#DESC Traceroute - Display network routes

#

# Author:  Russell Coker <russell@coker.com.au>

# based on the work of David A. Wheeler <dwheeler@ida.org>

# X-Debian-Packages: traceroute lft

#

#################################

#

# Rules for the traceroute_t domain.

#

# traceroute_t is the domain for the traceroute program.

# traceroute_exec_t is the type of the corresponding program.

#

type traceroute_t, domain, privlog, nscd_client_domain;

role sysadm_r types traceroute_t;

role system_r types traceroute_t;

# for user_ping:

in_user_role(traceroute_t)

uses_shlib(traceroute_t)

can_network_client(traceroute_t)

can_ypbind(traceroute_t)

allow traceroute_t node_t:rawip_socket node_bind;

type traceroute_exec_t, file_type, sysadmfile, exec_type;

# Transition into this domain when you run this program.

domain_auto_trans(initrc_t, traceroute_exec_t, traceroute_t)

domain_auto_trans(sysadm_t, traceroute_exec_t, traceroute_t)

allow traceroute_t etc_t:file { getattr read };

# Use capabilities.

allow traceroute_t self:capability { net_admin net_raw setuid setgid };

allow traceroute_t self:rawip_socket create_socket_perms;

allow traceroute_t self:netlink_route_socket { bind create getattr nlmsg_read read write };

allow traceroute_t self:unix_stream_socket create_socket_perms;

allow traceroute_t device_t:dir search;

# for lft

allow traceroute_t self:packet_socket create_socket_perms;

r_dir_file(traceroute_t, proc_t)

r_dir_file(traceroute_t, proc_net_t)

# Access the terminal.

allow traceroute_t admin_tty_type:chr_file rw_file_perms;

ifdef(`gnome-pty-helper.te', `allow traceroute_t sysadm_gph_t:fd use;')

allow traceroute_t privfd:fd use;

# dont need this

dontaudit traceroute_t fs_t:filesystem getattr;

dontaudit traceroute_t var_t:dir search;

ifdef(`ping.te', `

if (user_ping) {

	domain_auto_trans(unpriv_userdomain, traceroute_exec_t, traceroute_t)

	# allow access to the terminal

	allow traceroute_t { ttyfile ptyfile }:chr_file rw_file_perms;

}

')

#rules needed for nmap

allow traceroute_t { urandom_device_t random_device_t }:chr_file r_file_perms;

allow traceroute_t usr_t:file { getattr read };

read_locale(traceroute_t)

dontaudit traceroute_t userdomain:dir search;