.*)? gen_context(system_u:object_r:mpd_data_t,s0)
|
||||
267
policy/modules/services/mpd.if
Normal file
267
policy/modules/services/mpd.if
Normal file
@ -0,0 +1,267 @@
|
||||
## <summary>Music Player Daemon</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run mpd.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_domtrans',`
|
||||
gen_require(`
|
||||
type mpd_t, mpd_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1, mpd_exec_t, mpd_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute mpd server in the mpd domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_initrc_domtrans',`
|
||||
gen_require(`
|
||||
type mpd_initrc_exec_t;
|
||||
')
|
||||
|
||||
init_labeled_script_domtrans($1, mpd_initrc_exec_t)
|
||||
')
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
## Read mpd data files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_read_data_files',`
|
||||
gen_require(`
|
||||
type mpd_data_t;
|
||||
')
|
||||
|
||||
mpd_search_lib($1)
|
||||
read_files_pattern($1, mpd_data_t, mpd_data_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Manage mpd data files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_manage_data_files',`
|
||||
gen_require(`
|
||||
type mpd_data_t;
|
||||
')
|
||||
|
||||
mpd_search_lib($1)
|
||||
manage_files_pattern($1, mpd_data_t, mpd_data_t)
|
||||
')
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
## Read mpd tmpfs files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_read_tmpfs_files',`
|
||||
gen_require(`
|
||||
type mpd_tmpfs_t;
|
||||
')
|
||||
|
||||
fs_search_tmpfs($1)
|
||||
read_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
|
||||
')
|
||||
|
||||
###################################
|
||||
## <summary>
|
||||
## Manage mpd tmpfs files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_manage_tmpfs_files',`
|
||||
gen_require(`
|
||||
type mpd_tmpfs_t;
|
||||
')
|
||||
|
||||
fs_search_tmpfs($1)
|
||||
manage_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
|
||||
manage_lnk_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search mpd lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_search_lib',`
|
||||
gen_require(`
|
||||
type mpd_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 mpd_var_lib_t:dir search_dir_perms;
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read mpd lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_read_lib_files',`
|
||||
gen_require(`
|
||||
type mpd_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
read_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete
|
||||
## mpd lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_manage_lib_files',`
|
||||
gen_require(`
|
||||
type mpd_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
|
||||
')
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
## Create an object in the root directory, with a private
|
||||
## type using a type transition.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="private type">
|
||||
## <summary>
|
||||
## The type of the object to be created.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="object">
|
||||
## <summary>
|
||||
## The object class of the object being created.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_var_lib_filetrans',`
|
||||
gen_require(`
|
||||
type mpd_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
filetrans_pattern($1, mpd_var_lib_t, $2, $3)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage mpd lib dirs files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`mpd_manage_lib_dirs',`
|
||||
gen_require(`
|
||||
type mpd_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_dirs_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an mpd environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`mpd_admin',`
|
||||
gen_require(`
|
||||
type mpd_t, mpd_initrc_exec_t, mpd_etc_t;
|
||||
type mpd_data_t, mpd_log_t, mpd_var_lib_t;
|
||||
type mpd_tmpfs_t;
|
||||
')
|
||||
|
||||
allow $1 mpd_t:process { ptrace signal_perms };
|
||||
ps_process_pattern($1, mpd_t)
|
||||
|
||||
mpd_initrc_domtrans($1)
|
||||
domain_system_change_exemption($1)
|
||||
role_transition $2 mpd_initrc_exec_t system_r;
|
||||
allow $2 system_r;
|
||||
|
||||
admin_pattern($1, mpd_etc_t)
|
||||
files_list_etc($1)
|
||||
|
||||
files_list_var_lib($1)
|
||||
admin_pattern($1, mpd_var_lib_t)
|
||||
|
||||
admin_pattern($1, mpd_data_t)
|
||||
|
||||
admin_pattern($1, mpd_log_t)
|
||||
|
||||
fs_list_tmpfs($1)
|
||||
admin_pattern($1, mpd_tmpfs_t)
|
||||
')
|
||||
126
policy/modules/services/mpd.te
Normal file
126
policy/modules/services/mpd.te
Normal file
@ -0,0 +1,126 @@
|
||||
policy_module(mpd, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type mpd_t;
|
||||
type mpd_exec_t;
|
||||
init_daemon_domain(mpd_t, mpd_exec_t)
|
||||
|
||||
# type for music content
|
||||
type mpd_data_t;
|
||||
files_type(mpd_data_t)
|
||||
|
||||
type mpd_etc_t;
|
||||
files_config_file(mpd_etc_t)
|
||||
|
||||
type mpd_initrc_exec_t;
|
||||
init_script_file(mpd_initrc_exec_t)
|
||||
|
||||
type mpd_log_t;
|
||||
logging_log_file(mpd_log_t)
|
||||
|
||||
type mpd_tmp_t;
|
||||
files_tmp_file(mpd_tmp_t)
|
||||
|
||||
type mpd_tmpfs_t;
|
||||
files_tmpfs_file(mpd_tmpfs_t)
|
||||
|
||||
type mpd_var_lib_t;
|
||||
files_type(mpd_var_lib_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# mpd local policy
|
||||
#
|
||||
|
||||
# dac_override bug in mpd relating to mpd.log file
|
||||
allow mpd_t self:capability { dac_override kill setgid setuid };
|
||||
allow mpd_t self:process { getsched setsched setrlimit signal signull };
|
||||
allow mpd_t self:fifo_file rw_fifo_file_perms;
|
||||
allow mpd_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
||||
allow mpd_t self:unix_dgram_socket { create_socket_perms sendto };
|
||||
allow mpd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow mpd_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
|
||||
manage_dirs_pattern(mpd_t, mpd_data_t, mpd_data_t)
|
||||
manage_files_pattern(mpd_t, mpd_data_t, mpd_data_t)
|
||||
manage_lnk_files_pattern(mpd_t, mpd_data_t, mpd_data_t)
|
||||
|
||||
read_files_pattern(mpd_t, mpd_etc_t, mpd_etc_t)
|
||||
|
||||
manage_dirs_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
|
||||
manage_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
|
||||
manage_sock_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
|
||||
files_tmp_filetrans(mpd_t, mpd_tmp_t, { dir file sock_file })
|
||||
|
||||
manage_files_pattern(mpd_t, mpd_tmpfs_t, mpd_tmpfs_t)
|
||||
manage_dirs_pattern(mpd_t, mpd_tmpfs_t, mpd_tmpfs_t)
|
||||
fs_tmpfs_filetrans(mpd_t, mpd_tmpfs_t, file )
|
||||
|
||||
manage_dirs_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
|
||||
manage_files_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
|
||||
manage_lnk_files_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
|
||||
files_var_lib_filetrans(mpd_t, mpd_var_lib_t, { dir file lnk_file })
|
||||
|
||||
# needed by pulseaudio
|
||||
kernel_getattr_proc(mpd_t)
|
||||
kernel_read_system_state(mpd_t)
|
||||
kernel_read_kernel_sysctls(mpd_t)
|
||||
|
||||
corecmd_exec_bin(mpd_t)
|
||||
|
||||
corenet_all_recvfrom_unlabeled(mpd_t)
|
||||
corenet_all_recvfrom_netlabel(mpd_t)
|
||||
corenet_tcp_sendrecv_generic_if(mpd_t)
|
||||
corenet_tcp_sendrecv_generic_node(mpd_t)
|
||||
corenet_tcp_bind_mpd_port(mpd_t)
|
||||
corenet_tcp_bind_soundd_port(mpd_t)
|
||||
corenet_tcp_connect_http_port(mpd_t)
|
||||
corenet_tcp_connect_http_cache_port(mpd_t)
|
||||
corenet_tcp_connect_pulseaudio_port(mpd_t)
|
||||
corenet_tcp_connect_soundd_port(mpd_t)
|
||||
corenet_sendrecv_http_client_packets(mpd_t)
|
||||
corenet_sendrecv_http_cache_client_packets(mpd_t)
|
||||
corenet_sendrecv_pulseaudio_client_packets(mpd_t)
|
||||
corenet_sendrecv_soundd_client_packets(mpd_t)
|
||||
|
||||
dev_read_sound(mpd_t)
|
||||
dev_write_sound(mpd_t)
|
||||
dev_read_sysfs(mpd_t)
|
||||
|
||||
files_read_usr_files(mpd_t)
|
||||
|
||||
fs_getattr_tmpfs(mpd_t)
|
||||
fs_list_inotifyfs(mpd_t)
|
||||
fs_rw_anon_inodefs_files(mpd_t)
|
||||
|
||||
auth_use_nsswitch(mpd_t)
|
||||
|
||||
logging_send_syslog_msg(mpd_t)
|
||||
|
||||
miscfiles_read_localization(mpd_t)
|
||||
|
||||
optional_policy(`
|
||||
alsa_read_rw_config(mpd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
consolekit_dbus_chat(mpd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
dbus_system_bus_client(mpd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
pulseaudio_exec(mpd_t)
|
||||
pulseaudio_stream_connect(mpd_t)
|
||||
pulseaudio_signull(mpd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
udev_read_db(mpd_t)
|
||||
')
|
||||
Loading…
Reference in New Issue
Block a user