refpolicy/policy/modules/services/tcpd.te

   1
   2 policy_module(tcpd,1.0.1)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8 type tcpd_t;
   9 type tcpd_exec_t;
  10 inetd_tcp_service_domain(tcpd_t,tcpd_exec_t)
  11 role system_r types tcpd_t;
  12
  13 type tcpd_tmp_t;
  14 files_tmp_file(tcpd_tmp_t)
  15
  16 ########################################
  17 #
  18 # Local policy
  19 #
  20 allow tcpd_t self:tcp_socket create_stream_socket_perms;
  21
  22 allow tcpd_t tcpd_tmp_t:dir create_dir_perms;
  23 allow tcpd_t tcpd_tmp_t:file create_file_perms;
  24 files_tmp_filetrans(tcpd_t, tcpd_tmp_t, { file dir })
  25
  26 corenet_raw_sendrecv_all_if(tcpd_t)
  27 corenet_tcp_sendrecv_all_if(tcpd_t)
  28 corenet_raw_sendrecv_all_nodes(tcpd_t)
  29 corenet_tcp_sendrecv_all_nodes(tcpd_t)
  30 corenet_tcp_sendrecv_all_ports(tcpd_t)
  31 corenet_non_ipsec_sendrecv(tcpd_t)
  32 corenet_tcp_bind_all_nodes(tcpd_t)
  33
  34 fs_getattr_xattr_fs(tcpd_t)
  35
  36 # Run other daemons in the inetd child domain.
  37 corecmd_search_bin(tcpd_t)
  38 corecmd_search_sbin(tcpd_t)
  39
  40 files_read_etc_files(tcpd_t)
  41 # no good reason for files_dontaudit_search_var, probably nscd
  42 files_dontaudit_search_var(tcpd_t)
  43
  44 libs_use_ld_so(tcpd_t)
  45 libs_use_shared_libs(tcpd_t)
  46
  47 logging_send_syslog_msg(tcpd_t)
  48
  49 miscfiles_read_localization(tcpd_t)
  50
  51 sysnet_read_config(tcpd_t)
  52
  53 inetd_domtrans_child(tcpd_t)
  54
  55 optional_policy(`
  56         finger_domtrans(tcpd_t)
  57 ')
  58
  59 optional_policy(`
  60         nis_use_ypbind(tcpd_t)
  61 ')
  62
  63 optional_policy(`
  64         portmap_udp_send(tcpd_t)
  65 ')
  66
  67 optional_policy(`
  68         rlogin_domtrans(tcpd_t)
  69 ')
  70
  71 optional_policy(`
  72         rshd_domtrans(tcpd_t)
  73 ')
  74
  75 optional_policy(`
  76         uwimap_domtrans(tcpd_t)
  77 ')