blob: 10a0e54e1b055699a96be6b8cd52515dfd00d9bc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
policy_module(aptcacher)
########################################
#
# Declarations
#
attribute_role acngtool_roles;
type acngtool_t;
type acngtool_exec_t;
application_domain(acngtool_t, acngtool_exec_t)
role acngtool_roles types acngtool_t;
type aptcacher_t;
type aptcacher_exec_t;
init_daemon_domain(aptcacher_t, aptcacher_exec_t)
type aptcacher_conf_t;
files_config_file(aptcacher_conf_t)
type aptcacher_cache_t;
files_type(aptcacher_cache_t)
type aptcacher_lib_t;
files_type(aptcacher_lib_t)
type aptcacher_log_t;
logging_log_file(aptcacher_log_t)
type aptcacher_runtime_t;
files_runtime_file(aptcacher_runtime_t)
########################################
#
# Local policy
#
allow aptcacher_t self:process signal;
allow aptcacher_t self:fifo_file rw_inherited_fifo_file_perms;
allow aptcacher_t self:tcp_socket create_stream_socket_perms;
allow aptcacher_t self:unix_dgram_socket create_socket_perms;
allow aptcacher_t self:unix_stream_socket create_stream_socket_perms;
can_exec(aptcacher_t, acngtool_exec_t)
allow aptcacher_t aptcacher_conf_t:dir list_dir_perms;
allow aptcacher_t aptcacher_conf_t:file mmap_read_file_perms;
# /etc/apt-cacher-ng/ contains symlinks that point to /var/lib/apt-cacher-ng/
allow aptcacher_t aptcacher_conf_t:lnk_file read_lnk_file_perms;
allow aptcacher_t aptcacher_cache_t:dir manage_dir_perms;
allow aptcacher_t aptcacher_cache_t:file mmap_manage_file_perms;
allow aptcacher_t aptcacher_cache_t:lnk_file manage_lnk_file_perms;
allow aptcacher_t aptcacher_lib_t:file map;
files_search_var_lib(aptcacher_t)
read_files_pattern(aptcacher_t, aptcacher_lib_t, aptcacher_lib_t)
allow aptcacher_t aptcacher_log_t:file map;
logging_search_logs(aptcacher_t)
manage_files_pattern(aptcacher_t, aptcacher_log_t, aptcacher_log_t)
manage_sock_files_pattern(aptcacher_t, aptcacher_runtime_t, aptcacher_runtime_t)
kernel_read_vm_overcommit_sysctl(aptcacher_t)
# Calls system()
corecmd_exec_shell(aptcacher_t)
corenet_tcp_bind_aptcacher_port(aptcacher_t)
corenet_tcp_bind_generic_node(aptcacher_t)
corenet_tcp_connect_http_port(aptcacher_t)
auth_use_nsswitch(aptcacher_t)
files_read_etc_files(aptcacher_t)
# Uses sd_notify() to inform systemd it has properly started
init_dgram_send(aptcacher_t)
miscfiles_read_generic_certs(aptcacher_t)
# Reads /usr/share/zoneinfo/
miscfiles_read_localization(aptcacher_t)
# For some reasons it's trying to mmap /etc/hosts.deny
sysnet_mmap_config_files(aptcacher_t)
#######################################
#
# acngtool local policy
#
allow acngtool_t self:tcp_socket create_stream_socket_perms;
allow acngtool_t self:unix_stream_socket create_socket_perms;
allow acngtool_t aptcacher_conf_t:dir list_dir_perms;
allow acngtool_t aptcacher_conf_t:file mmap_read_file_perms;
aptcacher_stream_connect(acngtool_t)
corenet_tcp_connect_aptcacher_port(acngtool_t)
auth_use_nsswitch(acngtool_t)
# For some reasons it's trying to mmap /etc/hosts.deny
sysnet_mmap_config_files(acngtool_t)
optional_policy(`
cron_system_entry(acngtool_t, acngtool_exec_t)
')
|
GitWeb