Oreon-Lime-R2/selinux-policy/selinux-policy-d9f4a2b/selinux-policy-d9f4a2bbeb91fd95d0c35a90936efb9ea99d2455/policy/modules/contrib/keepalived.te

160 lines
4.9 KiB
Text
Raw Permalink Normal View History

policy_module(keepalived, 1.0.0)
########################################
#
# Declarations
#
## <desc>
## <p>
## Determine whether keepalived can
## connect to all TCP ports.
## </p>
## </desc>
gen_tunable(keepalived_connect_any, false)
type keepalived_t;
type keepalived_exec_t;
init_daemon_domain(keepalived_t, keepalived_exec_t)
type keepalived_unit_file_t;
systemd_unit_file(keepalived_unit_file_t)
type keepalived_var_run_t;
files_pid_file(keepalived_var_run_t)
type keepalived_unconfined_script_exec_t;
application_executable_file(keepalived_unconfined_script_exec_t)
type keepalived_tmp_t;
files_tmp_file(keepalived_tmp_t)
type keepalived_tmpfs_t;
files_tmpfs_file(keepalived_tmpfs_t)
########################################
#
# keepalived local policy
#
allow keepalived_t self:capability { net_admin net_raw kill dac_read_search setuid setgid sys_admin sys_nice sys_ptrace };
allow keepalived_t self:capability2 bpf;
allow keepalived_t self:cap_userns { sys_ptrace };
allow keepalived_t self:process { signal_perms getpgid setpgid setsched setrlimit };
allow keepalived_t self:icmp_socket create_socket_perms;
allow keepalived_t self:netlink_socket create_socket_perms;
allow keepalived_t self:netlink_generic_socket create_socket_perms;
allow keepalived_t self:netlink_netfilter_socket create_socket_perms;
allow keepalived_t self:netlink_connector_socket create_socket_perms;
allow keepalived_t self:netlink_route_socket nlmsg_write;
allow keepalived_t self:packet_socket create_socket_perms;
allow keepalived_t self:rawip_socket create_socket_perms;
manage_dirs_pattern(keepalived_t, keepalived_var_run_t, keepalived_var_run_t)
manage_files_pattern(keepalived_t, keepalived_var_run_t, keepalived_var_run_t)
files_pid_filetrans(keepalived_t, keepalived_var_run_t, { dir file })
allow keepalived_t keepalived_var_run_t:dir mounton;
manage_files_pattern(keepalived_t, keepalived_tmpfs_t, keepalived_tmpfs_t)
manage_dirs_pattern(keepalived_t, keepalived_tmpfs_t, keepalived_tmpfs_t)
fs_tmpfs_filetrans(keepalived_t, keepalived_tmpfs_t, { dir file })
manage_files_pattern(keepalived_t, keepalived_tmp_t, keepalived_tmp_t)
files_tmp_filetrans(keepalived_t, keepalived_tmp_t, file)
kernel_read_system_state(keepalived_t)
kernel_read_network_state(keepalived_t)
kernel_request_load_module(keepalived_t)
kernel_rw_usermodehelper_state(keepalived_t)
kernel_search_network_sysctl(keepalived_t)
kernel_rw_net_sysctls(keepalived_t)
auth_use_nsswitch(keepalived_t)
corecmd_exec_bin(keepalived_t)
corecmd_exec_shell(keepalived_t)
corenet_raw_bind_generic_node(keepalived_t)
corenet_tcp_connect_connlcli_port(keepalived_t)
corenet_tcp_connect_http_port(keepalived_t)
corenet_tcp_connect_mysqld_port(keepalived_t)
corenet_tcp_connect_smtp_port(keepalived_t)
corenet_tcp_connect_snmp_port(keepalived_t)
corenet_tcp_connect_agentx_port(keepalived_t)
corenet_tcp_connect_squid_port(keepalived_t)
domain_read_all_domains_state(keepalived_t)
domain_getattr_all_domains(keepalived_t)
dev_read_sysfs(keepalived_t)
dev_read_urand(keepalived_t)
files_dontaudit_mounton_rootfs(keepalived_var_run_t)
files_mounton_rootfs(keepalived_t)
files_watch_var_run_dirs(keepalived_t)
fs_getattr_tmpfs(keepalived_t)
fs_read_nsfs_files(keepalived_t)
fs_unmount_tmpfs(keepalived_t)
modutils_domtrans_kmod(keepalived_t)
init_signal(keepalived_t)
logging_send_syslog_msg(keepalived_t)
optional_policy(`
dbus_system_bus_client(keepalived_t)
init_dbus_chat(keepalived_t)
')
optional_policy(`
iptables_domtrans(keepalived_t)
')
optional_policy(`
rhcs_signull_haproxy(keepalived_t)
')
optional_policy(`
snmp_manage_var_lib_files(keepalived_t)
snmp_manage_var_lib_sock_files(keepalived_t)
snmp_manage_var_lib_dirs(keepalived_t)
snmp_stream_connect(keepalived_t)
')
tunable_policy(`keepalived_connect_any',`
corenet_tcp_connect_all_ports(keepalived_t)
corenet_tcp_bind_all_ports(keepalived_t)
corenet_sendrecv_all_packets(keepalived_t)
corenet_tcp_sendrecv_all_ports(keepalived_t)
')
########################################
#
# keepalived_unconfined_script_script_t local policy
#
optional_policy(`
type keepalived_unconfined_script_t;
domain_type(keepalived_unconfined_script_t)
domain_entry_file(keepalived_unconfined_script_t, keepalived_unconfined_script_exec_t)
role system_r types keepalived_unconfined_script_t;
allow keepalived_t keepalived_unconfined_script_t:process { sigkill signal };
domtrans_pattern(keepalived_t, keepalived_unconfined_script_exec_t, keepalived_unconfined_script_t)
allow keepalived_t keepalived_unconfined_script_exec_t:dir search_dir_perms;
allow keepalived_t keepalived_unconfined_script_exec_t:dir read_file_perms;
allow keepalived_t keepalived_unconfined_script_exec_t:file ioctl;
dontaudit keepalived_t keepalived_unconfined_script_exec_t:file setattr;
init_dbus_chat(keepalived_unconfined_script_t)
optional_policy(`
unconfined_domain(keepalived_unconfined_script_t)
')
')