| 1 | policy_module(arm4,1.0.0) |
|---|
| 2 | |
|---|
| 3 | ######################################## |
|---|
| 4 | # |
|---|
| 5 | # Declarations |
|---|
| 6 | # |
|---|
| 7 | |
|---|
| 8 | type arm4_t; |
|---|
| 9 | type arm4_exec_t; |
|---|
| 10 | init_daemon_domain(arm4_t, arm4_exec_t) |
|---|
| 11 | |
|---|
| 12 | type arm4_script_exec_t; |
|---|
| 13 | init_script_file(arm4_script_exec_t) |
|---|
| 14 | |
|---|
| 15 | type arm4_tmp_t; |
|---|
| 16 | files_tmp_file(arm4_tmp_t) |
|---|
| 17 | |
|---|
| 18 | type arm4_var_run_t; |
|---|
| 19 | files_pid_file(arm4_var_run_t) |
|---|
| 20 | |
|---|
| 21 | type arm4_var_lib_t; |
|---|
| 22 | files_type(arm4_var_lib_t) |
|---|
| 23 | |
|---|
| 24 | ######################################## |
|---|
| 25 | # |
|---|
| 26 | # arm4 local policy |
|---|
| 27 | # |
|---|
| 28 | |
|---|
| 29 | # Init script handling |
|---|
| 30 | domain_use_interactive_fds(arm4_t) |
|---|
| 31 | |
|---|
| 32 | # internal communication is often done using fifo and unix sockets. |
|---|
| 33 | allow arm4_t self:fifo_file rw_file_perms; |
|---|
| 34 | allow arm4_t self:unix_stream_socket create_stream_socket_perms; |
|---|
| 35 | allow arm4_t self:msgq { create unix_read unix_write associate enqueue read write }; |
|---|
| 36 | allow arm4_t self:shm { create unix_read unix_write associate read write }; |
|---|
| 37 | allow arm4_t self:sem { create unix_read unix_write associate read write }; |
|---|
| 38 | allow arm4_t self:process { signal signull }; |
|---|
| 39 | #allow arm4_t proc_t:file { read getattr }; |
|---|
| 40 | #allow arm4_t tmpfs_t:file { read write }; |
|---|
| 41 | |
|---|
| 42 | # Capabilities required by the daemon |
|---|
| 43 | allow arm4_t self:capability { chown setgid setuid dac_override }; |
|---|
| 44 | |
|---|
| 45 | files_read_etc_files(arm4_t) |
|---|
| 46 | |
|---|
| 47 | libs_use_ld_so(arm4_t) |
|---|
| 48 | libs_use_shared_libs(arm4_t) |
|---|
| 49 | |
|---|
| 50 | miscfiles_read_localization(arm4_t) |
|---|
| 51 | |
|---|
| 52 | |
|---|
| 53 | allow arm4_t arm4_tmp_t:file { manage_file_perms read write }; |
|---|
| 54 | allow arm4_t arm4_tmp_t:dir create_dir_perms; |
|---|
| 55 | files_tmp_filetrans(arm4_t,arm4_tmp_t, { file dir }) |
|---|
| 56 | |
|---|
| 57 | manage_dirs_pattern(arm4_t, arm4_var_run_t, arm4_var_run_t) |
|---|
| 58 | manage_files_pattern(arm4_t, arm4_var_run_t, arm4_var_run_t) |
|---|
| 59 | files_pid_filetrans(arm4_t,arm4_var_run_t, { file dir }) |
|---|
| 60 | |
|---|
| 61 | manage_dirs_pattern(arm4_t, arm4_var_lib_t, arm4_var_lib_t) |
|---|
| 62 | manage_files_pattern(arm4_t, arm4_var_lib_t, arm4_var_lib_t) |
|---|
| 63 | files_var_lib_filetrans(arm4_t, arm4_var_lib_t, { file dir } ) |
|---|
| 64 | |
|---|
| 65 | logging_send_syslog_msg(arm4_t) |
|---|
