78276fc43b
Semodule stopped using this many years ago. The policy_module() macro will continue to support an optional second parameter as version. If it is not specified, a default value of 1 is set. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
44 lines
905 B
Plaintext
44 lines
905 B
Plaintext
policy_module(memlockd)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type memlockd_t;
|
|
type memlockd_exec_t;
|
|
init_daemon_domain(memlockd_t, memlockd_exec_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow memlockd_t self:capability { setgid setuid ipc_lock };
|
|
allow memlockd_t self:fifo_file rw_inherited_fifo_file_perms;
|
|
|
|
# cache /etc/shadow too
|
|
auth_read_shadow(memlockd_t)
|
|
auth_map_shadow(memlockd_t)
|
|
|
|
corecmd_exec_all_executables(memlockd_t)
|
|
corecmd_exec_bin(memlockd_t)
|
|
corecmd_exec_shell(memlockd_t)
|
|
corecmd_read_all_executables(memlockd_t)
|
|
corecmd_search_bin(memlockd_t)
|
|
|
|
files_read_etc_files(memlockd_t)
|
|
files_map_etc_files(memlockd_t)
|
|
|
|
libs_exec_ld_so(memlockd_t)
|
|
|
|
logging_send_syslog_msg(memlockd_t)
|
|
|
|
miscfiles_read_localization(memlockd_t)
|
|
|
|
sysnet_mmap_read_config(memlockd_t)
|
|
|
|
ifndef(`distro_debian', `
|
|
allow memlockd_t self:capability dac_read_search;
|
|
')
|