diff options
Diffstat (limited to 'policy/modules/apps/usernetctl.te')
| -rw-r--r-- | policy/modules/apps/usernetctl.te | 78 |
1 files changed, 78 insertions, 0 deletions
diff --git a/policy/modules/apps/usernetctl.te b/policy/modules/apps/usernetctl.te new file mode 100644 index 000000000..4ef6f9b22 --- /dev/null +++ b/policy/modules/apps/usernetctl.te @@ -0,0 +1,78 @@ +policy_module(usernetctl, 1.8.0) + +######################################## +# +# Declarations +# + +attribute_role usernetctl_roles; + +type usernetctl_t; +type usernetctl_exec_t; +application_domain(usernetctl_t, usernetctl_exec_t) +domain_interactive_fd(usernetctl_t) +role usernetctl_roles types usernetctl_t; + +######################################## +# +# Local policy +# + +allow usernetctl_t self:capability { dac_override setgid setuid }; +allow usernetctl_t self:process { transition signal_perms getsched setsched getsession getpgid setpgid getcap setcap share getattr noatsecure siginh rlimitinh dyntransition setkeycreate setsockcreate getrlimit }; +allow usernetctl_t self:fd use; +allow usernetctl_t self:fifo_file rw_fifo_file_perms; +allow usernetctl_t self:unix_dgram_socket sendto; +allow usernetctl_t self:unix_stream_socket { accept connectto listen }; + +can_exec(usernetctl_t, usernetctl_exec_t) + +kernel_read_system_state(usernetctl_t) +kernel_read_kernel_sysctls(usernetctl_t) + +corecmd_list_bin(usernetctl_t) +corecmd_exec_bin(usernetctl_t) +corecmd_exec_shell(usernetctl_t) + +domain_dontaudit_read_all_domains_state(usernetctl_t) + +files_exec_etc_files(usernetctl_t) +files_read_etc_runtime_files(usernetctl_t) +files_list_pids(usernetctl_t) +files_list_home(usernetctl_t) +files_read_usr_files(usernetctl_t) + +fs_search_auto_mountpoints(usernetctl_t) + +auth_use_nsswitch(usernetctl_t) + +logging_send_syslog_msg(usernetctl_t) + +miscfiles_read_localization(usernetctl_t) + +seutil_read_config(usernetctl_t) + +sysnet_run_ifconfig(usernetctl_t, usernetctl_roles) +sysnet_run_dhcpc(usernetctl_t, usernetctl_roles) + +userdom_use_user_terminals(usernetctl_t) + +optional_policy(` + consoletype_run(usernetctl_t, usernetctl_roles) +') + +optional_policy(` + hostname_exec(usernetctl_t) +') + +optional_policy(` + iptables_run(usernetctl_t, usernetctl_roles) +') + +optional_policy(` + modutils_run(usernetctl_t, usernetctl_roles) +') + +optional_policy(` + ppp_run(usernetctl_t, usernetctl_roles) +') |