policy/modules/services/cgroup.te

   1 policy_module(cgroup, 1.0.1)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type cgclear_t;
   9 type cgclear_exec_t;
  10 init_daemon_domain(cgclear_t, cgclear_exec_t)
  11
  12 type cgred_t;
  13 type cgred_exec_t;
  14 init_daemon_domain(cgred_t, cgred_exec_t)
  15
  16 type cgred_initrc_exec_t;
  17 init_script_file(cgred_initrc_exec_t)
  18
  19 type cgred_log_t;
  20 logging_log_file(cgred_log_t)
  21
  22 type cgred_var_run_t;
  23 files_pid_file(cgred_var_run_t)
  24
  25 type cgrules_etc_t;
  26 files_config_file(cgrules_etc_t)
  27
  28 type cgconfig_t alias cgconfigparser_t;
  29 type cgconfig_exec_t alias cgconfigparser_exec_t;
  30 init_daemon_domain(cgconfig_t, cgconfig_exec_t)
  31
  32 type cgconfig_initrc_exec_t;
  33 init_script_file(cgconfig_initrc_exec_t)
  34
  35 type cgconfig_etc_t;
  36 files_config_file(cgconfig_etc_t)
  37
  38 ########################################
  39 #
  40 # cgclear personal policy.
  41 #
  42 allow cgclear_t self:capability { dac_read_search dac_override sys_admin };
  43
  44 kernel_read_system_state(cgclear_t)
  45
  46 domain_setpriority_all_domains(cgclear_t)
  47
  48 fs_manage_cgroup_dirs(cgclear_t)
  49 fs_manage_cgroup_files(cgclear_t)
  50 fs_unmount_cgroup(cgclear_t)
  51
  52 ########################################
  53 #
  54 # cgconfig personal policy.
  55 #
  56
  57 allow cgconfig_t self:capability { dac_override fowner fsetid chown sys_admin sys_tty_config };
  58
  59 allow cgconfig_t cgconfig_etc_t:file read_file_perms;
  60
  61 # search will do.
  62 kernel_list_unlabeled(cgconfig_t)
  63 kernel_read_system_state(cgconfig_t)
  64
  65 # /etc/nsswitch.conf, /etc/passwd
  66 files_read_etc_files(cgconfig_t)
  67
  68 fs_manage_cgroup_dirs(cgconfig_t)
  69 fs_manage_cgroup_files(cgconfig_t)
  70 fs_mount_cgroup(cgconfig_t)
  71 fs_mounton_cgroup(cgconfig_t)
  72 fs_unmount_cgroup(cgconfig_t)
  73
  74 ########################################
  75 #
  76 # cgred personal policy.
  77 #
  78
  79 allow cgred_t self:capability { chown fsetid net_admin sys_admin dac_override };
  80
  81 allow cgred_t self:netlink_socket { write bind create read };
  82 allow cgred_t self:unix_dgram_socket { write create connect };
  83
  84 manage_files_pattern(cgred_t, cgred_log_t, cgred_log_t)
  85 logging_log_filetrans(cgred_t, cgred_log_t, file)
  86
  87 allow cgred_t cgrules_etc_t:file read_file_perms;
  88
  89 manage_files_pattern(cgred_t, cgred_log_t, cgred_log_t)
  90 logging_log_filetrans(cgred_t, cgred_log_t, file)
  91
  92 # rc script creates pid file
  93 manage_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
  94 manage_sock_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
  95 files_pid_filetrans(cgred_t, cgred_var_run_t, { file sock_file })
  96
  97 kernel_read_system_state(cgred_t)
  98
  99 domain_read_all_domains_state(cgred_t)
 100 domain_setpriority_all_domains(cgred_t)
 101
 102 files_getattr_all_files(cgred_t)
 103 files_getattr_all_sockets(cgred_t)
 104 files_read_all_symlinks(cgred_t)
 105 # /etc/group
 106 files_read_etc_files(cgred_t)
 107
 108 fs_write_cgroup_files(cgred_t)
 109
 110 auth_use_nsswitch(cgred_t)
 111
 112 logging_send_syslog_msg(cgred_t)
 113
 114 miscfiles_read_localization(cgred_t)