44 lines
912 B
Plaintext
44 lines
912 B
Plaintext
policy_module(memlockd, 1.1.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type memlockd_t;
|
|
type memlockd_exec_t;
|
|
init_daemon_domain(memlockd_t, memlockd_exec_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow memlockd_t self:capability { setgid setuid ipc_lock };
|
|
allow memlockd_t self:fifo_file rw_inherited_fifo_file_perms;
|
|
|
|
# cache /etc/shadow too
|
|
auth_read_shadow(memlockd_t)
|
|
auth_map_shadow(memlockd_t)
|
|
|
|
corecmd_exec_all_executables(memlockd_t)
|
|
corecmd_exec_bin(memlockd_t)
|
|
corecmd_exec_shell(memlockd_t)
|
|
corecmd_read_all_executables(memlockd_t)
|
|
corecmd_search_bin(memlockd_t)
|
|
|
|
files_read_etc_files(memlockd_t)
|
|
files_map_etc_files(memlockd_t)
|
|
|
|
libs_exec_ld_so(memlockd_t)
|
|
|
|
logging_send_syslog_msg(memlockd_t)
|
|
|
|
miscfiles_read_localization(memlockd_t)
|
|
|
|
sysnet_mmap_read_config(memlockd_t)
|
|
|
|
ifndef(`distro_debian', `
|
|
allow memlockd_t self:capability dac_read_search;
|
|
')
|