-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/29/2011 02:27 PM, Mr Dash Four wrote:
>
>> Could you add me to CC. I would like to see these policies too. Thanks.
> I've just seen Dominick's response. Would you still need me to enclose
> these policies or are you happy with what he send me?
>
I already made some additional changes to bittorrent module:
bittorrent.te: transmission creates files and dirs in /var/lib/transmission.
policy_module(bittorrent, 1.0.0)
########################################
#
# Declarations
#
## <desc>
## <p>
## Allow bittorrent servers to modify
## public files used for public file
## transfer services. Directories/Files
## must be labeled public_content_rw_t.
## </p>
## </desc>
gen_tunable(allow_httpd_anon_write, false)
## <desc>
## <p>
## Allow bittorrent servers to use cifs
## used for public file transfer services.
## </p>
## </desc>
gen_tunable(allow_bittorrentd_use_cifs, false)
## <desc>
## <p>
## Allow bittorrent servers to use nfs
## used for public file transfer services.
## </p>
## </desc>
gen_tunable(allow_bittorrentd_use_nfs, false)
type bittorrentd_t;
type bittorrentd_exec_t;
init_daemon_domain(bittorrentd_t, bittorrentd_exec_t)
type bittorrentd_initrc_exec_t;
init_script_file(bittorrentd_initrc_exec_t)
type bittorrentd_etc_t;
files_config_file(bittorrentd_etc_t)
type bittorrentd_var_lib_t;
files_type(bittorrentd_var_lib_t)
type bittorrentd_var_log_t;
logging_log_file(bittorrentd_var_log_t)
########################################
#
# Local policy
#
allow bittorrentd_t self:capability { setgid setuid };
dontaudit bittorrentd_t self:capability sys_tty_config;
allow bittorrentd_t self:process { getsched setsched };
allow bittorrentd_t self:fifo_file rw_fifo_file_perms;
allow bittorrentd_t self:tcp_socket { accept listen };
allow bittorrentd_t self:unix_stream_socket create_socket_perms;
manage_dirs_pattern(bittorrentd_t, bittorrentd_var_lib_t,
bittorrentd_var_lib_t)
manage_files_pattern(bittorrentd_t, bittorrentd_var_lib_t,
bittorrentd_var_lib_t)
allow bittorrentd_t bittorrentd_var_log_t:file { create_file_perms
setattr_file_perms append_file_perms };
logging_log_filetrans(bittorrentd_t, bittorrentd_var_log_t, file)
kernel_read_network_state(bittorrentd_t)
corenet_all_recvfrom_unlabeled(bittorrentd_t)
corenet_all_recvfrom_netlabel(bittorrentd_t)
corenet_tcp_sendrecv_generic_if(bittorrentd_t)
corenet_udp_sendrecv_generic_if(bittorrentd_t)
corenet_tcp_sendrecv_generic_node(bittorrentd_t)
corenet_udp_sendrecv_generic_node(bittorrentd_t)
corenet_tcp_bind_generic_node(bittorrentd_t)
corenet_udp_bind_generic_node(bittorrentd_t)
corenet_tcp_bind_bittorrent_ctl_port(bittorrentd_t)
corenet_tcp_sendrecv_bittorrent_ctl_port(bittorrentd_t)
corenet_sendrecv_bittorrent_ctl_server_packets(bittorrentd_t)
dev_read_urand(bittorrentd_t)
domain_use_interactive_fds(bittorrentd_t)
files_search_var_lib(bittorrentd_t)
files_search_pids(bittorrentd_t)
fs_search_auto_mountpoints(bittorrentd_t)
auth_use_nsswitch(bittorrentd_t)
logging_send_syslog_msg(bittorrentd_t)
miscfiles_read_localization(bittorrentd_t)
miscfiles_read_public_files(bittorrentd_t)
tunable_policy(`allow_bittorrent_anon_write',`
miscfiles_manage_public_files(bittorrentd_t)
')
tunable_policy(`allow_bittorrentd_use_cifs',`
fs_manage_cifs_dirs(bittorrentd_t)
fs_manage_cifs_files(bittorrentd_t)
')
tunable_policy(`allow_bittorrentd_use_nfs',`
fs_manage_nfs_dirs(bittorrentd_t)
fs_manage_nfs_files(bittorrentd_t)
')
optional_policy(`
seutil_sigchld_newrole(bittorrentd_t)
')
bittorrent.if: create bittorrent_admin()
## <summary>Bittorrent peer-to-peer communications protocol for file
sharing.</summary>
########################################
## <summary>
## Read bittorrent daemon
## configuration files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`bittorrent_read_daemon_config_files',`
gen_require(`
type bittorrentd_etc_t;
')
files_search_etc($1)
allow $1 bittorrentd_etc_t:file read_file_perms;
')
########################################
## <summary>
## All of the rules required to
## administrate an bittorrent
## environment.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`bittorrent_admin',`
gen_require(`
type bittorrentd_t; bittorrentd_initrc_exec_t;
type bittorrentd_etc_t, bittorrentd_var_log_t;
type bittorrentd_var_lib_t;
')
allow $1 bittorrentd_t:process { ptrace signal_perms };
ps_process_pattern($1, bittorrentd_t)
init_labeled_script_domtrans($1, bittorrentd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 bittorrentd_initrc_exec_t system_r;
allow $2 system_r;
miscfiles_manage_public_files($1)
files_list_etc($1)
admin_pattern($1, bittorrentd_etc_t)
logging_list_logs($1)
admin_pattern($1, bittorrentd_var_log_t)
files_list_var_lib($1)
admin_pattern($1, bittorrentd_var_lib_t)
')
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk26sukACgkQMlxVo39jgT/uHwCghqxyuCJALPKR/YpVyobmvYoW
e38AoLN0fAOuf+bEMA4xUsm8dTESboFb
=NUCj
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
