#DESC Tcpd - Access control facilities from internet services

#

# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser  

#           Russell Coker <russell@coker.com.au>

# X-Debian-Packages: tcpd

# Depends: inetd.te

#

#################################

#

# Rules for the tcpd_t domain.

#

type tcpd_t, domain, privlog;

role system_r types tcpd_t;

uses_shlib(tcpd_t)

type tcpd_exec_t, file_type, sysadmfile, exec_type;

domain_auto_trans(inetd_t, tcpd_exec_t, tcpd_t)

allow tcpd_t fs_t:filesystem getattr;

# no good reason for this, probably nscd

dontaudit tcpd_t var_t:dir search;

can_network_server(tcpd_t)

can_ypbind(tcpd_t)

allow tcpd_t self:unix_dgram_socket create_socket_perms;

allow tcpd_t self:unix_stream_socket create_socket_perms;

allow tcpd_t etc_t:file { getattr read };

read_locale(tcpd_t)

tmp_domain(tcpd)

# Use sockets inherited from inetd.

allow tcpd_t inetd_t:tcp_socket rw_stream_socket_perms;

# Run each daemon with a defined domain in its own domain.

# These rules have been moved to each target domain .te file.

# Run other daemons in the inetd_child_t domain.

allow tcpd_t { bin_t sbin_t }:dir search;

domain_auto_trans(tcpd_t, inetd_child_exec_t, inetd_child_t)

allow tcpd_t device_t:dir search;