1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
## <summary>mDNS/DNS-SD daemon implementing Apple ZeroConf architecture</summary>
########################################
## <summary>
## Execute avahi server in the avahi domain.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
interface(`avahi_domtrans',`
gen_require(`
type avahi_exec_t, avahi_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, avahi_exec_t, avahi_t)
')
########################################
## <summary>
## Send avahi a signal
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
interface(`avahi_signal',`
gen_require(`
type avahi_t;
')
allow $1 avahi_t:process signal;
')
########################################
## <summary>
## Send avahi a kill signal.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`avahi_kill',`
gen_require(`
type avahi_t;
')
allow $1 avahi_t:process sigkill;
')
########################################
## <summary>
## Send avahi a signull
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`avahi_signull',`
gen_require(`
type avahi_t;
')
allow $1 avahi_t:process signull;
')
########################################
## <summary>
## Send and receive messages from
## avahi over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`avahi_dbus_chat',`
gen_require(`
type avahi_t;
class dbus send_msg;
')
allow $1 avahi_t:dbus send_msg;
allow avahi_t $1:dbus send_msg;
')
########################################
## <summary>
## Connect to avahi using a unix domain stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`avahi_stream_connect',`
gen_require(`
type avahi_t, avahi_var_run_t;
')
files_search_pids($1)
stream_connect_pattern($1, avahi_var_run_t, avahi_var_run_t, avahi_t)
')
########################################
## <summary>
## Do not audit attempts to search the avahi pid directory.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`avahi_dontaudit_search_pid',`
gen_require(`
type avahi_var_run_t;
')
dontaudit $1 avahi_var_run_t:dir search_dir_perms;
')
########################################
## <summary>
## All of the rules required to administrate
## an avahi environment
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to be allowed to manage the avahi domain.
## </summary>
## </param>
## <rolecap/>
#
interface(`avahi_admin',`
gen_require(`
type avahi_t, avahi_var_run_t;
type avahi_initrc_exec_t;
')
allow $1 avahi_t:process { ptrace signal_perms };
ps_process_pattern($1, avahi_t)
init_labeled_script_domtrans($1, avahi_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 avahi_initrc_exec_t system_r;
allow $2 system_r;
files_list_pids($1)
admin_pattern($1, avahi_var_run_t)
')
|
