policy_module(perdition, 1.5.0) ######################################## # # Declarations # type perdition_t; type perdition_exec_t; init_daemon_domain(perdition_t,perdition_exec_t) type perdition_etc_t; files_config_file(perdition_etc_t) type perdition_var_run_t; files_pid_file(perdition_var_run_t) ######################################## # # Local policy # allow perdition_t self:capability { setgid setuid }; dontaudit perdition_t self:capability sys_tty_config; allow perdition_t self:process signal_perms; allow perdition_t self:tcp_socket create_stream_socket_perms; allow perdition_t self:udp_socket create_socket_perms; allow perdition_t perdition_etc_t:file { getattr read }; files_search_etc(perdition_t) manage_files_pattern(perdition_t,perdition_var_run_t,perdition_var_run_t) files_pid_filetrans(perdition_t,perdition_var_run_t,file) kernel_read_kernel_sysctls(perdition_t) kernel_list_proc(perdition_t) kernel_read_proc_symlinks(perdition_t) corenet_all_recvfrom_unlabeled(perdition_t) corenet_all_recvfrom_netlabel(perdition_t) corenet_tcp_sendrecv_generic_if(perdition_t) corenet_udp_sendrecv_generic_if(perdition_t) corenet_tcp_sendrecv_all_nodes(perdition_t) corenet_udp_sendrecv_all_nodes(perdition_t) corenet_tcp_sendrecv_all_ports(perdition_t) corenet_udp_sendrecv_all_ports(perdition_t) corenet_tcp_bind_all_nodes(perdition_t) corenet_tcp_bind_pop_port(perdition_t) corenet_sendrecv_pop_server_packets(perdition_t) dev_read_sysfs(perdition_t) domain_use_interactive_fds(perdition_t) fs_getattr_all_fs(perdition_t) fs_search_auto_mountpoints(perdition_t) files_read_etc_files(perdition_t) libs_use_ld_so(perdition_t) libs_use_shared_libs(perdition_t) logging_send_syslog_msg(perdition_t) miscfiles_read_localization(perdition_t) sysnet_read_config(perdition_t) userdom_dontaudit_use_unpriv_user_fds(perdition_t) sysadm_dontaudit_search_home_dirs(perdition_t) optional_policy(` seutil_sigchld_newrole(perdition_t) ') optional_policy(` udev_read_db(perdition_t) ')