policy/modules/services/avahi.te

   1 policy_module(avahi, 1.13.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type avahi_t;
   9 type avahi_exec_t;
  10 init_daemon_domain(avahi_t, avahi_exec_t)
  11
  12 type avahi_initrc_exec_t;
  13 init_script_file(avahi_initrc_exec_t)
  14
  15 type avahi_var_lib_t;
  16 files_pid_file(avahi_var_lib_t)
  17
  18 type avahi_var_run_t;
  19 files_pid_file(avahi_var_run_t)
  20 init_sock_file(avahi_var_run_t)
  21
  22 ########################################
  23 #
  24 # Local policy
  25 #
  26
  27 allow avahi_t self:capability { dac_override setgid chown fowner kill net_admin net_raw setuid sys_chroot };
  28 dontaudit avahi_t self:capability sys_tty_config;
  29 allow avahi_t self:process { setrlimit signal_perms getcap setcap };
  30 allow avahi_t self:fifo_file rw_fifo_file_perms;
  31 allow avahi_t self:unix_stream_socket { connectto create_stream_socket_perms };
  32 allow avahi_t self:unix_dgram_socket create_socket_perms;
  33 allow avahi_t self:tcp_socket create_stream_socket_perms;
  34 allow avahi_t self:udp_socket create_socket_perms;
  35 allow avahi_t self:packet_socket create_socket_perms;
  36
  37 manage_dirs_pattern(avahi_t, avahi_var_lib_t, avahi_var_lib_t)
  38 manage_files_pattern(avahi_t, avahi_var_lib_t, avahi_var_lib_t)
  39 files_var_lib_filetrans(avahi_t, avahi_var_lib_t, { dir file })
  40
  41 manage_dirs_pattern(avahi_t, avahi_var_run_t, avahi_var_run_t)
  42 manage_files_pattern(avahi_t, avahi_var_run_t, avahi_var_run_t)
  43 manage_sock_files_pattern(avahi_t, avahi_var_run_t, avahi_var_run_t)
  44 allow avahi_t avahi_var_run_t:dir setattr_dir_perms;
  45 files_pid_filetrans(avahi_t, avahi_var_run_t, { dir file })
  46
  47 kernel_read_system_state(avahi_t)
  48 kernel_read_kernel_sysctls(avahi_t)
  49 kernel_read_network_state(avahi_t)
  50 kernel_request_load_module(avahi_t)
  51
  52 corecmd_exec_bin(avahi_t)
  53 corecmd_exec_shell(avahi_t)
  54
  55 corenet_all_recvfrom_unlabeled(avahi_t)
  56 corenet_all_recvfrom_netlabel(avahi_t)
  57 corenet_tcp_sendrecv_generic_if(avahi_t)
  58 corenet_udp_sendrecv_generic_if(avahi_t)
  59 corenet_tcp_sendrecv_generic_node(avahi_t)
  60 corenet_udp_sendrecv_generic_node(avahi_t)
  61 corenet_tcp_sendrecv_all_ports(avahi_t)
  62 corenet_udp_sendrecv_all_ports(avahi_t)
  63 corenet_tcp_bind_generic_node(avahi_t)
  64 corenet_udp_bind_generic_node(avahi_t)
  65 corenet_tcp_bind_howl_port(avahi_t)
  66 corenet_udp_bind_howl_port(avahi_t)
  67 corenet_send_howl_client_packets(avahi_t)
  68 corenet_receive_howl_server_packets(avahi_t)
  69
  70 dev_read_sysfs(avahi_t)
  71 dev_read_urand(avahi_t)
  72
  73 fs_getattr_all_fs(avahi_t)
  74 fs_search_auto_mountpoints(avahi_t)
  75 fs_list_inotifyfs(avahi_t)
  76
  77 domain_use_interactive_fds(avahi_t)
  78
  79 files_read_etc_files(avahi_t)
  80 files_read_etc_runtime_files(avahi_t)
  81 files_read_usr_files(avahi_t)
  82
  83 auth_use_nsswitch(avahi_t)
  84
  85 init_signal_script(avahi_t)
  86 init_signull_script(avahi_t)
  87
  88 logging_send_syslog_msg(avahi_t)
  89
  90 miscfiles_read_localization(avahi_t)
  91 miscfiles_read_generic_certs(avahi_t)
  92
  93 sysnet_domtrans_ifconfig(avahi_t)
  94 sysnet_manage_config(avahi_t)
  95 sysnet_etc_filetrans_config(avahi_t)
  96
  97 userdom_dontaudit_use_unpriv_user_fds(avahi_t)
  98 userdom_dontaudit_search_user_home_dirs(avahi_t)
  99
 100 optional_policy(`
 101         dbus_system_domain(avahi_t, avahi_exec_t)
 102         dbus_system_bus_client(avahi_t)
 103         dbus_connect_system_bus(avahi_t)
 104
 105         init_dbus_chat_script(avahi_t)
 106 ')
 107
 108 optional_policy(`
 109         rpcbind_signull(avahi_t)
 110 ')
 111
 112 optional_policy(`
 113         seutil_sigchld_newrole(avahi_t)
 114 ')
 115
 116 optional_policy(`
 117         udev_read_db(avahi_t)
 118 ')