37 lines
961 B
Text
37 lines
961 B
Text
policy_module(test_policy,1.0.0)
|
|
|
|
type test_domain_t;
|
|
domain_type(test_domain_t)
|
|
|
|
corecmd_bin_entry_type(test_domain_t)
|
|
kernel_read_all_sysctls(test_domain_t)
|
|
kernel_read_security_state(test_domain_t)
|
|
fs_read_binfmt_misc(test_domain_t)
|
|
fs_search_auto_mountpoints(test_domain_t)
|
|
|
|
# No interface for this in policy:
|
|
require {
|
|
type binfmt_misc_fs_t;
|
|
}
|
|
list_dirs_pattern(test_domain_t, binfmt_misc_fs_t, binfmt_misc_fs_t)
|
|
|
|
# Some BPF sysctls can only be read with CAP_SYS_ADMIN, so we need to silence
|
|
# it.
|
|
dontaudit test_domain_t self:capability sys_admin;
|
|
|
|
require {
|
|
type TEST_TYPE;
|
|
role TEST_ROLE;
|
|
}
|
|
allow TEST_TYPE test_domain_t:process transition;
|
|
role TEST_ROLE types test_domain_t;
|
|
|
|
allow test_domain_t TEST_TYPE:fd use;
|
|
allow test_domain_t TEST_TYPE:fifo_file rw_inherited_fifo_file_perms;
|
|
allow test_domain_t TEST_TYPE:process { sigchld };
|
|
|
|
files_search_tmp(test_domain_t)
|
|
|
|
term_use_all_terms(test_domain_t)
|
|
|
|
userdom_search_user_tmp_dirs(test_domain_t)
|