#DESC Squid - Web cache

#

# Author:  Russell Coker <russell@coker.com.au>

# X-Debian-Packages: squid

#

#################################

#

# Rules for the squid_t domain.

#

# squid_t is the domain the squid process runs in

ifdef(`apache.te',`

can_tcp_connect(squid_t, httpd_t)

')

bool squid_connect_any false;

daemon_domain(squid, `, web_client_domain, nscd_client_domain')

type squid_conf_t, file_type, sysadmfile;

general_domain_access(squid_t)

allow { squid_t initrc_t } squid_conf_t:file r_file_perms;

allow squid_t squid_conf_t:dir r_dir_perms;

allow squid_t squid_conf_t:lnk_file read;

logdir_domain(squid)

rw_dir_create_file(initrc_t, squid_log_t)

allow squid_t usr_t:file { getattr read };

# type for /var/cache/squid

type squid_cache_t, file_type, sysadmfile;

allow squid_t self:capability { setgid setuid net_bind_service dac_override };

allow squid_t { etc_t etc_runtime_t }:file r_file_perms;

allow squid_t etc_t:lnk_file read;

allow squid_t self:unix_stream_socket create_socket_perms;

allow squid_t self:unix_dgram_socket create_socket_perms;

allow squid_t self:fifo_file rw_file_perms;

read_sysctl(squid_t)

allow squid_t devtty_t:chr_file rw_file_perms;

allow squid_t { self proc_t }:file { read getattr };

# for when we use /var/spool/cache

allow squid_t var_spool_t:dir search;

# Grant permissions to create, access, and delete cache files.

# No type transitions required, as the files inherit the parent directory type.

create_dir_file(squid_t, squid_cache_t)

ifdef(`logrotate.te',

`domain_auto_trans(logrotate_t, squid_exec_t, squid_t)')

ifdef(`crond.te', `domain_auto_trans(system_crond_t, squid_exec_t, squid_t)')

# Use the network

can_network(squid_t)

if (squid_connect_any) {

allow squid_t port_type:tcp_socket name_connect;

} 

can_ypbind(squid_t)

can_tcp_connect(web_client_domain, squid_t)

# tcp port 8080 and udp port 3130 is http_cache_port_t (see net_contexts)

allow squid_t { gopher_port_t ftp_port_t http_port_t http_cache_port_t }:{ tcp_socket udp_socket } name_bind;

allow squid_t { gopher_port_t ftp_port_t http_port_t http_cache_port_t }:tcp_socket name_connect;

# to allow running programs from /usr/lib/squid (IE unlinkd)

# also allow exec()ing itself

can_exec(squid_t, { lib_t squid_exec_t bin_t sbin_t shell_exec_t } )

allow squid_t { bin_t sbin_t }:dir search;

allow squid_t { bin_t sbin_t }:lnk_file read;

dontaudit squid_t { boot_t tmp_t home_root_t security_t devpts_t }:dir getattr;

ifdef(`targeted_policy', `

dontaudit squid_t tty_device_t:chr_file { read write };

')

allow squid_t urandom_device_t:chr_file { getattr read };

#squid requires the following when run in diskd mode, the recommended setting

allow squid_t tmpfs_t:file { read write };

r_dir_file(squid_t, cert_t)

ifdef(`winbind.te', `

domain_auto_trans(squid_t, winbind_helper_exec_t, winbind_helper_t)

allow winbind_helper_t squid_t:tcp_socket rw_socket_perms;

allow winbind_helper_t squid_log_t:file ra_file_perms;

')