policy/modules/services/icecast.te

   1 policy_module(icecast, 1.1.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ##      <p>
  10 ##      Allow icecast to connect to all ports, not just
  11 ##      sound ports.
  12 ##      </p>
  13 ## </desc>
  14 gen_tunable(icecast_connect_any, false)
  15
  16 type icecast_t;
  17 type icecast_exec_t;
  18 init_daemon_domain(icecast_t, icecast_exec_t)
  19
  20 type icecast_initrc_exec_t;
  21 init_script_file(icecast_initrc_exec_t)
  22
  23 type icecast_var_run_t;
  24 files_pid_file(icecast_var_run_t)
  25
  26 type icecast_log_t;
  27 logging_log_file(icecast_log_t)
  28
  29 ########################################
  30 #
  31 # icecast local policy
  32 #
  33
  34 allow icecast_t self:capability { dac_override setgid setuid sys_nice };
  35 allow icecast_t self:process { getsched fork setsched signal };
  36 allow icecast_t self:fifo_file rw_fifo_file_perms;
  37 allow icecast_t self:unix_stream_socket create_stream_socket_perms;
  38 allow icecast_t self:tcp_socket create_stream_socket_perms;
  39
  40 manage_dirs_pattern(icecast_t, icecast_log_t, icecast_log_t)
  41 manage_files_pattern(icecast_t, icecast_log_t, icecast_log_t)
  42 logging_log_filetrans(icecast_t, icecast_log_t, { file dir })
  43
  44 manage_dirs_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)
  45 manage_files_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)
  46 files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir })
  47
  48 kernel_read_system_state(icecast_t)
  49
  50 corenet_tcp_bind_soundd_port(icecast_t)
  51 corenet_tcp_connect_soundd_port(icecast_t)
  52
  53 tunable_policy(`icecast_connect_any',`
  54         corenet_tcp_connect_all_ports(icecast_t)
  55         corenet_tcp_bind_all_ports(icecast_t)
  56         corenet_sendrecv_all_client_packets(icecast_t)
  57 ')
  58
  59 # Init script handling
  60 domain_use_interactive_fds(icecast_t)
  61
  62 files_read_etc_files(icecast_t)
  63
  64 auth_use_nsswitch(icecast_t)
  65
  66 miscfiles_read_localization(icecast_t)
  67
  68 sysnet_dns_name_resolve(icecast_t)
  69
  70 optional_policy(`
  71         apache_read_sys_content(icecast_t)
  72 ')
  73
  74 optional_policy(`
  75         rtkit_scheduled(icecast_t)
  76 ')