From 80978901354b17cf3460d5d4451b48b59a9204ae Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Fri, 10 Mar 2023 17:00:31 +0000 Subject: [PATCH 19/20] contrib/selinux: Split interfaces into smaller bits ...to fit accepted Fedora practices. Link: https://github.com/fedora-selinux/selinux-policy/pull/1613 Signed-off-by: Stefano Brivio (cherry picked from commit 93105ea06619d4c199f8140f4b75ae359757dc6d) --- contrib/selinux/passt.if | 71 ++++++++++++++++++++++++++++++++++------ 1 file changed, 61 insertions(+), 10 deletions(-) diff --git a/contrib/selinux/passt.if b/contrib/selinux/passt.if index 3e37c5b..f7560a7 100644 --- a/contrib/selinux/passt.if +++ b/contrib/selinux/passt.if @@ -17,37 +17,88 @@ interface(`passt_domtrans',` domtrans_pattern($1, passt_exec_t, passt_t) ') -interface(`passt_socket',` +interface(`passt_socket_dir',` + gen_require(` + type passt_t; + ') + + allow passt_t $1:dir add_entry_dir_perms; +') + +interface(`passt_socket_create',` + gen_require(` + type passt_t; + ') + + allow passt_t $1:sock_file create; +') + +interface(`passt_socket_use',` gen_require(` type passt_t; ') - allow $1 $2:sock_file write; allow $1 passt_t:unix_stream_socket connectto; + allow $1 $2:sock_file { read write }; + allow passt_t $2:sock_file { read write }; +') + +interface(`passt_socket_delete',` + gen_require(` + type passt_t; + ') + + allow $1 $2:sock_file unlink; +') + +interface(`passt_logfile_dir',` + gen_require(` + type passt_t; + ') - allow passt_t $2:sock_file { create read write unlink }; + allow passt_t $1:dir add_entry_dir_perms; ') -interface(`passt_logfile',` +interface(`passt_logfile_use',` gen_require(` type passt_t; ') logging_log_file($1); - allow passt_t $1:dir { search write add_name }; allow passt_t $1:file { create open read write }; ') -interface(`passt_pidfile',` +interface(`passt_pidfile_dir',` + gen_require(` + type passt_t; + ') + + allow passt_t $1:dir add_entry_dir_perms; +') + +interface(`passt_pidfile_write',` + gen_require(` + type passt_t; + ') + + files_pid_file($1); + allow passt_t $1:file { create open write }; +') + +interface(`passt_pidfile_read',` gen_require(` type passt_t; ') - allow $1 $2:file { open read unlink }; + allow $1 $2:file { open read }; +') + +interface(`passt_pidfile_delete',` + gen_require(` + type passt_t; + ') - files_pid_file($2); - allow passt_t $2:dir { search write add_name }; - allow passt_t $2:file { create open write }; + allow $1 $2:file unlink; ') interface(`passt_kill',` -- 2.39.2