|
Chris PeBenito |
6c192c7 |
policy_module(qemu, 1.6.1)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Declarations
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
## <desc>
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## Allow qemu to connect fully to the network
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## </desc>
|
|
|
1ec3d1a |
gen_tunable(qemu_full_network, false)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
## <desc>
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## Allow qemu to use cifs/Samba file systems
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## </desc>
|
|
|
1ec3d1a |
gen_tunable(qemu_use_cifs, true)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
## <desc>
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## Allow qemu to use serial/parallel communication ports
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## </desc>
|
|
|
1ec3d1a |
gen_tunable(qemu_use_comm, false)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
## <desc>
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## Allow qemu to use nfs file systems
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## </desc>
|
|
|
1ec3d1a |
gen_tunable(qemu_use_nfs, true)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
## <desc>
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## Allow qemu to use usb devices
|
|
|
1ec3d1a |
##
|
|
|
1ec3d1a |
## </desc>
|
|
|
1ec3d1a |
gen_tunable(qemu_use_usb, true)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
virt_domain_template(qemu)
|
|
|
1ec3d1a |
role system_r types qemu_t;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# qemu local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
storage_raw_write_removable_device(qemu_t)
|
|
|
1ec3d1a |
storage_raw_read_removable_device(qemu_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
userdom_search_user_home_content(qemu_t)
|
|
|
1ec3d1a |
userdom_read_user_tmpfs_files(qemu_t)
|
|
|
1ec3d1a |
userdom_stream_connect(qemu_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
tunable_policy(`qemu_full_network',`
|
|
|
1ec3d1a |
allow qemu_t self:udp_socket create_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_if(qemu_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_node(qemu_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_all_ports(qemu_t)
|
|
|
1ec3d1a |
corenet_udp_bind_generic_node(qemu_t)
|
|
|
1ec3d1a |
corenet_udp_bind_all_ports(qemu_t)
|
|
|
1ec3d1a |
corenet_tcp_bind_all_ports(qemu_t)
|
|
|
1ec3d1a |
corenet_tcp_connect_all_ports(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
tunable_policy(`qemu_use_cifs',`
|
|
|
1ec3d1a |
fs_manage_cifs_dirs(qemu_t)
|
|
|
1ec3d1a |
fs_manage_cifs_files(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
tunable_policy(`qemu_use_comm',`
|
|
|
1ec3d1a |
term_use_unallocated_ttys(qemu_t)
|
|
|
1ec3d1a |
dev_rw_printer(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
tunable_policy(`qemu_use_nfs',`
|
|
|
1ec3d1a |
fs_manage_nfs_dirs(qemu_t)
|
|
|
1ec3d1a |
fs_manage_nfs_files(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
tunable_policy(`qemu_use_usb',`
|
|
|
1ec3d1a |
dev_rw_usbfs(qemu_t)
|
|
|
1ec3d1a |
fs_manage_dos_dirs(qemu_t)
|
|
|
1ec3d1a |
fs_manage_dos_files(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
dbus_read_lib_files(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
pulseaudio_manage_home_files(qemu_t)
|
|
|
1ec3d1a |
pulseaudio_stream_connect(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
tunable_policy(`qemu_use_cifs',`
|
|
|
1ec3d1a |
samba_domtrans_smbd(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
virt_domtrans_bridgehelper(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
virt_manage_home_files(qemu_t)
|
|
|
1ec3d1a |
virt_manage_images(qemu_t)
|
|
|
1ec3d1a |
virt_append_log(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
xen_rw_image_files(qemu_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
xserver_read_xdm_pid(qemu_t)
|
|
|
1ec3d1a |
xserver_stream_connect(qemu_t)
|
|
|
1ec3d1a |
')
|