#DESC TFTP - UDP based file server for boot loaders

#

# Author:  Russell Coker <russell@coker.com.au>

# X-Debian-Packages: tftpd atftpd

# Depends: inetd.te

#

#################################

#

# Rules for the tftpd_t domain.

#

# tftpd_exec_t is the type of the tftpd executable.

#

daemon_domain(tftpd)

type tftp_port_t, port_type, reserved_port_type;

# tftpdir_t is the type of files in the /tftpboot directories.

type tftpdir_t, file_type, sysadmfile;

r_dir_file(tftpd_t, tftpdir_t)

domain_auto_trans(inetd_t, tftpd_exec_t, tftpd_t)

# Use the network.

can_network_udp(tftpd_t)

allow tftpd_t tftp_port_t:udp_socket name_bind;

ifdef(`inetd.te', `

allow inetd_t tftp_port_t:udp_socket name_bind;

')

allow tftpd_t self:unix_dgram_socket create_socket_perms;

allow tftpd_t self:unix_stream_socket create_stream_socket_perms;

# allow any domain to connect to the TFTP server

allow tftpd_t inetd_t:udp_socket rw_socket_perms;

# Use capabilities

allow tftpd_t self:capability { setgid setuid net_bind_service sys_chroot };

allow tftpd_t etc_t:dir r_dir_perms;

allow tftpd_t etc_t:file r_file_perms;

allow tftpd_t var_t:dir r_dir_perms;

allow tftpd_t var_t:{ file lnk_file } r_file_perms;