83 lines
2 KiB
Text
83 lines
2 KiB
Text
|
policy_module(jetty, 1.0.0)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
type jetty_t;
|
||
|
|
type jetty_exec_t;
|
||
|
|
init_daemon_domain(jetty_t, jetty_exec_t)
|
||
|
|
|
||
|
|
type jetty_cache_t;
|
||
|
|
files_type(jetty_cache_t)
|
||
|
|
|
||
|
|
type jetty_log_t;
|
||
|
|
logging_log_file(jetty_log_t)
|
||
|
|
|
||
|
|
type jetty_tmp_t;
|
||
|
|
files_tmp_file(jetty_tmp_t)
|
||
|
|
|
||
|
|
type jetty_var_lib_t;
|
||
|
|
files_type(jetty_var_lib_t)
|
||
|
|
|
||
|
|
type jetty_var_run_t;
|
||
|
|
files_pid_file(jetty_var_run_t)
|
||
|
|
|
||
|
|
type jetty_unit_file_t;
|
||
|
|
systemd_unit_file(jetty_unit_file_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# jetty local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow jetty_t self:process execmem;
|
||
|
|
allow jetty_t self:process { signal signull };
|
||
|
|
|
||
|
|
allow jetty_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow jetty_t self:tcp_socket { accept listen };
|
||
|
|
|
||
|
|
manage_dirs_pattern(jetty_t, jetty_cache_t, jetty_cache_t)
|
||
|
|
manage_files_pattern(jetty_t, jetty_cache_t, jetty_cache_t)
|
||
|
|
files_var_filetrans(jetty_t, jetty_cache_t, dir)
|
||
|
|
|
||
|
|
manage_dirs_pattern(jetty_t, jetty_log_t, jetty_log_t)
|
||
|
|
manage_files_pattern(jetty_t, jetty_log_t, jetty_log_t)
|
||
|
|
logging_log_filetrans(jetty_t, jetty_log_t, dir)
|
||
|
|
|
||
|
|
manage_dirs_pattern(jetty_t, jetty_tmp_t, jetty_tmp_t)
|
||
|
|
manage_files_pattern(jetty_t, jetty_tmp_t, jetty_tmp_t)
|
||
|
|
files_tmp_filetrans(jetty_t, jetty_tmp_t, { dir file })
|
||
|
|
allow jetty_t jetty_tmp_t:file map;
|
||
|
|
|
||
|
|
manage_dirs_pattern(jetty_t, jetty_var_lib_t, jetty_var_lib_t)
|
||
|
|
manage_files_pattern(jetty_t, jetty_var_lib_t, jetty_var_lib_t)
|
||
|
|
files_var_lib_filetrans(jetty_t, jetty_var_lib_t, dir)
|
||
|
|
|
||
|
|
manage_dirs_pattern(jetty_t, jetty_var_run_t, jetty_var_run_t)
|
||
|
|
manage_files_pattern(jetty_t, jetty_var_run_t, jetty_var_run_t)
|
||
|
|
files_pid_filetrans(jetty_t, jetty_var_run_t, dir)
|
||
|
|
|
||
|
|
fs_search_cgroup_dirs(jetty_t)
|
||
|
|
fs_read_cgroup_files(jetty_t)
|
||
|
|
|
||
|
|
kernel_read_system_state(jetty_t)
|
||
|
|
kernel_read_network_state(jetty_t)
|
||
|
|
|
||
|
|
corecmd_exec_bin(jetty_t)
|
||
|
|
corecmd_exec_shell(jetty_t)
|
||
|
|
|
||
|
|
corenet_tcp_bind_http_cache_port(jetty_t)
|
||
|
|
|
||
|
|
dev_read_rand(jetty_t)
|
||
|
|
dev_read_sysfs(jetty_t)
|
||
|
|
dev_read_urand(jetty_t)
|
||
|
|
|
||
|
|
auth_use_nsswitch(jetty_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
#allow access to /etc/abrt/plugins/java.conf
|
||
|
|
abrt_read_config(jetty_t)
|
||
|
|
')
|