diff options
author | Hans Ulrich Niedermann <hun@n-dimensional.de> | 2009-07-11 16:25:24 +0200 |
---|---|---|
committer | Hans Ulrich Niedermann <hun@n-dimensional.de> | 2009-07-11 16:25:24 +0200 |
commit | cc07de58baccb0331a78489113ad54c509ea8cfe (patch) | |
tree | 6a767f1701dbd1220ecf57227050d7908c36268f | |
parent | b9faf5c885bdbc1689ed11edb6fcf2009e557a85 (diff) | |
download | gps-devices-package-cc07de58baccb0331a78489113ad54c509ea8cfe.tar.gz gps-devices-package-cc07de58baccb0331a78489113ad54c509ea8cfe.tar.xz gps-devices-package-cc07de58baccb0331a78489113ad54c509ea8cfe.zip |
Add SE policy sources for gpsd
-rw-r--r-- | .gitignore | 1 | ||||
-rw-r--r-- | gpsd-devices.fc | 6 | ||||
-rw-r--r-- | gpsd-devices.if | 54 | ||||
-rw-r--r-- | gpsd-devices.te | 28 |
4 files changed, 89 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b8cdaf8 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +*.pp diff --git a/gpsd-devices.fc b/gpsd-devices.fc new file mode 100644 index 0000000..9cf7c4c --- /dev/null +++ b/gpsd-devices.fc @@ -0,0 +1,6 @@ +# myapp executable will have: +# label: system_u:object_r:myapp_exec_t +# MLS sensitivity: s0 +# MCS categories: <none> + +/usr/sbin/myapp -- gen_context(system_u:object_r:myapp_exec_t,s0) diff --git a/gpsd-devices.if b/gpsd-devices.if new file mode 100644 index 0000000..54d42ae --- /dev/null +++ b/gpsd-devices.if @@ -0,0 +1,54 @@ +## <summary>Myapp example policy</summary> +## <desc> +## <p> +## More descriptive text about myapp. The desc +## tag can also use p, ul, and ol +## html tags for formatting. +## </p> +## <p> +## This policy supports the following myapp features: +## <ul> +## <li>Feature A</li> +## <li>Feature B</li> +## <li>Feature C</li> +## </ul> +## </p> +## </desc> +# + +######################################## +## <summary> +## Execute a domain transition to run myapp. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`myapp_domtrans',` + gen_require(` + type myapp_t, myapp_exec_t; + ') + + domtrans_pattern($1,myapp_exec_t,myapp_t) +') + +######################################## +## <summary> +## Read myapp log files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to read the log files. +## </summary> +## </param> +# +interface(`myapp_read_log',` + gen_require(` + type myapp_log_t; + ') + + logging_search_logs($1) + allow $1 myapp_log_t:file read_file_perms; +') diff --git a/gpsd-devices.te b/gpsd-devices.te new file mode 100644 index 0000000..8238355 --- /dev/null +++ b/gpsd-devices.te @@ -0,0 +1,28 @@ + +policy_module(myapp,1.0.0) + +######################################## +# +# Declarations +# + +type myapp_t; +type myapp_exec_t; +domain_type(myapp_t) +domain_entry_file(myapp_t, myapp_exec_t) + +type myapp_log_t; +logging_log_file(myapp_log_t) + +type myapp_tmp_t; +files_tmp_file(myapp_tmp_t) + +######################################## +# +# Myapp local policy +# + +allow myapp_t myapp_log_t:file { read_file_perms append_file_perms }; + +allow myapp_t myapp_tmp_t:file manage_file_perms; +files_tmp_filetrans(myapp_t,myapp_tmp_t,file) |