diff --git a/policy/modules/admin/smoltclient.fc b/policy/modules/admin/smoltclient.fc new file mode 100644 index 0000000..263ea90 --- /dev/null +++ b/policy/modules/admin/smoltclient.fc @@ -0,0 +1,4 @@ + +/usr/share/smolt/client/sendProfile.py -- gen_context(system_u:object_r:smoltclient_exec_t,s0) + + diff --git a/policy/modules/admin/smoltclient.if b/policy/modules/admin/smoltclient.if new file mode 100644 index 0000000..a54079b --- /dev/null +++ b/policy/modules/admin/smoltclient.if @@ -0,0 +1 @@ +## The Fedora hardware profiler client diff --git a/policy/modules/admin/smoltclient.te b/policy/modules/admin/smoltclient.te new file mode 100644 index 0000000..9eb42d9 --- /dev/null +++ b/policy/modules/admin/smoltclient.te @@ -0,0 +1,67 @@ + +policy_module(smoltclient,1.0.0) + +######################################## +# +# Declarations +# + +type smoltclient_t; +type smoltclient_exec_t; +application_domain(smoltclient_t, smoltclient_exec_t) +cron_system_entry(smoltclient_t, smoltclient_exec_t) + +type smoltclient_tmp_t; +files_tmp_file(smoltclient_tmp_t) + +######################################## +# +# Local policy +# +allow smoltclient_t self:process { setsched getsched }; + +allow smoltclient_t self:fifo_file rw_fifo_file_perms; +allow smoltclient_t self:tcp_socket create_socket_perms; +allow smoltclient_t self:udp_socket create_socket_perms; + +can_exec(smoltclient_t, smoltclient_tmp_t) +manage_dirs_pattern(smoltclient_t, smoltclient_tmp_t, smoltclient_tmp_t) +manage_files_pattern(smoltclient_t, smoltclient_tmp_t, smoltclient_tmp_t) +files_tmp_filetrans(smoltclient_t, smoltclient_tmp_t, { dir file }) + +kernel_read_system_state(smoltclient_t) +kernel_read_network_state(smoltclient_t) +kernel_read_kernel_sysctls(smoltclient_t) + +corecmd_exec_bin(smoltclient_t) +corecmd_exec_shell(smoltclient_t) + +corenet_tcp_connect_http_port(smoltclient_t) + +dev_read_sysfs(smoltclient_t) + +fs_getattr_all_fs(smoltclient_t) +fs_getattr_all_dirs(smoltclient_t) + +files_getattr_generic_locks(smoltclient_t) +files_read_etc_files(smoltclient_t) +files_read_usr_files(smoltclient_t) + +auth_use_nsswitch(smoltclient_t) + +logging_send_syslog_msg(smoltclient_t) + +miscfiles_read_localization(smoltclient_t) + +optional_policy(` + dbus_system_bus_client(smoltclient_t) +') + +optional_policy(` + hal_dbus_chat(smoltclient_t) +') + +optional_policy(` + rpm_exec(smoltclient_t) + rpm_read_db(smoltclient_t) +')