gogs.te 2.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113
  1. policy_module(gogs, 0.2.7)
  2. ########################################
  3. #
  4. # Declarations
  5. #
  6. attribute_role gogs_roles;
  7. type gogs_t;
  8. type gogs_exec_t;
  9. init_daemon_domain(gogs_t, gogs_exec_t)
  10. type gogs_initrc_exec_t;
  11. init_script_file(gogs_initrc_exec_t)
  12. type gogs_opt_t;
  13. files_type(gogs_opt_t)
  14. type gogs_var_lib_t;
  15. files_type(gogs_var_lib_t)
  16. type gogs_tmp_t;
  17. files_tmp_file(gogs_tmp_t);
  18. type gogs_ssh_t;
  19. files_type(gogs_ssh_t)
  20. ########################################
  21. #
  22. # Local policy
  23. #
  24. allow gogs_t self:fifo_file { read write getattr };
  25. allow gogs_t self:process { getsched signal };
  26. allow gogs_t self:tcp_socket { getattr setopt bind create accept listen read write connect getopt };
  27. allow gogs_t self:udp_socket { connect getattr create setopt };
  28. allow gogs_t self:fifo_file ioctl;
  29. allow gogs_t gogs_exec_t:file execute_no_trans;
  30. allow gogs_t gogs_var_lib_t:file { execute execute_no_trans };
  31. manage_dirs_pattern(gogs_t, gogs_opt_t, gogs_opt_t)
  32. manage_files_pattern(gogs_t, gogs_opt_t, gogs_opt_t)
  33. manage_dirs_pattern(gogs_t, gogs_ssh_t, gogs_ssh_t)
  34. manage_files_pattern(gogs_t, gogs_ssh_t, gogs_ssh_t)
  35. manage_lnk_files_pattern(gogs_t, gogs_ssh_t, gogs_ssh_t)
  36. allow gogs_t gogs_ssh_t:file map;
  37. filetrans_pattern(gogs_t, gogs_opt_t, gogs_ssh_t, { file dir lnk_file })
  38. manage_dirs_pattern(gogs_t, gogs_var_lib_t, gogs_var_lib_t)
  39. manage_files_pattern(gogs_t, gogs_var_lib_t, gogs_var_lib_t)
  40. manage_lnk_files_pattern(gogs_t, gogs_var_lib_t, gogs_var_lib_t)
  41. optional_policy(`
  42. gen_require(`
  43. type var_lib_t;
  44. ')
  45. filetrans_pattern(gogs_t, var_lib_t, gogs_var_lib_t, { file dir lnk_file })
  46. ')
  47. manage_dirs_pattern(gogs_t, gogs_var_lib_t, gogs_tmp_t)
  48. manage_files_pattern(gogs_t, gogs_var_lib_t, gogs_tmp_t)
  49. files_tmp_filetrans(gogs_t, gogs_tmp_t, { file dir } )
  50. allow gogs_t gogs_opt_t:file map;
  51. allow gogs_t gogs_var_lib_t:file map;
  52. miscfiles_read_localization(gogs_t)
  53. corenet_tcp_bind_generic_node(gogs_t)
  54. corenet_tcp_bind_ntop_port(gogs_t)
  55. corenet_tcp_connect_smtp_port(gogs_t)
  56. corenet_tcp_connect_ntop_port(gogs_t)
  57. kernel_read_net_sysctls(gogs_t)
  58. kernel_read_system_state(gogs_t)
  59. git_exec(gogs_t)
  60. git_read_usr_t(gogs_t)
  61. corecmd_exec_bin(gogs_t)
  62. files_read_etc_files(gogs_t)
  63. mysql_tcp_connect(gogs_t)
  64. sysnet_read_config(gogs_t)
  65. kernel_read_kernel_sysctls(gogs_t)
  66. kernel_read_vm_sysctls(gogs_t)
  67. dev_read_sysfs(gogs_t)
  68. corecmd_exec_shell(gogs_t)
  69. dev_read_urand(gogs_t)
  70. optional_policy(`
  71. gen_require(`
  72. type sshd_t;
  73. ')
  74. manage_files_pattern(sshd_t, gogs_ssh_t, gogs_ssh_t)
  75. manage_dirs_pattern(sshd_t, gogs_ssh_t, gogs_ssh_t)
  76. search_dirs_pattern(sshd_t, gogs_opt_t, gogs_opt_t)
  77. domain_auto_trans(sshd_t, gogs_exec_t, gogs_t)
  78. ')
  79. optional_policy(`
  80. gen_require(`
  81. type supervisor_t;
  82. ')
  83. supervisor_service_domain(gogs_t, gogs_exec_t)
  84. allow supervisor_t gogs_opt_t:dir search;
  85. ')
  86. optional_policy(`
  87. gen_require(`
  88. type ssh_keygen_exec_t;
  89. ')
  90. allow gogs_t ssh_keygen_exec_t:file { read getattr open execute execute_no_trans };
  91. ')