|
Dominick Grift |
920de50 |
policy_module(icecast, 1.1.1)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Declarations
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
## <desc>
|
|
|
1ec3d1a |
##
|
|
Dominick Grift |
920de50 |
## Determine whether icecast can listen
|
|
Dominick Grift |
920de50 |
## on and connect to any TCP port.
|
|
Dominick Grift |
920de50 |
##
|
|
Dominick Grift |
920de50 |
## </desc>
|
|
Dominick Grift |
920de50 |
gen_tunable(icecast_use_any_tcp_ports, false)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type icecast_t;
|
|
|
1ec3d1a |
type icecast_exec_t;
|
|
Dominick Grift |
920de50 |
application_executable_file(icecast_exec_t)
|
|
|
1ec3d1a |
init_daemon_domain(icecast_t, icecast_exec_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type icecast_initrc_exec_t;
|
|
|
1ec3d1a |
init_script_file(icecast_initrc_exec_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type icecast_log_t;
|
|
|
1ec3d1a |
logging_log_file(icecast_log_t)
|
|
|
1ec3d1a |
|
|
Dominick Grift |
920de50 |
type icecast_var_run_t;
|
|
Dominick Grift |
920de50 |
files_pid_file(icecast_var_run_t)
|
|
Dominick Grift |
920de50 |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
Dominick Grift |
920de50 |
# Local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow icecast_t self:capability { dac_override setgid setuid sys_nice };
|
|
Dominick Grift |
920de50 |
allow icecast_t self:process { getsched setsched signal };
|
|
|
1ec3d1a |
allow icecast_t self:fifo_file rw_fifo_file_perms;
|
|
|
1ec3d1a |
allow icecast_t self:unix_stream_socket create_stream_socket_perms;
|
|
Dominick Grift |
920de50 |
allow icecast_t self:tcp_socket { accept listen };
|
|
|
1ec3d1a |
|
|
Dominick Grift |
920de50 |
allow icecast_t icecast_log_t:dir setattr_dir_perms;
|
|
Dominick Grift |
920de50 |
append_files_pattern(icecast_t, icecast_log_t, icecast_log_t)
|
|
Dominick Grift |
920de50 |
create_files_pattern(icecast_t, icecast_log_t, icecast_log_t)
|
|
Dominick Grift |
920de50 |
setattr_files_pattern(icecast_t, icecast_log_t, icecast_log_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_dirs_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)
|
|
|
1ec3d1a |
manage_files_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t)
|
|
|
1ec3d1a |
files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir })
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
kernel_read_system_state(icecast_t)
|
|
|
1ec3d1a |
|
|
Dominick Grift |
920de50 |
corenet_all_recvfrom_unlabeled(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_all_recvfrom_netlabel(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_tcp_sendrecv_generic_if(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_tcp_sendrecv_generic_node(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_tcp_bind_generic_node(icecast_t)
|
|
Dominick Grift |
920de50 |
|
|
Dominick Grift |
920de50 |
corenet_sendrecv_soundd_server_packets(icecast_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_bind_soundd_port(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_sendrecv_soundd_client_packets(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_tcp_connect_soundd_port(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_tcp_sendrecv_soundd_port(icecast_t)
|
|
|
1ec3d1a |
|
|
Dominick Grift |
920de50 |
dev_read_sysfs(icecast_t)
|
|
Dominick Grift |
920de50 |
dev_read_urand(icecast_t)
|
|
Dominick Grift |
920de50 |
dev_read_rand(icecast_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
|
2e739f7 |
auth_use_nsswitch(icecast_t)
|
|
|
2e739f7 |
|
|
Dominick Grift |
920de50 |
tunable_policy(`icecast_use_any_tcp_ports',`
|
|
Dominick Grift |
920de50 |
corenet_tcp_connect_all_ports(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_sendrecv_all_client_packets(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_tcp_bind_all_ports(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_sendrecv_all_server_packets(icecast_t)
|
|
Dominick Grift |
920de50 |
corenet_tcp_sendrecv_all_ports(icecast_t)
|
|
Dominick Grift |
920de50 |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
apache_read_sys_content(icecast_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
rtkit_scheduled(icecast_t)
|
|
|
1ec3d1a |
')
|