#DESC Calamaris - Squid log analysis

#

# Author:  Russell Coker <russell@coker.com.au>

# X-Debian-Packages: calamaris

# Depends: squid.te

#

#################################

#

# Rules for the calamaris_t domain.

#

# calamaris_t is the domain the calamaris process runs in

system_domain(calamaris, `, privmail')

ifdef(`crond.te', `

system_crond_entry(calamaris_exec_t, calamaris_t)

')

allow calamaris_t { var_t var_run_t }:dir { getattr search };

allow calamaris_t squid_log_t:dir search;

allow calamaris_t squid_log_t:file { getattr read };

allow calamaris_t { usr_t lib_t }:file { getattr read };

allow calamaris_t usr_t:lnk_file { getattr read };

dontaudit calamaris_t usr_t:file ioctl;

type calamaris_www_t, file_type, sysadmfile;

ifdef(`apache.te', `

allow calamaris_t httpd_sys_content_t:dir search;

')

rw_dir_create_file(calamaris_t, calamaris_www_t)

# for when squid has a different UID

allow calamaris_t self:capability dac_override;

logdir_domain(calamaris)

allow calamaris_t device_t:dir search;

allow calamaris_t devtty_t:chr_file { read write };

allow calamaris_t urandom_device_t:chr_file { getattr read };

allow calamaris_t self:process { fork signal_perms setsched };

read_sysctl(calamaris_t)

allow calamaris_t proc_t:dir search;

allow calamaris_t proc_t:file { getattr read };

allow calamaris_t { proc_t self }:lnk_file read;

allow calamaris_t self:dir search;

allow calamaris_t { bin_t sbin_t }:dir search;

allow calamaris_t bin_t:lnk_file read;

allow calamaris_t etc_runtime_t:file { getattr read };

allow calamaris_t self:fifo_file { getattr read write ioctl };

read_locale(calamaris_t)

can_exec(calamaris_t, bin_t)

allow calamaris_t self:unix_stream_socket create_stream_socket_perms;

allow calamaris_t self:udp_socket create_socket_perms;

allow calamaris_t etc_t:file { getattr read };

allow calamaris_t etc_t:lnk_file read;

dontaudit calamaris_t etc_t:file ioctl;

dontaudit calamaris_t sysadm_home_dir_t:dir { getattr search };

can_network_server(calamaris_t)

can_ypbind(calamaris_t)

ifdef(`named.te', `

can_udp_send(calamaris_t, named_t)

can_udp_send(named_t, calamaris_t)

')

ifdef(`apache.te', `

r_dir_file(httpd_t, calamaris_www_t)

')