93 lines
2.0 KiB
Plaintext
93 lines
2.0 KiB
Plaintext
policy_module(entropyd, 1.14.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Determine whether entropyd can use
|
|
## audio devices as the source for
|
|
## the entropy feeds.
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(entropyd_use_audio, false)
|
|
|
|
type entropyd_t;
|
|
type entropyd_exec_t;
|
|
init_daemon_domain(entropyd_t, entropyd_exec_t)
|
|
|
|
type entropyd_initrc_exec_t;
|
|
init_script_file(entropyd_initrc_exec_t)
|
|
|
|
type entropyd_runtime_t alias entropyd_var_run_t;
|
|
files_runtime_file(entropyd_runtime_t)
|
|
|
|
type entropyd_unit_t;
|
|
init_unit_file(entropyd_unit_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow entropyd_t self:capability { dac_override ipc_lock sys_admin };
|
|
dontaudit entropyd_t self:capability sys_tty_config;
|
|
allow entropyd_t self:process signal_perms;
|
|
allow entropyd_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
manage_files_pattern(entropyd_t, entropyd_runtime_t, entropyd_runtime_t)
|
|
files_runtime_filetrans(entropyd_t, entropyd_runtime_t, file)
|
|
|
|
kernel_read_system_state(entropyd_t)
|
|
kernel_rw_kernel_sysctl(entropyd_t)
|
|
kernel_read_crypto_sysctls(entropyd_t)
|
|
|
|
dev_read_sysfs(entropyd_t)
|
|
dev_read_urand(entropyd_t)
|
|
dev_write_urand(entropyd_t)
|
|
dev_read_rand(entropyd_t)
|
|
dev_write_rand(entropyd_t)
|
|
|
|
files_read_etc_files(entropyd_t)
|
|
files_read_usr_files(entropyd_t)
|
|
|
|
fs_getattr_all_fs(entropyd_t)
|
|
fs_search_auto_mountpoints(entropyd_t)
|
|
|
|
domain_use_interactive_fds(entropyd_t)
|
|
|
|
logging_send_syslog_msg(entropyd_t)
|
|
|
|
miscfiles_read_localization(entropyd_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(entropyd_t)
|
|
userdom_dontaudit_search_user_home_dirs(entropyd_t)
|
|
|
|
ifdef(`init_systemd', `
|
|
optional_policy(`
|
|
systemd_PrivateDevices(entropyd_t)
|
|
')
|
|
')
|
|
|
|
tunable_policy(`entropyd_use_audio',`
|
|
dev_read_sound(entropyd_t)
|
|
dev_write_sound(entropyd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
tunable_policy(`entropyd_use_audio',`
|
|
alsa_read_lib(entropyd_t)
|
|
alsa_read_config(entropyd_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(entropyd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(entropyd_t)
|
|
')
|