Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

pagure: expand the SELinux pagure policy

Browse source 
Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
This commit is contained in:
Pierre-Yves Chibon 2020-11-17 15:24:35 +01:00
parent a2dded035a
commit c025a442eb
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
roles/pagure/files/selinux/pagure.te
View file

@ -1,4 +1,4 @@
module pagure 1.1; module pagure 1.2;
require { require {
type gitosis_var_lib_t; type gitosis_var_lib_t;
@ -13,14 +13,14 @@ require {
type var_run_t; type var_run_t;
type var_t; type var_t;
class dir { add_name remove_name write }; class dir { add_name remove_name write };
class file { create link setattr write execute execute_no_trans getattr map open read rename unlink }; class file { create link setattr write execute execute_no_trans getattr map open read rename unlink ioctrl };
class process execmem; class process execmem;
class sock_file write; class sock_file write;
class tcp_socket name_connect; class tcp_socket name_connect;
} }
allow httpd_t gitosis_var_lib_t:dir { add_name remove_name write }; allow httpd_t gitosis_var_lib_t:dir { add_name remove_name write };
allow httpd_t gitosis_var_lib_t:file { create link setattr unlink write }; allow httpd_t gitosis_var_lib_t:file { create link setattr unlink write rename };
#============= httpd_t ============== #============= httpd_t ==============
@ -30,11 +30,11 @@ allow httpd_t httpd_log_t:file { rename unlink };
#!!!! This avc is allowed in the current policy #!!!! This avc is allowed in the current policy
allow httpd_t self:process execmem; allow httpd_t self:process execmem;
allow httpd_t var_log_t:file { open rename }; allow httpd_t var_log_t:file { open rename unlink };
#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files' #!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow httpd_t var_t:file map; allow httpd_t var_t:file map;
allow httpd_t var_t:file { getattr open read }; allow httpd_t var_t:file { getattr open read ioctl };
#============= postfix_cleanup_t ============== #============= postfix_cleanup_t ==============
allow postfix_cleanup_t var_run_t:sock_file write; allow postfix_cleanup_t var_run_t:sock_file write;