-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/29/2011 02:27 PM, Mr Dash Four wrote:
> Could you add me to CC. I would like to see these policies too. Thanks.
I've just seen Dominick's response. Would you still need me to enclose
these policies or are you happy with what he send me?
I already made some additional changes to bittorrent module:
bittorrent.te: transmission creates files and dirs in /var/lib/transmission.
policy_module(bittorrent, 1.0.0)
########################################
#
# Declarations
#
## <desc>
## <p>
## Allow bittorrent servers to modify
## public files used for public file
## transfer services. Directories/Files
## must be labeled public_content_rw_t.
## </p>
## </desc>
gen_tunable(allow_httpd_anon_write, false)
## <desc>
## <p>
## Allow bittorrent servers to use cifs
## used for public file transfer services.
## </p>
## </desc>
gen_tunable(allow_bittorrentd_use_cifs, false)
## <desc>
## <p>
## Allow bittorrent servers to use nfs
## used for public file transfer services.
## </p>
## </desc>
gen_tunable(allow_bittorrentd_use_nfs, false)
type bittorrentd_t;
type bittorrentd_exec_t;
init_daemon_domain(bittorrentd_t, bittorrentd_exec_t)
type bittorrentd_initrc_exec_t;
init_script_file(bittorrentd_initrc_exec_t)
type bittorrentd_etc_t;
files_config_file(bittorrentd_etc_t)
type bittorrentd_var_lib_t;
files_type(bittorrentd_var_lib_t)
type bittorrentd_var_log_t;
logging_log_file(bittorrentd_var_log_t)
########################################
#
# Local policy
#
allow bittorrentd_t self:capability { setgid setuid };
dontaudit bittorrentd_t self:capability sys_tty_config;
allow bittorrentd_t self:process { getsched setsched };
allow bittorrentd_t self:fifo_file rw_fifo_file_perms;
allow bittorrentd_t self:tcp_socket { accept listen };
allow bittorrentd_t self:unix_stream_socket create_socket_perms;
manage_dirs_pattern(bittorrentd_t, bittorrentd_var_lib_t,
bittorrentd_var_lib_t)
manage_files_pattern(bittorrentd_t, bittorrentd_var_lib_t,
bittorrentd_var_lib_t)
allow bittorrentd_t bittorrentd_var_log_t:file { create_file_perms
setattr_file_perms append_file_perms };
logging_log_filetrans(bittorrentd_t, bittorrentd_var_log_t, file)
kernel_read_network_state(bittorrentd_t)
corenet_all_recvfrom_unlabeled(bittorrentd_t)
corenet_all_recvfrom_netlabel(bittorrentd_t)
corenet_tcp_sendrecv_generic_if(bittorrentd_t)
corenet_udp_sendrecv_generic_if(bittorrentd_t)
corenet_tcp_sendrecv_generic_node(bittorrentd_t)
corenet_udp_sendrecv_generic_node(bittorrentd_t)
corenet_tcp_bind_generic_node(bittorrentd_t)
corenet_udp_bind_generic_node(bittorrentd_t)
corenet_tcp_bind_bittorrent_ctl_port(bittorrentd_t)
corenet_tcp_sendrecv_bittorrent_ctl_port(bittorrentd_t)
corenet_sendrecv_bittorrent_ctl_server_packets(bittorrentd_t)
dev_read_urand(bittorrentd_t)
domain_use_interactive_fds(bittorrentd_t)
files_search_var_lib(bittorrentd_t)
files_search_pids(bittorrentd_t)
fs_search_auto_mountpoints(bittorrentd_t)
auth_use_nsswitch(bittorrentd_t)
logging_send_syslog_msg(bittorrentd_t)
miscfiles_read_localization(bittorrentd_t)
miscfiles_read_public_files(bittorrentd_t)
tunable_policy(`allow_bittorrent_anon_write',`
miscfiles_manage_public_files(bittorrentd_t)
')
tunable_policy(`allow_bittorrentd_use_cifs',`
fs_manage_cifs_dirs(bittorrentd_t)
fs_manage_cifs_files(bittorrentd_t)
')
tunable_policy(`allow_bittorrentd_use_nfs',`
fs_manage_nfs_dirs(bittorrentd_t)
fs_manage_nfs_files(bittorrentd_t)
')
optional_policy(`
seutil_sigchld_newrole(bittorrentd_t)
')
bittorrent.if: create bittorrent_admin()
## <summary>Bittorrent peer-to-peer communications protocol for file
sharing.</summary>
########################################
## <summary>
## Read bittorrent daemon
## configuration files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`bittorrent_read_daemon_config_files',`
gen_require(`
type bittorrentd_etc_t;
')
files_search_etc($1)
allow $1 bittorrentd_etc_t:file read_file_perms;
')
########################################
## <summary>
## All of the rules required to
## administrate an bittorrent
## environment.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`bittorrent_admin',`
gen_require(`
type bittorrentd_t; bittorrentd_initrc_exec_t;
type bittorrentd_etc_t, bittorrentd_var_log_t;
type bittorrentd_var_lib_t;
')
allow $1 bittorrentd_t:process { ptrace signal_perms };
ps_process_pattern($1, bittorrentd_t)
init_labeled_script_domtrans($1, bittorrentd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 bittorrentd_initrc_exec_t system_r;
allow $2 system_r;
miscfiles_manage_public_files($1)
files_list_etc($1)
admin_pattern($1, bittorrentd_etc_t)
logging_list_logs($1)
admin_pattern($1, bittorrentd_var_log_t)
files_list_var_lib($1)
admin_pattern($1, bittorrentd_var_lib_t)
')
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk26sukACgkQMlxVo39jgT/uHwCghqxyuCJALPKR/YpVyobmvYoW
e38AoLN0fAOuf+bEMA4xUsm8dTESboFb
=NUCj
-----END PGP SIGNATURE-----