refpolicy/policy/modules/services/dbskk.te

   1
   2 policy_module(dbskk,1.1.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type dbskkd_t;
  10 type dbskkd_exec_t;
  11 inetd_service_domain(dbskkd_t,dbskkd_exec_t)
  12 role system_r types dbskkd_t;
  13
  14 type dbskkd_tmp_t;
  15 files_tmp_file(dbskkd_tmp_t)
  16
  17 type dbskkd_var_run_t;
  18 files_pid_file(dbskkd_var_run_t)
  19
  20 ########################################
  21 #
  22 # Local policy
  23 #
  24
  25 allow dbskkd_t self:process signal_perms;
  26 allow dbskkd_t self:fifo_file rw_file_perms;
  27 allow dbskkd_t self:tcp_socket connected_stream_socket_perms;
  28 allow dbskkd_t self:udp_socket create_socket_perms;
  29
  30 # for identd
  31 # cjp: this should probably only be inetd_child rules?
  32 allow dbskkd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
  33 allow dbskkd_t self:capability { setuid setgid };
  34 files_search_home(dbskkd_t)
  35 optional_policy(`
  36         kerberos_use(dbskkd_t)
  37 ')
  38 #end for identd
  39
  40 allow dbskkd_t dbskkd_tmp_t:dir create_dir_perms;
  41 allow dbskkd_t dbskkd_tmp_t:file create_file_perms;
  42 files_tmp_filetrans(dbskkd_t, dbskkd_tmp_t, { file dir })
  43
  44 allow dbskkd_t dbskkd_var_run_t:file create_file_perms;
  45 allow dbskkd_t dbskkd_var_run_t:dir rw_dir_perms;
  46 files_pid_filetrans(dbskkd_t,dbskkd_var_run_t,file)
  47
  48 kernel_read_kernel_sysctls(dbskkd_t)
  49 kernel_read_system_state(dbskkd_t)
  50 kernel_read_network_state(dbskkd_t)
  51
  52 corenet_tcp_sendrecv_all_if(dbskkd_t)
  53 corenet_udp_sendrecv_all_if(dbskkd_t)
  54 corenet_raw_sendrecv_all_if(dbskkd_t)
  55 corenet_tcp_sendrecv_all_nodes(dbskkd_t)
  56 corenet_udp_sendrecv_all_nodes(dbskkd_t)
  57 corenet_raw_sendrecv_all_nodes(dbskkd_t)
  58 corenet_tcp_sendrecv_all_ports(dbskkd_t)
  59 corenet_udp_sendrecv_all_ports(dbskkd_t)
  60 corenet_non_ipsec_sendrecv(dbskkd_t)
  61 corenet_tcp_bind_all_nodes(dbskkd_t)
  62 corenet_udp_bind_all_nodes(dbskkd_t)
  63
  64 dev_read_urand(dbskkd_t)
  65
  66 fs_getattr_xattr_fs(dbskkd_t)
  67
  68 files_read_etc_files(dbskkd_t)
  69
  70 libs_use_ld_so(dbskkd_t)
  71 libs_use_shared_libs(dbskkd_t)
  72
  73 logging_send_syslog_msg(dbskkd_t)
  74
  75 miscfiles_read_localization(dbskkd_t)
  76
  77 sysnet_read_config(dbskkd_t)
  78
  79 optional_policy(`
  80         nis_use_ypbind(dbskkd_t)
  81 ')
  82
  83 optional_policy(`
  84         nscd_socket_use(dbskkd_t)
  85 ')