#DESC Ifconfig - Configure network interfaces

#

# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser  

# X-Debian-Packages: net-tools

#

#################################

#

# Rules for the ifconfig_t domain.

#

# ifconfig_t is the domain for the ifconfig program.

# ifconfig_exec_t is the type of the corresponding program.

#

type ifconfig_t, domain, privlog, privmodule;

type ifconfig_exec_t, file_type, sysadmfile, exec_type;

role system_r types ifconfig_t;

role sysadm_r types ifconfig_t;

uses_shlib(ifconfig_t)

general_domain_access(ifconfig_t)

domain_auto_trans(initrc_t, ifconfig_exec_t, ifconfig_t)

domain_auto_trans(sysadm_t, ifconfig_exec_t, ifconfig_t)

# for /sbin/ip

allow ifconfig_t self:netlink_route_socket rw_netlink_socket_perms;

allow ifconfig_t self:tcp_socket { create ioctl };

allow ifconfig_t etc_t:file { getattr read };

allow ifconfig_t self:socket create_socket_perms;

# Use capabilities.

allow ifconfig_t self:capability net_admin;

dontaudit ifconfig_t self:capability sys_module;

# Inherit and use descriptors from init.

allow ifconfig_t { kernel_t init_t }:fd use;

# Access /proc

r_dir_file(ifconfig_t, proc_t)

r_dir_file(ifconfig_t, proc_net_t)

allow ifconfig_t privfd:fd use;

allow ifconfig_t run_init_t:fd use;

# Create UDP sockets, necessary when called from dhcpc

allow ifconfig_t self:udp_socket create_socket_perms;

# Access terminals.

allow ifconfig_t { user_tty_type initrc_devpts_t admin_tty_type }:chr_file rw_file_perms;

ifdef(`gnome-pty-helper.te', `allow ifconfig_t sysadm_gph_t:fd use;')

allow ifconfig_t tun_tap_device_t:chr_file { read write };

# ifconfig attempts to search some sysctl entries.

# Do not audit those attempts; comment out these rules if it is desired to

# see the denials.

dontaudit ifconfig_t { sysctl_t sysctl_net_t }:dir search;

allow ifconfig_t fs_t:filesystem getattr;

read_locale(ifconfig_t)

allow ifconfig_t lib_t:file { getattr read };

rhgb_domain(ifconfig_t)

allow ifconfig_t userdomain:fd use;

dontaudit ifconfig_t root_t:file read;