| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778 |
- policy_module(supervisor, 0.1.18)
- ########################################
- #
- # Declarations
- #
- attribute_role supervisor_roles;
- type supervisor_t;
- type supervisord_exec_t;
- init_daemon_domain(supervisor_t, supervisord_exec_t)
- role supervisor_roles types supervisor_t;
- type supervisor_etc_t;
- files_config_file(supervisor_etc_t)
- type supervisor_initrc_exec_t;
- init_script_file(supervisor_initrc_exec_t);
- type supervisor_var_log_t;
- logging_log_file(supervisor_var_log_t)
- type supervisor_var_run_t;
- files_pid_file(supervisor_var_run_t)
- type supervisor_usr_t;
- files_type(supervisor_usr_t)
- type supervisor_usr_lib_t;
- files_type(supervisor_usr_lib_t)
- type supervisor_tmp_t;
- files_tmp_file(supervisor_tmp_t)
- type supervisorctl_t;
- type supervisorctl_exec_t;
- init_system_domain(supervisorctl_t,supervisorctl_exec_t)
- ########################################
- #
- # Local policy
- #
- allow supervisor_t self:capability sys_tty_config;
- allow supervisor_t self:fifo_file { ioctl read write getattr };
- allow supervisor_t self:process setpgid;
- allow supervisor_t self:capability { setuid setgid };
- allow supervisor_t self:capability kill;
- allow supervisor_t self:unix_stream_socket { accept listen };
- corecmd_exec_bin(supervisor_t)
- corecmd_exec_shell(supervisor_t)
- auth_use_nsswitch(supervisor_t)
- miscfiles_read_localization(supervisor_t)
- dev_read_urand(supervisor_t)
- kernel_read_system_state(supervisor_t)
- read_files_pattern(supervisor_t,supervisor_etc_t,supervisor_etc_t)
- search_dirs_pattern(supervisor_t,supervisor_etc_t,supervisor_etc_t)
- allow supervisor_t supervisor_etc_t:dir read;
- read_files_pattern(supervisor_t,supervisor_usr_t,supervisor_usr_t)
- manage_dirs_pattern(supervisor_t,supervisor_var_log_t,supervisor_var_log_t)
- manage_files_pattern(supervisor_t,supervisor_var_log_t,supervisor_var_log_t)
- logging_log_filetrans(supervisor_t,supervisor_var_log_t, file)
- manage_dirs_pattern(supervisor_t,supervisor_tmp_t,supervisor_tmp_t)
- manage_files_pattern(supervisor_t,supervisor_tmp_t,supervisor_tmp_t)
- files_tmp_filetrans(supervisor_t,supervisor_tmp_t, file)
- manage_files_pattern(supervisor_t,supervisor_var_run_t,supervisor_var_run_t)
- manage_sock_files_pattern(supervisor_t,supervisor_var_run_t,supervisor_var_run_t)
- files_pid_filetrans(supervisor_t,supervisor_var_run_t, { file sock_file })
|
