ptunnel-ng.te 2.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960
  1. module ptunnel-ng 1.0;
  2. require {
  3. type local_login_t;
  4. type file_context_t;
  5. type unconfined_t;
  6. type lvm_t;
  7. type bin_t;
  8. type gpmctl_t;
  9. type tracefs_t;
  10. type dpkg_script_t;
  11. type xconsole_device_t;
  12. type modules_object_t;
  13. type initrc_var_run_t;
  14. type var_run_t;
  15. type debugfs_t;
  16. type udev_var_run_t;
  17. type bootloader_t;
  18. type tmp_t;
  19. type fsadm_run_t;
  20. class file { create execmod execute execute_no_trans getattr link open read rename setattr unlink write };
  21. class capability sys_module;
  22. class dir { add_name getattr remove_name search write };
  23. class fifo_file getattr;
  24. class sock_file getattr;
  25. class system module_load;
  26. }
  27. #============= bootloader_t ==============
  28. allow bootloader_t debugfs_t:dir search;
  29. allow bootloader_t file_context_t:dir search;
  30. allow bootloader_t file_context_t:file { getattr open read };
  31. allow bootloader_t fsadm_run_t:dir { add_name getattr remove_name write };
  32. allow bootloader_t fsadm_run_t:file { create getattr link open read rename setattr unlink write };
  33. allow bootloader_t gpmctl_t:sock_file getattr;
  34. allow bootloader_t modules_object_t:system module_load;
  35. allow bootloader_t self:capability sys_module;
  36. allow bootloader_t tmp_t:file { execute execute_no_trans getattr open read };
  37. allow bootloader_t tracefs_t:dir search;
  38. allow bootloader_t udev_var_run_t:file { getattr open read };
  39. allow bootloader_t xconsole_device_t:fifo_file getattr;
  40. #============= dpkg_script_t ==============
  41. #!!!! This avc can be allowed using the boolean 'allow_execmod'
  42. allow dpkg_script_t bin_t:file execmod;
  43. #============= local_login_t ==============
  44. allow local_login_t initrc_var_run_t:file unlink;
  45. allow local_login_t var_run_t:dir { add_name remove_name write };
  46. allow local_login_t var_run_t:file { getattr open read rename unlink };
  47. #============= lvm_t ==============
  48. allow lvm_t initrc_var_run_t:dir { add_name getattr write };
  49. #============= unconfined_t ==============
  50. #!!!! This avc can be allowed using the boolean 'allow_execmod'
  51. allow unconfined_t bin_t:file execmod;