a7c9634eca
WireGuard is a fast, modern, secure VPN tunnel, according to https://www.wireguard.com/. In order to install it, the mostly documented way consists in building and installing an out-of-tree kernel module and using userland tools to configure this module (wg and wg-quick). * WireGuard is like "ip": the userland tool communicates with the kernel module through a netlink socket. * WireGuard is like "iptables": there is no daemon, but some distributions ship systemd units that restores a WireGuard configuration when started. * WireGuard is like other services: its configuration files are in /etc, and it can use /run and /tmp. Create a new policy module which handles all of this. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
9 lines
388 B
Plaintext
9 lines
388 B
Plaintext
/etc/wireguard(/.*)? gen_context(system_u:object_r:wireguard_etc_t,s0)
|
|
|
|
/run/wireguard(/.*)? gen_context(system_u:object_r:wireguard_runtime_t,s0)
|
|
|
|
/usr/bin/wg -- gen_context(system_u:object_r:wireguard_exec_t,s0)
|
|
/usr/bin/wg-quick -- gen_context(system_u:object_r:wireguard_exec_t,s0)
|
|
|
|
/usr/lib/systemd/system/wg-quick.*\.service -- gen_context(system_u:object_r:wireguard_unit_t,s0)
|