policy/modules/services/cgroup.te

   1 policy_module(cgroup, 1.0.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type cgclear_t;
   9 type cgclear_exec_t;
  10 init_daemon_domain(cgclear_t, cgclear_exec_t)
  11
  12 type cgred_t;
  13 type cgred_exec_t;
  14 init_daemon_domain(cgred_t, cgred_exec_t)
  15
  16 type cgred_initrc_exec_t;
  17 init_script_file(cgred_initrc_exec_t)
  18
  19 type cgred_var_run_t;
  20 files_pid_file(cgred_var_run_t)
  21
  22 type cgrules_etc_t;
  23 files_config_file(cgrules_etc_t)
  24
  25 type cgconfig_t;
  26 type cgconfig_exec_t;
  27 init_daemon_domain(cgconfig_t, cgconfig_exec_t)
  28
  29 type cgconfig_initrc_exec_t;
  30 init_script_file(cgconfig_initrc_exec_t)
  31
  32 type cgconfig_etc_t;
  33 files_config_file(cgconfig_etc_t)
  34
  35 ########################################
  36 #
  37 # cgclear personal policy.
  38 #
  39
  40 allow cgclear_t self:capability sys_admin;
  41
  42 kernel_read_system_state(cgclear_t)
  43
  44 domain_setpriority_all_domains(cgclear_t)
  45
  46 fs_manage_cgroup_dirs(cgclear_t)
  47 fs_manage_cgroup_files(cgclear_t)
  48 fs_unmount_cgroup(cgclear_t)
  49
  50 ########################################
  51 #
  52 # cgconfig personal policy.
  53 #
  54
  55 allow cgconfig_t self:capability { chown sys_admin };
  56
  57 allow cgconfig_t cgconfig_etc_t:file read_file_perms;
  58
  59 # search will do.
  60 kernel_list_unlabeled(cgconfig_t)
  61 kernel_read_system_state(cgconfig_t)
  62
  63 # /etc/nsswitch.conf, /etc/passwd
  64 files_read_etc_files(cgconfig_t)
  65
  66 fs_manage_cgroup_dirs(cgconfig_t)
  67 fs_manage_cgroup_files(cgconfig_t)
  68 fs_mount_cgroup(cgconfig_t)
  69 fs_mounton_cgroup(cgconfig_t)
  70
  71 ########################################
  72 #
  73 # cgred personal policy.
  74 #
  75
  76 allow cgred_t self:capability { net_admin sys_admin sys_ptrace dac_override };
  77 allow cgred_t self:netlink_socket { write bind create read };
  78 allow cgred_t self:unix_dgram_socket { write create connect };
  79
  80 allow cgred_t cgrules_etc_t:file read_file_perms;
  81
  82 # rc script creates pid file
  83 manage_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
  84 manage_sock_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
  85 files_pid_filetrans(cgred_t, cgred_var_run_t, { file sock_file })
  86
  87 kernel_read_system_state(cgred_t)
  88
  89 domain_read_all_domains_state(cgred_t)
  90 domain_setpriority_all_domains(cgred_t)
  91
  92 files_getattr_all_files(cgred_t)
  93 files_getattr_all_sockets(cgred_t)
  94 files_read_all_symlinks(cgred_t)
  95 # /etc/group
  96 files_read_etc_files(cgred_t)
  97
  98 fs_write_cgroup_files(cgred_t)
  99
 100 logging_send_syslog_msg(cgred_t)
 101
 102 miscfiles_read_localization(cgred_t)