← Back to branch summary

~ubuntu-branches/ubuntu/natty/refpolicy-ubuntu/natty

« back to all changes in this revision

Viewing changes to policy/modules/admin/shorewall.te

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2010-04-22 17:10:43 UTC
  • mfrom: (1.1.2 upstream)
  • Revision ID: james.westby@ubuntu.com-20100422171043-khrw2m21gser7icb
Tags: 0.2.20091117-0ubuntu1
https://launchpad.net/bugs/568744
* New upstream release, converted to source format 3.
* Updated Ubuntu-specific patches thanks to Steve Lawrence (LP: #568744).
* Extracted Makefile change to debian/patches/bashisms.patch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
policy/modules/admin/shorewall.te
 
1
 
 
2
policy_module(shorewall, 1.0.0)
 
3
 
 
4
########################################
 
5
#
 
6
# Declarations
 
7
#
 
8
 
 
9
type shorewall_t;
 
10
type shorewall_exec_t;
 
11
init_daemon_domain(shorewall_t, shorewall_exec_t)
 
12
 
 
13
type shorewall_initrc_exec_t;
 
14
init_script_file(shorewall_initrc_exec_t)
 
15
 
 
16
# etc files
 
17
type shorewall_etc_t;
 
18
files_config_file(shorewall_etc_t)
 
19
 
 
20
# lock files
 
21
type shorewall_lock_t;
 
22
files_lock_file(shorewall_lock_t)
 
23
 
 
24
# tmp files
 
25
type shorewall_tmp_t;
 
26
files_tmp_file(shorewall_tmp_t)
 
27
 
 
28
# var/lib files
 
29
type shorewall_var_lib_t;
 
30
files_type(shorewall_var_lib_t)
 
31
 
 
32
########################################
 
33
#
 
34
# shorewall local policy
 
35
#
 
36
 
 
37
allow shorewall_t self:capability { dac_override net_admin net_raw setuid setgid sys_nice sys_ptrace };
 
38
dontaudit shorewall_t self:capability sys_tty_config;
 
39
allow shorewall_t self:fifo_file rw_fifo_file_perms;
 
40
 
 
41
read_files_pattern(shorewall_t, shorewall_etc_t, shorewall_etc_t)
 
42
list_dirs_pattern(shorewall_t, shorewall_etc_t, shorewall_etc_t)
 
43
 
 
44
manage_files_pattern(shorewall_t, shorewall_lock_t, shorewall_lock_t)
 
45
files_lock_filetrans(shorewall_t, shorewall_lock_t, file)
 
46
 
 
47
exec_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
 
48
manage_dirs_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
 
49
manage_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t)
 
50
files_var_lib_filetrans(shorewall_t, shorewall_var_lib_t, { dir file })
 
51
 
 
52
manage_dirs_pattern(shorewall_t, shorewall_tmp_t, shorewall_tmp_t)
 
53
manage_files_pattern(shorewall_t, shorewall_tmp_t, shorewall_tmp_t)
 
54
files_tmp_filetrans(shorewall_t, shorewall_tmp_t, { file dir })
 
55
 
 
56
kernel_read_kernel_sysctls(shorewall_t)
 
57
kernel_read_network_state(shorewall_t)
 
58
kernel_read_system_state(shorewall_t)
 
59
kernel_rw_net_sysctls(shorewall_t)
 
60
 
 
61
corecmd_exec_bin(shorewall_t)
 
62
corecmd_exec_shell(shorewall_t)
 
63
 
 
64
dev_read_urand(shorewall_t)
 
65
 
 
66
domain_read_all_domains_state(shorewall_t)
 
67
 
 
68
files_getattr_kernel_modules(shorewall_t)
 
69
files_read_etc_files(shorewall_t)
 
70
files_read_usr_files(shorewall_t)
 
71
files_search_kernel_modules(shorewall_t)
 
72
 
 
73
fs_getattr_all_fs(shorewall_t)
 
74
 
 
75
init_rw_utmp(shorewall_t)
 
76
 
 
77
logging_send_syslog_msg(shorewall_t)
 
78
 
 
79
miscfiles_read_localization(shorewall_t)
 
80
 
 
81
sysnet_domtrans_ifconfig(shorewall_t)
 
82
 
 
83
optional_policy(`
 
84
        iptables_domtrans(shorewall_t)
 
85
')
 
86
 
 
87
optional_policy(`
 
88
        modutils_domtrans_insmod(shorewall_t)
 
89
')
 
90
 
 
91
optional_policy(`
 
92
        ulogd_search_log(shorewall_t)
 
93
')