policy/modules/services/distcc.te

   1
   2 policy_module(distcc, 1.6.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type distccd_t;
  10 type distccd_exec_t;
  11 init_daemon_domain(distccd_t, distccd_exec_t)
  12
  13 type distccd_log_t;
  14 logging_log_file(distccd_log_t)
  15
  16 type distccd_tmp_t;
  17 files_tmp_file(distccd_tmp_t)
  18
  19 type distccd_var_run_t;
  20 files_pid_file(distccd_var_run_t)
  21
  22 ########################################
  23 #
  24 # Local policy
  25 #
  26
  27 allow distccd_t self:capability { setgid setuid };
  28 dontaudit distccd_t self:capability sys_tty_config;
  29 allow distccd_t self:process { signal_perms setsched };
  30 allow distccd_t self:fifo_file rw_fifo_file_perms;
  31 allow distccd_t self:netlink_route_socket r_netlink_socket_perms;
  32 allow distccd_t self:tcp_socket create_stream_socket_perms;
  33 allow distccd_t self:udp_socket create_socket_perms;
  34
  35 allow distccd_t distccd_log_t:file manage_file_perms;
  36 logging_log_filetrans(distccd_t, distccd_log_t, file)
  37
  38 manage_dirs_pattern(distccd_t, distccd_tmp_t, distccd_tmp_t)
  39 manage_files_pattern(distccd_t, distccd_tmp_t, distccd_tmp_t)
  40 files_tmp_filetrans(distccd_t, distccd_tmp_t, { file dir })
  41
  42 manage_files_pattern(distccd_t, distccd_var_run_t, distccd_var_run_t)
  43 files_pid_filetrans(distccd_t, distccd_var_run_t, file)
  44
  45 kernel_read_system_state(distccd_t)
  46 kernel_read_kernel_sysctls(distccd_t)
  47
  48 corenet_all_recvfrom_unlabeled(distccd_t)
  49 corenet_all_recvfrom_netlabel(distccd_t)
  50 corenet_tcp_sendrecv_all_if(distccd_t)
  51 corenet_udp_sendrecv_all_if(distccd_t)
  52 corenet_tcp_sendrecv_all_nodes(distccd_t)
  53 corenet_udp_sendrecv_all_nodes(distccd_t)
  54 corenet_tcp_sendrecv_all_ports(distccd_t)
  55 corenet_udp_sendrecv_all_ports(distccd_t)
  56 corenet_tcp_bind_all_nodes(distccd_t)
  57 corenet_tcp_bind_distccd_port(distccd_t)
  58 corenet_sendrecv_distccd_server_packets(distccd_t)
  59
  60 dev_read_sysfs(distccd_t)
  61
  62 fs_getattr_all_fs(distccd_t)
  63 fs_search_auto_mountpoints(distccd_t)
  64
  65 corecmd_exec_bin(distccd_t)
  66 corecmd_read_bin_symlinks(distccd_t)
  67
  68 domain_use_interactive_fds(distccd_t)
  69
  70 files_read_etc_files(distccd_t)
  71 files_read_etc_runtime_files(distccd_t)
  72
  73 libs_use_ld_so(distccd_t)
  74 libs_use_shared_libs(distccd_t)
  75 libs_exec_lib_files(distccd_t)
  76
  77 logging_send_syslog_msg(distccd_t)
  78
  79 miscfiles_read_localization(distccd_t)
  80
  81 sysnet_read_config(distccd_t)
  82
  83 userdom_dontaudit_use_unpriv_user_fds(distccd_t)
  84
  85 sysadm_dontaudit_search_home_dirs(distccd_t)
  86
  87 optional_policy(`
  88         nis_use_ypbind(distccd_t)
  89 ')
  90
  91 optional_policy(`
  92         seutil_sigchld_newrole(distccd_t)
  93 ')
  94
  95 optional_policy(`
  96         udev_read_db(distccd_t)
  97 ')