Chris PeBenito eab2cc
policy_module(slocate, 1.9.1)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Declarations
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type locate_t;
Chris PeBenito 17de1b
type locate_exec_t;
Chris PeBenito 0bfccd
init_system_domain(locate_t, locate_exec_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type locate_log_t;
Chris PeBenito 17de1b
logging_log_file(locate_log_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type locate_var_lib_t;
Chris PeBenito 17de1b
files_type(locate_var_lib_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Local policy
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
allow locate_t self:capability { chown dac_read_search dac_override fowner fsetid };
Chris PeBenito c90440
allow locate_t self:process { execmem execheap execstack signal };
Chris PeBenito c0868a
allow locate_t self:fifo_file rw_fifo_file_perms;
Chris PeBenito 17de1b
allow locate_t self:unix_stream_socket create_socket_perms;
Chris PeBenito 17de1b
Chris PeBenito 0bfccd
manage_dirs_pattern(locate_t, locate_var_lib_t, locate_var_lib_t)
Chris PeBenito 0bfccd
manage_files_pattern(locate_t, locate_var_lib_t, locate_var_lib_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
kernel_read_system_state(locate_t)
Chris PeBenito eab2cc
kernel_dontaudit_search_network_state(locate_t)
Chris PeBenito 17de1b
kernel_dontaudit_search_sysctl(locate_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
corecmd_exec_bin(locate_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
dev_getattr_all_blk_files(locate_t)
Chris PeBenito 17de1b
dev_getattr_all_chr_files(locate_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
files_list_all(locate_t)
Chris PeBenito 17de1b
files_getattr_all_files(locate_t)
Chris PeBenito e82895
files_getattr_all_pipes(locate_t)
Chris PeBenito f7101c
files_getattr_all_sockets(locate_t)
Chris PeBenito 17de1b
files_read_etc_runtime_files(locate_t)
Chris PeBenito 17de1b
files_read_etc_files(locate_t)
Chris PeBenito 17de1b
Chris PeBenito f9029f
fs_getattr_all_fs(locate_t)
Chris PeBenito f7101c
fs_getattr_all_files(locate_t)
Chris PeBenito c90440
fs_getattr_all_pipes(locate_t)
Chris PeBenito c90440
fs_getattr_all_symlinks(locate_t)
Chris PeBenito eab2cc
fs_getattr_all_blk_files(locate_t)
Chris PeBenito eab2cc
fs_getattr_all_chr_files(locate_t)
Chris PeBenito f7101c
fs_list_all(locate_t)
Chris PeBenito 6224fc
fs_list_inotifyfs(locate_t)
Chris PeBenito eab2cc
fs_read_noxattr_fs_symlinks(locate_t)
Chris PeBenito 17de1b
Chris PeBenito 6dd721
# getpwnam
Chris PeBenito 6dd721
auth_use_nsswitch(locate_t)
Chris PeBenito 6dd721
Chris PeBenito 17de1b
miscfiles_read_localization(locate_t)
Chris PeBenito 17de1b
Chris PeBenito d6d16b
ifdef(`enable_mls',`
Chris PeBenito d6d16b
	# On MLS machines will not be allowed to getattr Anything but SystemLow
Chris PeBenito d6d16b
	files_dontaudit_getattr_all_dirs(locate_t)
Chris PeBenito d6d16b
')
Chris PeBenito d6d16b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 17de1b
	cron_system_entry(locate_t, locate_exec_t)
Chris PeBenito 17de1b
')