## ShoutCast compatible streaming media server. ######################################## ## ## Execute a domain transition to run icecast. ## ## ## ## Domain allowed to transition. ## ## # interface(`icecast_domtrans',` gen_require(` type icecast_t, icecast_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, icecast_exec_t, icecast_t) ') ######################################## ## ## Send generic signals to icecast. ## ## ## ## Domain allowed access. ## ## # interface(`icecast_signal',` gen_require(` type icecast_t; ') allow $1 icecast_t:process signal; ') ######################################## ## ## Execute icecast server in the icecast domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`icecast_initrc_domtrans',` gen_require(` type icecast_initrc_exec_t; ') init_labeled_script_domtrans($1, icecast_initrc_exec_t) ') ######################################## ## ## Read icecast pid files. ## ## ## ## Domain allowed access. ## ## # interface(`icecast_read_pid_files',` gen_require(` type icecast_var_run_t; ') files_search_pids($1) allow $1 icecast_var_run_t:file read_file_perms; ') ######################################## ## ## Create, read, write, and delete ## icecast pid files. ## ## ## ## Domain allowed access. ## ## # interface(`icecast_manage_pid_files',` gen_require(` type icecast_var_run_t; ') files_search_pids($1) manage_files_pattern($1, icecast_var_run_t, icecast_var_run_t) ') ######################################## ## ## Read icecast log files. ## ## ## ## Domain allowed access. ## ## ## # interface(`icecast_read_log',` gen_require(` type icecast_log_t; ') logging_search_logs($1) read_files_pattern($1, icecast_log_t, icecast_log_t) ') ######################################## ## ## Append icecast log files. ## ## ## ## Domain allowed access. ## ## # interface(`icecast_append_log',` gen_require(` type icecast_log_t; ') logging_search_logs($1) append_files_pattern($1, icecast_log_t, icecast_log_t) ') ######################################## ## ## Create, read, write, and delete ## icecast log files. ## ## ## ## Domain allow access. ## ## # interface(`icecast_manage_log',` gen_require(` type icecast_log_t; ') logging_search_logs($1) manage_files_pattern($1, icecast_log_t, icecast_log_t) ') ######################################## ## ## All of the rules required to ## administrate an icecast environment. ## ## ## ## Domain allowed access. ## ## ## ## ## Role allowed access. ## ## ## # interface(`icecast_admin',` gen_require(` type icecast_t, icecast_initrc_exec_t, icecast_log_t; type icecast_var_run_t; ') allow $1 icecast_t:process signal_perms; ps_process_pattern($1, icecast_t) tunable_policy(`deny_ptrace',`',` allow $1 icecast_t:process ptrace; ') # Allow icecast_t to restart the apache service icecast_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 icecast_initrc_exec_t system_r; allow $2 system_r; allow $1 icecast_t:process { ptrace signal_perms }; ps_process_pattern($1, icecast_t) logging_search_logs($1) admin_pattern($1, icecast_log_t) files_search_pids($1) admin_pattern($1, icecast_var_run_t) ')