pritunl_web.te

policy_module(pritunl_web, 1.0.0)

require {
  type pritunl_t;
  type pritunl_tmp_t;
  type pritunl_var_log_t;

  type http_port_t;
  type net_conf_t;
  type node_t;
  type proc_net_t;
  type sysctl_net_t;
  type unreserved_port_t;
}

type pritunl_web_t;
type pritunl_web_exec_t;
domain_type(pritunl_web_t)
domain_entry_file(pritunl_web_t, pritunl_web_exec_t)
init_daemon_domain(pritunl_web_t, pritunl_web_exec_t)

type_transition pritunl_t pritunl_web_exec_t:process pritunl_web_t;

allow pritunl_web_t pritunl_t:fifo_file { read write ioctl };
allow pritunl_web_t pritunl_t:process sigchld;
allow pritunl_web_t pritunl_t:netlink_route_socket { read write ioctl };
allow pritunl_web_t pritunl_t:tcp_socket { read write ioctl };
allow pritunl_web_t pritunl_t:udp_socket { read write ioctl };
allow pritunl_web_t pritunl_t:unix_stream_socket { read write ioctl };
allow pritunl_web_t pritunl_var_log_t:file append;
allow pritunl_web_t pritunl_tmp_t:dir search;
allow pritunl_web_t pritunl_tmp_t:file { getattr open read };

allow pritunl_web_t http_port_t:tcp_socket name_bind;
allow pritunl_web_t net_conf_t:file { getattr open read };
allow pritunl_web_t node_t:tcp_socket node_bind;
allow pritunl_web_t proc_net_t:file read;
allow pritunl_web_t self:capability { net_bind_service net_admin };
allow pritunl_web_t self:capability2 block_suspend;
allow pritunl_web_t self:netlink_route_socket { bind create getattr nlmsg_read read write };
allow pritunl_web_t self:tcp_socket { accept bind connect create getattr getopt ioctl listen setopt shutdown read write };
allow pritunl_web_t self:udp_socket { accept bind connect create getattr getopt ioctl listen setopt shutdown read write };
allow pritunl_web_t self:unix_dgram_socket { create ioctl };
allow pritunl_web_t sysctl_net_t:dir search;
allow pritunl_web_t sysctl_net_t:file { open read };
allow pritunl_web_t unreserved_port_t:tcp_socket name_connect;