policy/modules/services/pxe.te

   1
   2 policy_module(pxe,1.1.0)
   3
   4 # cjp: policy seems incomplete
   5
   6 ########################################
   7 #
   8 # Declarations
   9 #
  10
  11 type pxe_t;
  12 type pxe_exec_t;
  13 init_daemon_domain(pxe_t,pxe_exec_t)
  14
  15 type pxe_log_t;
  16 logging_log_file(pxe_log_t)
  17
  18 type pxe_var_run_t;
  19 files_pid_file(pxe_var_run_t)
  20
  21 ########################################
  22 #
  23 # Local policy
  24 #
  25
  26 allow pxe_t self:capability { chown setgid setuid };
  27 dontaudit pxe_t self:capability sys_tty_config;
  28 allow pxe_t self:process signal_perms;
  29
  30 allow pxe_t pxe_log_t:file manage_file_perms;
  31 logging_log_filetrans(pxe_t,pxe_log_t,file)
  32
  33 manage_files_pattern(pxe_t,pxe_var_run_t,pxe_var_run_t)
  34 files_pid_filetrans(pxe_t,pxe_var_run_t,file)
  35
  36 kernel_read_kernel_sysctls(pxe_t)
  37 kernel_list_proc(pxe_t)
  38 kernel_read_proc_symlinks(pxe_t)
  39
  40 corenet_udp_bind_pxe_port(pxe_t)
  41
  42 dev_read_sysfs(pxe_t)
  43
  44 domain_use_interactive_fds(pxe_t)
  45
  46 files_read_etc_files(pxe_t)
  47
  48 fs_getattr_all_fs(pxe_t)
  49 fs_search_auto_mountpoints(pxe_t)
  50
  51 libs_use_ld_so(pxe_t)
  52 libs_use_shared_libs(pxe_t)
  53
  54 logging_send_syslog_msg(pxe_t)
  55
  56 miscfiles_read_localization(pxe_t)
  57
  58 userdom_dontaudit_use_unpriv_user_fds(pxe_t)
  59 userdom_dontaudit_search_sysadm_home_dirs(pxe_t)
  60
  61 optional_policy(`
  62         seutil_sigchld_newrole(pxe_t)
  63 ')
  64
  65 optional_policy(`
  66         udev_read_db(pxe_t)
  67 ')