#DESC vpnc

#

# Author:  Dan Walsh <dwalsh@redhat.com>

#

#################################

#

# Rules for the vpnc_t domain, et al.

#

# vpnc_t is the domain for the vpnc program.

# vpnc_exec_t is the type of the vpnc executable.

#

application_domain(vpnc, `, sysctl_net_writer, nscd_client_domain')

allow vpnc_t { random_device_t urandom_device_t }:chr_file { getattr read };

# Use the network.

can_network(vpnc_t)

allow vpnc_t port_type:tcp_socket name_connect;

allow vpnc_t isakmp_port_t:udp_socket name_bind;

can_ypbind(vpnc_t)

allow vpnc_t self:socket create_socket_perms;

# Use capabilities.

allow vpnc_t self:capability { net_admin ipc_lock net_bind_service net_raw };

allow vpnc_t devpts_t:dir search;

allow vpnc_t etc_t:file { getattr read };

allow vpnc_t tun_tap_device_t:chr_file { ioctl read write };

allow vpnc_t self:rawip_socket create_socket_perms;

allow vpnc_t self:unix_dgram_socket create_socket_perms;

allow vpnc_t self:unix_stream_socket create_socket_perms;

allow vpnc_t { devtty_t user_tty_type admin_tty_type }:chr_file rw_file_perms;

allow vpnc_t port_t:udp_socket name_bind;

allow vpnc_t etc_runtime_t:file { getattr read };

allow vpnc_t proc_t:file { getattr read };

dontaudit vpnc_t selinux_config_t:dir search;

can_exec(vpnc_t, {bin_t sbin_t ifconfig_exec_t shell_exec_t })

allow vpnc_t sysctl_net_t:dir search;

allow vpnc_t sysctl_net_t:file write;

allow vpnc_t sbin_t:dir search;

allow vpnc_t bin_t:dir search;

allow vpnc_t bin_t:lnk_file read;

allow vpnc_t self:dir search;

r_dir_file(vpnc_t, proc_t)

r_dir_file(vpnc_t, proc_net_t)

tmp_domain(vpnc)

allow vpnc_t self:fifo_file { getattr ioctl read write };

allow vpnc_t self:file { getattr read };

allow vpnc_t self:netlink_route_socket rw_netlink_socket_perms;

file_type_auto_trans(vpnc_t, etc_t, net_conf_t, file)

allow vpnc_t etc_t:file { execute execute_no_trans ioctl };

dontaudit vpnc_t home_root_t:dir search;

dontaudit vpnc_t user_home_dir_type:dir search;

var_run_domain(vpnc)

allow vpnc_t userdomain:fd use;

r_dir_file(vpnc_t, sysfs_t)

allow vpnc_t self:process { fork sigchld };

read_locale(vpnc_t)

read_sysctl(vpnc_t)

allow vpnc_t fs_t:filesystem getattr;