|
Dominick Grift |
099a864 |
policy_module(portage, 1.13.1)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
# Declarations
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
## <desc>
|
|
Chris PeBenito |
9401ae1 |
##
|
|
Chris PeBenito |
9401ae1 |
## Allow the portage domains to use NFS mounts (regular nfs_t)
|
|
Chris PeBenito |
9401ae1 |
##
|
|
Chris PeBenito |
9401ae1 |
## </desc>
|
|
Chris PeBenito |
9401ae1 |
gen_tunable(portage_use_nfs, false)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
82067f6 |
attribute_role portage_roles;
|
|
Chris PeBenito |
82067f6 |
|
|
Chris PeBenito |
9401ae1 |
type gcc_config_t;
|
|
Chris PeBenito |
9401ae1 |
type gcc_config_exec_t;
|
|
Chris PeBenito |
9401ae1 |
application_domain(gcc_config_t, gcc_config_exec_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# constraining type
|
|
Chris PeBenito |
9401ae1 |
type portage_t;
|
|
Chris PeBenito |
9401ae1 |
type portage_exec_t;
|
|
Chris PeBenito |
9401ae1 |
application_domain(portage_t, portage_exec_t)
|
|
Chris PeBenito |
9401ae1 |
domain_obj_id_change_exemption(portage_t)
|
|
Chris PeBenito |
9401ae1 |
rsync_entry_type(portage_t)
|
|
Chris PeBenito |
9401ae1 |
corecmd_shell_entry_type(portage_t)
|
|
Chris PeBenito |
82067f6 |
role portage_roles types portage_t;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# portage compile sandbox domain
|
|
Chris PeBenito |
9401ae1 |
type portage_sandbox_t;
|
|
Chris PeBenito |
9401ae1 |
application_domain(portage_sandbox_t, portage_exec_t)
|
|
Chris PeBenito |
9401ae1 |
# the shell is the entrypoint if regular sandbox is disabled
|
|
Chris PeBenito |
9401ae1 |
# portage_exec_t is the entrypoint if regular sandbox is enabled
|
|
Chris PeBenito |
9401ae1 |
corecmd_shell_entry_type(portage_sandbox_t)
|
|
Chris PeBenito |
82067f6 |
role portage_roles types portage_sandbox_t;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# portage package fetching domain
|
|
Chris PeBenito |
9401ae1 |
type portage_fetch_t;
|
|
Chris PeBenito |
9401ae1 |
type portage_fetch_exec_t;
|
|
Chris PeBenito |
9401ae1 |
application_domain(portage_fetch_t, portage_fetch_exec_t)
|
|
Chris PeBenito |
9401ae1 |
corecmd_shell_entry_type(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
rsync_entry_type(portage_fetch_t)
|
|
Chris PeBenito |
82067f6 |
role portage_roles types portage_fetch_t;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_devpts_t;
|
|
Chris PeBenito |
9401ae1 |
term_pty(portage_devpts_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_ebuild_t;
|
|
Sven Vermeulen |
6a47f59 |
files_mountpoint(portage_ebuild_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_fetch_tmp_t;
|
|
Chris PeBenito |
9401ae1 |
files_tmp_file(portage_fetch_tmp_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_db_t;
|
|
Chris PeBenito |
9401ae1 |
files_type(portage_db_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_conf_t;
|
|
Chris PeBenito |
9401ae1 |
files_type(portage_conf_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_cache_t;
|
|
Chris PeBenito |
9401ae1 |
files_type(portage_cache_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_gpg_t;
|
|
Chris PeBenito |
9401ae1 |
files_type(portage_gpg_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_log_t;
|
|
Chris PeBenito |
9401ae1 |
logging_log_file(portage_log_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_srcrepo_t;
|
|
Chris PeBenito |
9401ae1 |
files_type(portage_srcrepo_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_tmp_t;
|
|
Chris PeBenito |
9401ae1 |
files_tmp_file(portage_tmp_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type portage_tmpfs_t;
|
|
Chris PeBenito |
9401ae1 |
files_tmpfs_file(portage_tmpfs_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
# gcc-config policy
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow gcc_config_t self:capability { chown fsetid };
|
|
Chris PeBenito |
9401ae1 |
allow gcc_config_t self:fifo_file rw_file_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
manage_files_pattern(gcc_config_t, portage_cache_t, portage_cache_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
read_files_pattern(gcc_config_t, portage_conf_t, portage_conf_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow gcc_config_t portage_ebuild_t:dir list_dir_perms;
|
|
Chris PeBenito |
9401ae1 |
read_files_pattern(gcc_config_t, portage_ebuild_t, portage_ebuild_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow gcc_config_t portage_exec_t:file mmap_file_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
kernel_read_system_state(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
kernel_read_kernel_sysctls(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
corecmd_exec_shell(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
corecmd_exec_bin(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
corecmd_manage_bin_files(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
domain_use_interactive_fds(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_manage_etc_files(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
files_rw_etc_runtime_files(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
files_read_usr_files(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
files_search_var_lib(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
files_search_pids(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
# complains loudly about not being able to list
|
|
Chris PeBenito |
9401ae1 |
# the directory it is being run from
|
|
Chris PeBenito |
9401ae1 |
files_list_all(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# seems to be ok without this
|
|
Chris PeBenito |
9401ae1 |
init_dontaudit_read_script_status_files(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
libs_read_lib_files(gcc_config_t)
|
|
Chris PeBenito |
82067f6 |
libs_run_ldconfig(gcc_config_t, portage_roles)
|
|
Chris PeBenito |
9401ae1 |
libs_manage_shared_libs(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
# gcc-config creates a temp dir for the libs
|
|
Chris PeBenito |
9401ae1 |
libs_manage_lib_dirs(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
logging_send_syslog_msg(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
miscfiles_read_localization(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
userdom_use_user_terminals(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
consoletype_exec(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
ifdef(`distro_gentoo',`
|
|
Chris PeBenito |
9401ae1 |
init_exec_rc(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Sven Vermeulen |
5b8d821 |
tunable_policy(`portage_use_nfs',`
|
|
Sven Vermeulen |
5b8d821 |
fs_read_nfs_files(gcc_config_t)
|
|
Sven Vermeulen |
5b8d821 |
')
|
|
Sven Vermeulen |
5b8d821 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
seutil_use_newrole_fds(gcc_config_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
# Portage Merging Rules
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# - setfscreate for merging to live fs
|
|
Chris PeBenito |
9401ae1 |
# - setexec to run portage fetch
|
|
Chris PeBenito |
9401ae1 |
allow portage_t self:process { setfscreate setexec };
|
|
Chris PeBenito |
9401ae1 |
# - kill for mysql merging, at least
|
|
Chris PeBenito |
9401ae1 |
allow portage_t self:capability { sys_nice kill setfcap };
|
|
Sven Vermeulen |
4cb4408 |
dontaudit portage_t self:capability { dac_read_search };
|
|
Sven Vermeulen |
4cb4408 |
dontaudit portage_t self:netlink_route_socket rw_netlink_socket_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# user post-sync scripts
|
|
Chris PeBenito |
9401ae1 |
can_exec(portage_t, portage_conf_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow portage_t portage_log_t:file manage_file_perms;
|
|
Chris PeBenito |
9401ae1 |
logging_log_filetrans(portage_t, portage_log_t, file)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow portage_t { portage_fetch_t portage_sandbox_t }:process signal;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# transition for rsync and wget
|
|
Chris PeBenito |
9401ae1 |
corecmd_shell_spec_domtrans(portage_t, portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
rsync_entry_domtrans(portage_t, portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t portage_t:fd use;
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t portage_t:fifo_file rw_file_perms;
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t portage_t:process sigchld;
|
|
Sven Vermeulen |
4cb4408 |
dontaudit portage_fetch_t portage_devpts_t:chr_file { read write };
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# transition to sandbox for compiling
|
|
Chris PeBenito |
9401ae1 |
domain_trans(portage_t, portage_exec_t, portage_sandbox_t)
|
|
Chris PeBenito |
9401ae1 |
corecmd_shell_spec_domtrans(portage_t, portage_sandbox_t)
|
|
Chris PeBenito |
9401ae1 |
allow portage_sandbox_t portage_t:fd use;
|
|
Chris PeBenito |
9401ae1 |
allow portage_sandbox_t portage_t:fifo_file rw_file_perms;
|
|
Chris PeBenito |
9401ae1 |
allow portage_sandbox_t portage_t:process sigchld;
|
|
Chris PeBenito |
9401ae1 |
allow portage_sandbox_t self:process ptrace;
|
|
Sven Vermeulen |
4cb4408 |
dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# run scripts out of the build directory
|
|
Chris PeBenito |
9401ae1 |
can_exec(portage_t, portage_tmp_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Sven Vermeulen |
4cb4408 |
kernel_dontaudit_request_load_module(portage_t)
|
|
Chris PeBenito |
9401ae1 |
# merging baselayout will need this:
|
|
Chris PeBenito |
9401ae1 |
kernel_write_proc_files(portage_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
domain_dontaudit_read_all_domains_state(portage_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# modify any files in the system
|
|
Chris PeBenito |
9401ae1 |
files_manage_all_files(portage_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
selinux_get_fs_mount(portage_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
auth_manage_shadow(portage_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# merging baselayout will need this:
|
|
Chris PeBenito |
9401ae1 |
init_exec(portage_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
# run setfiles -r
|
|
Chris PeBenito |
82067f6 |
seutil_run_setfiles(portage_t, portage_roles)
|
|
Chris PeBenito |
9401ae1 |
# run semodule
|
|
Chris PeBenito |
82067f6 |
seutil_run_semanage(portage_t, portage_roles)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
82067f6 |
portage_run_gcc_config(portage_t, portage_roles)
|
|
Chris PeBenito |
9401ae1 |
# if sesandbox is disabled, compiling is performed in this domain
|
|
Chris PeBenito |
9401ae1 |
portage_compile_domain(portage_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
82067f6 |
bootloader_run(portage_t, portage_roles)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
cron_system_entry(portage_t, portage_exec_t)
|
|
Chris PeBenito |
9401ae1 |
cron_system_entry(portage_fetch_t, portage_fetch_exec_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
82067f6 |
modutils_run_depmod(portage_t, portage_roles)
|
|
Chris PeBenito |
82067f6 |
modutils_run_update_mods(portage_t, portage_roles)
|
|
Chris PeBenito |
9401ae1 |
#dontaudit update_modules_t portage_tmp_t:dir search_dir_perms;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
82067f6 |
usermanage_run_groupadd(portage_t, portage_roles)
|
|
Chris PeBenito |
82067f6 |
usermanage_run_useradd(portage_t, portage_roles)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
ifdef(`TODO',`
|
|
Chris PeBenito |
9401ae1 |
# seems to work ok without these
|
|
Chris PeBenito |
9401ae1 |
dontaudit portage_t device_t:{ blk_file chr_file } getattr;
|
|
Chris PeBenito |
9401ae1 |
dontaudit portage_t proc_t:dir setattr;
|
|
Chris PeBenito |
9401ae1 |
dontaudit portage_t device_type:chr_file read_chr_file_perms;
|
|
Chris PeBenito |
9401ae1 |
dontaudit portage_t device_type:blk_file read_blk_file_perms;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
##########################################
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
# Portage fetch domain
|
|
Chris PeBenito |
9401ae1 |
# - for rsync and distfile fetching
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t self:process signal;
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t self:capability { dac_override fowner fsetid chown };
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t self:fifo_file rw_fifo_file_perms;
|
|
Dominick Grift |
099a864 |
allow portage_fetch_t self:tcp_socket { accept listen };
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t self:unix_stream_socket create_socket_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t portage_conf_t:dir list_dir_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Sven Vermeulen |
529ad2f |
allow portage_fetch_t portage_devpts_t:chr_file { rw_chr_file_perms setattr };
|
|
Sven Vermeulen |
529ad2f |
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t portage_gpg_t:dir rw_dir_perms;
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t portage_gpg_t:file manage_file_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t portage_tmp_t:dir manage_dir_perms;
|
|
Chris PeBenito |
9401ae1 |
allow portage_fetch_t portage_tmp_t:file manage_file_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
read_files_pattern(portage_fetch_t, portage_conf_t, portage_conf_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
manage_dirs_pattern(portage_fetch_t, portage_ebuild_t, portage_ebuild_t)
|
|
Chris PeBenito |
9401ae1 |
manage_files_pattern(portage_fetch_t, portage_ebuild_t, portage_ebuild_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
manage_dirs_pattern(portage_fetch_t, portage_fetch_tmp_t, portage_fetch_tmp_t)
|
|
Chris PeBenito |
9401ae1 |
manage_files_pattern(portage_fetch_t, portage_fetch_tmp_t, portage_fetch_tmp_t)
|
|
Chris PeBenito |
9401ae1 |
files_tmp_filetrans(portage_fetch_t, portage_fetch_tmp_t, { file dir })
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
kernel_read_system_state(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
kernel_read_kernel_sysctls(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
corecmd_exec_bin(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corecmd_exec_shell(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
corenet_all_recvfrom_unlabeled(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_all_recvfrom_netlabel(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_sendrecv_generic_if(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_sendrecv_generic_node(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_sendrecv_all_ports(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_connect_http_cache_port(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_connect_git_port(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_connect_rsync_port(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_sendrecv_http_client_packets(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_sendrecv_http_cache_client_packets(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_sendrecv_git_client_packets(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_sendrecv_rsync_client_packets(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
# would rather not connect to unspecified ports, but
|
|
Chris PeBenito |
9401ae1 |
# it occasionally comes up
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_connect_all_reserved_ports(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_connect_generic_port(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
dev_dontaudit_read_rand(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
domain_use_interactive_fds(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_read_etc_runtime_files(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
files_read_usr_files(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
files_dontaudit_search_pids(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Matthew Thode |
8fdef3c |
fs_search_auto_mountpoints(portage_fetch_t)
|
|
Matthew Thode |
8fdef3c |
|
|
Chris PeBenito |
9401ae1 |
logging_list_logs(portage_fetch_t)
|
|
Sven Vermeulen |
4cb4408 |
logging_dontaudit_search_logs(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
term_search_ptys(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
099a864 |
auth_use_nsswitch(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
099a864 |
miscfiles_read_localization(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
userdom_use_user_terminals(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
userdom_dontaudit_read_user_home_content_files(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
rsync_exec(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
ifdef(`hide_broken_symptoms',`
|
|
Chris PeBenito |
9401ae1 |
dontaudit portage_fetch_t portage_cache_t:file read;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
tunable_policy(`portage_use_nfs',`
|
|
Chris PeBenito |
9401ae1 |
fs_getattr_nfs(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
fs_manage_nfs_dirs(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
fs_manage_nfs_files(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
fs_manage_nfs_symlinks(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
gpg_exec(portage_fetch_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
##########################################
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
# Portage sandbox domain
|
|
Chris PeBenito |
9401ae1 |
# - SELinux-enforced sandbox
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
portage_compile_domain(portage_sandbox_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
099a864 |
auth_use_nsswitch(portage_sandbox_t)
|
|
Dominick Grift |
099a864 |
|
|
Chris PeBenito |
9401ae1 |
ifdef(`hide_broken_symptoms',`
|
|
Chris PeBenito |
9401ae1 |
# leaked descriptors
|
|
Chris PeBenito |
9401ae1 |
dontaudit portage_sandbox_t portage_cache_t:dir { setattr };
|
|
Chris PeBenito |
9401ae1 |
dontaudit portage_sandbox_t portage_cache_t:file { setattr write };
|
|
Chris PeBenito |
9401ae1 |
')
|