turnserver: add policy module

turnserver.fc

@@ -0,0 +1,13 @@
+/etc/rc\.d/init\.d/coturn	--	gen_context(system_u:object_r:turnserver_initrc_exec_t,s0)
+
+/etc/turnuserdb.conf	-- 	gen_context(system_u:object_r:turnserver_etc_t,s0)
+/etc/turnserver.conf	-- 	gen_context(system_u:object_r:turnserver_etc_t,s0)
+/etc/default/coturn	-- 	gen_context(system_u:object_r:turnserver_etc_t,s0)
+
+/usr/bin/turnserver	--	gen_context(system_u:object_r:turnserver_exec_t,s0)
+
+/var/log/turn.*	--	gen_context(system_u:object_r:turnserver_var_log_t,s0)
+/var/run/turnserver(/.*)?	--	gen_context(system_u:object_r:turnserver_var_run_t,s0)
+
+/var/lib/turn(/.*)?		gen_context(system_u:object_r:turnserver_var_t,s0)
+

turnserver.te

@@ -0,0 +1,84 @@
+policy_module(turnserver, 0.1.10)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role turnserver_roles;
+
+type turnserver_t;
+type turnserver_exec_t;
+init_daemon_domain(turnserver_t, turnserver_exec_t)
+
+type turnserver_etc_t;
+files_config_file(turnserver_etc_t)
+
+type turnserver_initrc_exec_t;
+init_script_file(turnserver_initrc_exec_t)
+
+type turnserver_var_run_t;
+files_pid_file(turnserver_var_run_t)
+
+type turnserver_var_log_t;
+logging_log_file(turnserver_var_log_t)
+
+type turnserver_var_t;
+files_type(turnserver_var_t)
+
+type turnserver_tmp_t;
+files_tmp_file(turnserver_tmp_t)
+
+type turnserver_unit_t;
+init_unit_file(turnserver_unit_t)
+
+########################################
+#
+# Local policy
+#
+
+allow turnserver_t self:tcp_socket { bind create setopt listen };
+allow turnserver_t self:udp_socket { getopt create setopt bind };
+allow turnserver_t self:capability { setuid setgid };
+allow turnserver_t self:process signal;
+allow turnserver_t self:tcp_socket accept;
+allow turnserver_t self:rawip_socket { bind create listen setopt };
+
+manage_dirs_pattern(turnserver_t, turnserver_var_t, turnserver_var_t)
+manage_files_pattern(turnserver_t, turnserver_var_t, turnserver_var_t)
+type_transition turnserver_t turnserver_var_t:file turnserver_var_t;
+
+read_files_pattern(turnserver_t, turnserver_etc_t, turnserver_etc_t)
+
+manage_files_pattern(turnserver_t, turnserver_var_run_t, turnserver_var_run_t)
+files_pid_filetrans(turnserver_t, turnserver_var_run_t, file)
+
+manage_files_pattern(turnserver_t, turnserver_var_log_t, turnserver_var_log_t)
+logging_log_filetrans(turnserver_t, turnserver_var_log_t, file)
+
+manage_dirs_pattern(turnserver_t,turnserver_tmp_t,turnserver_tmp_t)
+manage_files_pattern(turnserver_t,turnserver_tmp_t,turnserver_tmp_t)
+files_tmp_filetrans(turnserver_t,turnserver_tmp_t, file)
+
+dev_read_sysfs(turnserver_t)
+
+corenet_tcp_bind_all_unreserved_ports(turnserver_t)
+corenet_udp_bind_all_unreserved_ports(turnserver_t)
+
+corenet_tcp_bind_generic_node(turnserver_t)
+corenet_udp_bind_generic_node(turnserver_t)
+corenet_raw_bind_generic_node(turnserver_t)
+
+miscfiles_read_localization(turnserver_t)
+dev_read_urand(turnserver_t)
+auth_use_nsswitch(turnserver_t)
+
+kernel_request_load_module(turnserver_t)
+
+optional_policy(`
+	gen_require(`
+		type port_t;
+	')
+	allow turnserver_t port_t:rawip_socket name_bind;
+')
+