From: Ralf Ertzinger Date: Fri, 14 Nov 2014 15:32:56 +0000 (+0000) Subject: Add rules for tesseract X-Git-Url: https://git.camperquake.de/gitweb.cgi?p=selinux.git;a=commitdiff_plain;h=0e7657673c0fa43bd215b837243fac43800ed723 Add rules for tesseract --- diff --git a/tesseract/tesseract.fc b/tesseract/tesseract.fc new file mode 100644 index 0000000..0ac201e --- /dev/null +++ b/tesseract/tesseract.fc @@ -0,0 +1,2 @@ +/etank/games/tesseract/tesseract/bin_unix/linux(_64)?_(server|client) -- gen_context(system_u:object_r:tesseract_exec_t,s0) +/etank/games/tesseract/tesseract(/.*)? gen_context(system_u:object_r:tesseract_ro_t,s0) diff --git a/tesseract/tesseract.if b/tesseract/tesseract.if new file mode 100644 index 0000000..3eb6a30 --- /dev/null +++ b/tesseract/tesseract.if @@ -0,0 +1 @@ +## diff --git a/tesseract/tesseract.te b/tesseract/tesseract.te new file mode 100644 index 0000000..1de962f --- /dev/null +++ b/tesseract/tesseract.te @@ -0,0 +1,32 @@ +policy_module(tesseract, 0.1.0) + +# File context for the executable process +type tesseract_t; +type tesseract_exec_t; + +type tesseract_rw_t; +files_type(tesseract_rw_t) + +type tesseract_ro_t; +files_type(tesseract_ro_t) + +#type tesseract_tmp_t; +#files_tmp_file(tesseract_tmp_t) + +init_daemon_domain(tesseract_t, tesseract_exec_t) + +corenet_udp_sendrecv_generic_port(tesseract_t) +corenet_udp_bind_generic_port(tesseract_t) +corenet_udp_bind_generic_node(tesseract_t) + +allow tesseract_t tesseract_ro_t:dir list_dir_perms; +allow tesseract_t tesseract_ro_t:file read_file_perms; +#allow tesseract_t tesseract_tmp_t:file manage_file_perms; +#allow tesseract_t tesseract_tmp_t:dir manage_dir_perms; + +#manage_files_pattern(tesseract_t, tesseract_rw_t, tesseract_rw_t) +#manage_dirs_pattern(tesseract_t, tesseract_rw_t, tesseract_rw_t) +#setattr_files_pattern(tesseract_t, tesseract_rw_t, tesseract_rw_t) + +sysnet_dns_name_resolve(tesseract_t) +#files_tmp_filetrans(tesseract_t, tesseract_tmp_t, { file dir})