114 lines
3.0 KiB
Plaintext
114 lines
3.0 KiB
Plaintext
policy_module(aptcacher, 1.2.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
attribute_role acngtool_roles;
|
|
|
|
type acngtool_t;
|
|
type acngtool_exec_t;
|
|
application_domain(acngtool_t, acngtool_exec_t)
|
|
role acngtool_roles types acngtool_t;
|
|
|
|
type aptcacher_t;
|
|
type aptcacher_exec_t;
|
|
init_daemon_domain(aptcacher_t, aptcacher_exec_t)
|
|
|
|
type aptcacher_conf_t;
|
|
files_config_file(aptcacher_conf_t)
|
|
|
|
type aptcacher_cache_t;
|
|
files_type(aptcacher_cache_t)
|
|
|
|
type aptcacher_lib_t;
|
|
files_type(aptcacher_lib_t)
|
|
|
|
type aptcacher_log_t;
|
|
logging_log_file(aptcacher_log_t)
|
|
|
|
type aptcacher_runtime_t;
|
|
files_runtime_file(aptcacher_runtime_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow aptcacher_t self:process signal;
|
|
|
|
allow aptcacher_t self:fifo_file rw_inherited_fifo_file_perms;
|
|
allow aptcacher_t self:tcp_socket create_stream_socket_perms;
|
|
allow aptcacher_t self:unix_dgram_socket create_socket_perms;
|
|
allow aptcacher_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
can_exec(aptcacher_t, acngtool_exec_t)
|
|
|
|
allow aptcacher_t aptcacher_conf_t:dir list_dir_perms;
|
|
allow aptcacher_t aptcacher_conf_t:file mmap_read_file_perms;
|
|
# /etc/apt-cacher-ng/ contains symlinks that point to /var/lib/apt-cacher-ng/
|
|
allow aptcacher_t aptcacher_conf_t:lnk_file read_lnk_file_perms;
|
|
|
|
allow aptcacher_t aptcacher_cache_t:dir manage_dir_perms;
|
|
allow aptcacher_t aptcacher_cache_t:file { manage_file_perms map };
|
|
allow aptcacher_t aptcacher_cache_t:lnk_file manage_lnk_file_perms;
|
|
|
|
allow aptcacher_t aptcacher_lib_t:file map;
|
|
files_search_var_lib(aptcacher_t)
|
|
read_files_pattern(aptcacher_t, aptcacher_lib_t, aptcacher_lib_t)
|
|
|
|
allow aptcacher_t aptcacher_log_t:file map;
|
|
logging_search_logs(aptcacher_t)
|
|
manage_files_pattern(aptcacher_t, aptcacher_log_t, aptcacher_log_t)
|
|
|
|
manage_sock_files_pattern(aptcacher_t, aptcacher_runtime_t, aptcacher_runtime_t)
|
|
|
|
kernel_read_vm_overcommit_sysctl(aptcacher_t)
|
|
|
|
# Calls system()
|
|
corecmd_exec_shell(aptcacher_t)
|
|
|
|
corenet_tcp_bind_aptcacher_port(aptcacher_t)
|
|
corenet_tcp_bind_generic_node(aptcacher_t)
|
|
corenet_tcp_connect_http_port(aptcacher_t)
|
|
|
|
auth_use_nsswitch(aptcacher_t)
|
|
|
|
files_read_etc_files(aptcacher_t)
|
|
|
|
# Uses sd_notify() to inform systemd it has properly started
|
|
init_dgram_send(aptcacher_t)
|
|
|
|
miscfiles_read_generic_certs(aptcacher_t)
|
|
|
|
# Reads /usr/share/zoneinfo/
|
|
miscfiles_read_localization(aptcacher_t)
|
|
|
|
# For some reasons it's trying to mmap /etc/hosts.deny
|
|
sysnet_mmap_config_files(aptcacher_t)
|
|
|
|
#######################################
|
|
#
|
|
# acngtool local policy
|
|
#
|
|
|
|
allow acngtool_t self:tcp_socket create_stream_socket_perms;
|
|
allow acngtool_t self:unix_stream_socket create_socket_perms;
|
|
|
|
allow acngtool_t aptcacher_conf_t:dir list_dir_perms;
|
|
allow acngtool_t aptcacher_conf_t:file mmap_read_file_perms;
|
|
|
|
aptcacher_stream_connect(acngtool_t)
|
|
|
|
corenet_tcp_connect_aptcacher_port(acngtool_t)
|
|
|
|
auth_use_nsswitch(acngtool_t)
|
|
|
|
# For some reasons it's trying to mmap /etc/hosts.deny
|
|
sysnet_mmap_config_files(acngtool_t)
|
|
|
|
optional_policy(`
|
|
cron_system_entry(acngtool_t, acngtool_exec_t)
|
|
')
|