policy_module(rpcbind, 1.6.1) ######################################## # # Declarations # type rpcbind_t; type rpcbind_exec_t; init_daemon_domain(rpcbind_t, rpcbind_exec_t) type rpcbind_initrc_exec_t; init_script_file(rpcbind_initrc_exec_t) type rpcbind_tmp_t; files_tmp_file(rpcbind_tmp_t) type rpcbind_var_run_t; files_pid_file(rpcbind_var_run_t) init_daemon_run_dir(rpcbind_var_run_t, "rpcbind") type rpcbind_var_lib_t; files_type(rpcbind_var_lib_t) type rpcbind_unit_file_t; systemd_unit_file(rpcbind_unit_file_t) ######################################## # # Local policy # allow rpcbind_t self:capability { chown dac_read_search dac_override setgid setuid sys_tty_config }; allow rpcbind_t self:fifo_file rw_fifo_file_perms; allow rpcbind_t self:unix_stream_socket { accept listen }; allow rpcbind_t self:tcp_socket { accept listen }; manage_files_pattern(rpcbind_t, rpcbind_tmp_t, rpcbind_tmp_t) manage_dirs_pattern(rpcbind_t, rpcbind_tmp_t, rpcbind_tmp_t) files_tmp_filetrans(rpcbind_t, rpcbind_tmp_t, { file dir }) manage_dirs_pattern(rpcbind_t, rpcbind_var_run_t, rpcbind_var_run_t) manage_files_pattern(rpcbind_t, rpcbind_var_run_t, rpcbind_var_run_t) manage_sock_files_pattern(rpcbind_t, rpcbind_var_run_t, rpcbind_var_run_t) files_pid_filetrans(rpcbind_t, rpcbind_var_run_t, { file sock_file dir }) manage_dirs_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t) manage_files_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t) manage_sock_files_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t) files_var_lib_filetrans(rpcbind_t, rpcbind_var_lib_t, { file dir sock_file }) kernel_read_system_state(rpcbind_t) kernel_read_network_state(rpcbind_t) kernel_read_net_sysctls(rpcbind_t) kernel_request_load_module(rpcbind_t) corenet_all_recvfrom_netlabel(rpcbind_t) corenet_tcp_sendrecv_generic_if(rpcbind_t) corenet_udp_sendrecv_generic_if(rpcbind_t) corenet_tcp_sendrecv_generic_node(rpcbind_t) corenet_udp_sendrecv_generic_node(rpcbind_t) corenet_tcp_sendrecv_all_ports(rpcbind_t) corenet_udp_sendrecv_all_ports(rpcbind_t) corenet_tcp_bind_generic_node(rpcbind_t) corenet_udp_bind_generic_node(rpcbind_t) corenet_sendrecv_all_server_packets(rpcbind_t) corenet_tcp_bind_portmap_port(rpcbind_t) corenet_udp_bind_portmap_port(rpcbind_t) corenet_udp_bind_all_rpc_ports(rpcbind_t) corecmd_exec_shell(rpcbind_t) domain_use_interactive_fds(rpcbind_t) files_read_etc_runtime_files(rpcbind_t) auth_use_nsswitch(rpcbind_t) logging_send_syslog_msg(rpcbind_t) sysnet_dns_name_resolve(rpcbind_t) optional_policy(` nis_use_ypbind(rpcbind_t) ') optional_policy(` systemd_tmpfiles_exec(rpcbind_t) ') ifdef(`distro_debian',` term_dontaudit_use_unallocated_ttys(rpcbind_t) ')