Update pritunl web selinux

jo-ruch · Mar 1, 2018 · 0c8bd53 · 0c8bd53
1 parent 7ba934d
commit 0c8bd53
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 8 deletions.
diff --git a/selinux-web/pritunl_web.fc → selinux/pritunl_web.fc b/selinux-web/pritunl_web.fc → selinux/pritunl_web.fc
diff --git a/selinux-web/pritunl_web.te → selinux/pritunl_web.te b/selinux-web/pritunl_web.te → selinux/pritunl_web.te
@@ -2,13 +2,12 @@ policy_module(pritunl_web, 1.0.0)
 
 require {
   type pritunl_t;
+  type pritunl_tmp_t;
   type pritunl_var_log_t;
 
   type http_port_t;
   type net_conf_t;
   type node_t;
-  type pritunl_t;
-  type pritunl_tmp_t;
   type proc_net_t;
   type sysctl_net_t;
   type unreserved_port_t;
@@ -22,11 +21,12 @@ init_daemon_domain(pritunl_web_t, pritunl_web_exec_t)
 
 type_transition pritunl_t pritunl_web_exec_t:process pritunl_web_t;
 
-allow pritunl_web_t pritunl_t:fifo_file { read write };
+allow pritunl_web_t pritunl_t:fifo_file { read write ioctl };
 allow pritunl_web_t pritunl_t:process sigchld;
-allow pritunl_web_t pritunl_t:netlink_route_socket { read write };
-allow pritunl_web_t pritunl_t:udp_socket { read write };
-allow pritunl_web_t pritunl_t:fifo_file ioctl;
+allow pritunl_web_t pritunl_t:netlink_route_socket { read write ioctl };
+allow pritunl_web_t pritunl_t:tcp_socket { read write ioctl };
+allow pritunl_web_t pritunl_t:udp_socket { read write ioctl };
+allow pritunl_web_t pritunl_t:unix_stream_socket { read write ioctl };
 allow pritunl_web_t pritunl_var_log_t:file append;
 allow pritunl_web_t pritunl_tmp_t:dir search;
 allow pritunl_web_t pritunl_tmp_t:file { getattr open read };
@@ -36,9 +36,10 @@ allow pritunl_web_t net_conf_t:file { getattr open read };
 allow pritunl_web_t node_t:tcp_socket node_bind;
 allow pritunl_web_t proc_net_t:file read;
 allow pritunl_web_t self:capability { net_bind_service net_admin };
+allow pritunl_web_t self:capability2 block_suspend;
 allow pritunl_web_t self:netlink_route_socket { bind create getattr nlmsg_read read write };
-allow pritunl_web_t self:tcp_socket { accept bind connect create getattr getopt listen setopt read write };
-allow pritunl_web_t self:udp_socket { connect create getattr };
+allow pritunl_web_t self:tcp_socket { accept bind connect create getattr getopt ioctl listen setopt shutdown read write };
+allow pritunl_web_t self:udp_socket { accept bind connect create getattr getopt ioctl listen setopt shutdown read write };
 allow pritunl_web_t self:unix_dgram_socket { create ioctl };
 allow pritunl_web_t sysctl_net_t:dir search;
 allow pritunl_web_t sysctl_net_t:file { open read };