1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
policy_module(dnsmasq, 1.17.1)
########################################
#
# Declarations
#
type dnsmasq_t;
type dnsmasq_exec_t;
init_daemon_domain(dnsmasq_t, dnsmasq_exec_t)
type dnsmasq_initrc_exec_t;
init_script_file(dnsmasq_initrc_exec_t)
type dnsmasq_etc_t;
files_config_file(dnsmasq_etc_t)
type dnsmasq_lease_t;
files_type(dnsmasq_lease_t)
type dnsmasq_unit_t;
init_unit_file(dnsmasq_unit_t)
type dnsmasq_var_log_t;
logging_log_file(dnsmasq_var_log_t)
type dnsmasq_var_run_t;
files_pid_file(dnsmasq_var_run_t)
########################################
#
# Local policy
#
allow dnsmasq_t self:capability { chown dac_override net_admin net_raw setgid setuid };
dontaudit dnsmasq_t self:capability sys_tty_config;
allow dnsmasq_t self:process { getcap setcap signal_perms };
allow dnsmasq_t self:fifo_file rw_fifo_file_perms;
allow dnsmasq_t self:tcp_socket { accept listen };
allow dnsmasq_t self:packet_socket create_socket_perms;
allow dnsmasq_t self:rawip_socket create_socket_perms;
allow dnsmasq_t dnsmasq_etc_t:dir list_dir_perms;
allow dnsmasq_t dnsmasq_etc_t:file read_file_perms;
manage_files_pattern(dnsmasq_t, dnsmasq_lease_t, dnsmasq_lease_t)
files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file)
allow dnsmasq_t dnsmasq_var_log_t:file append_file_perms;
allow dnsmasq_t dnsmasq_var_log_t:file create_file_perms;
allow dnsmasq_t dnsmasq_var_log_t:file setattr_file_perms;
logging_log_filetrans(dnsmasq_t, dnsmasq_var_log_t, file)
manage_dirs_pattern(dnsmasq_t, dnsmasq_var_run_t, dnsmasq_var_run_t)
manage_files_pattern(dnsmasq_t, dnsmasq_var_run_t, dnsmasq_var_run_t)
files_pid_filetrans(dnsmasq_t, dnsmasq_var_run_t, { dir file })
kernel_read_kernel_sysctls(dnsmasq_t)
kernel_read_net_sysctls(dnsmasq_t)
kernel_read_network_state(dnsmasq_t)
kernel_read_system_state(dnsmasq_t)
kernel_request_load_module(dnsmasq_t)
corecmd_exec_shell(dnsmasq_t)
corenet_all_recvfrom_unlabeled(dnsmasq_t)
corenet_all_recvfrom_netlabel(dnsmasq_t)
corenet_tcp_sendrecv_generic_if(dnsmasq_t)
corenet_udp_sendrecv_generic_if(dnsmasq_t)
corenet_raw_sendrecv_generic_if(dnsmasq_t)
corenet_tcp_sendrecv_generic_node(dnsmasq_t)
corenet_udp_sendrecv_generic_node(dnsmasq_t)
corenet_raw_sendrecv_generic_node(dnsmasq_t)
corenet_tcp_sendrecv_all_ports(dnsmasq_t)
corenet_udp_sendrecv_all_ports(dnsmasq_t)
corenet_tcp_bind_generic_node(dnsmasq_t)
corenet_udp_bind_generic_node(dnsmasq_t)
corenet_sendrecv_dns_server_packets(dnsmasq_t)
corenet_tcp_bind_dns_port(dnsmasq_t)
corenet_sendrecv_dhcpd_server_packets(dnsmasq_t)
corenet_udp_bind_all_ports(dnsmasq_t)
dev_read_sysfs(dnsmasq_t)
dev_read_urand(dnsmasq_t)
domain_use_interactive_fds(dnsmasq_t)
files_read_etc_runtime_files(dnsmasq_t)
fs_getattr_all_fs(dnsmasq_t)
fs_search_auto_mountpoints(dnsmasq_t)
auth_use_nsswitch(dnsmasq_t)
logging_send_syslog_msg(dnsmasq_t)
miscfiles_read_localization(dnsmasq_t)
userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t)
userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
optional_policy(`
cobbler_read_lib_files(dnsmasq_t)
')
optional_policy(`
dbus_connect_system_bus(dnsmasq_t)
dbus_system_bus_client(dnsmasq_t)
')
optional_policy(`
networkmanager_read_pid_files(dnsmasq_t)
')
optional_policy(`
ppp_read_pid_files(dnsmasq_t)
')
optional_policy(`
seutil_sigchld_newrole(dnsmasq_t)
')
optional_policy(`
tftp_read_content(dnsmasq_t)
')
optional_policy(`
udev_read_db(dnsmasq_t)
')
optional_policy(`
virt_manage_lib_files(dnsmasq_t)
virt_read_pid_files(dnsmasq_t)
virt_pid_filetrans(dnsmasq_t, dnsmasq_var_run_t, { dir file })
virt_domtrans_leaseshelper(dnsmasq_t)
')
|
GitWeb