From 9dd8c6802987b027e40323b355433767df2ded82 Mon Sep 17 00:00:00 2001
From: Zachary Huff <zach.huff.386@gmail.com>
Date: Thu, 1 Mar 2018 00:18:25 -0500
Subject: [PATCH] Add pritunl dns selinux

---
 selinux/pritunl_dns.fc |  1 +
 selinux/pritunl_dns.te | 51 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 selinux/pritunl_dns.fc
 create mode 100644 selinux/pritunl_dns.te

diff --git a/selinux/pritunl_dns.fc b/selinux/pritunl_dns.fc
new file mode 100644
index 000000000..6acb8de7d
--- /dev/null
+++ b/selinux/pritunl_dns.fc
@@ -0,0 +1 @@
+/usr/bin/pritunl-dns -- gen_context(system_u:object_r:pritunl_dns_exec_t,s0)
diff --git a/selinux/pritunl_dns.te b/selinux/pritunl_dns.te
new file mode 100644
index 000000000..e96e585fb
--- /dev/null
+++ b/selinux/pritunl_dns.te
@@ -0,0 +1,51 @@
+policy_module(pritunl_dns, 1.0.0)
+
+require {
+  type pritunl_t;
+  type pritunl_tmp_t;
+  type pritunl_var_log_t;
+
+  type dns_port_t;
+  type http_port_t;
+  type mongod_port_t;
+  type net_conf_t;
+  type node_t;
+  type proc_net_t;
+  type sysctl_net_t;
+  type unreserved_port_t;
+}
+
+type pritunl_dns_t;
+type pritunl_dns_exec_t;
+domain_type(pritunl_dns_t)
+domain_entry_file(pritunl_dns_t, pritunl_dns_exec_t)
+init_daemon_domain(pritunl_dns_t, pritunl_dns_exec_t)
+
+type_transition pritunl_t pritunl_dns_exec_t:process pritunl_dns_t;
+
+allow pritunl_dns_t pritunl_t:fifo_file { read write ioctl };
+allow pritunl_dns_t pritunl_t:process sigchld;
+allow pritunl_dns_t pritunl_t:netlink_route_socket { read write ioctl };
+allow pritunl_dns_t pritunl_t:udp_socket { read write ioctl };
+allow pritunl_dns_t pritunl_t:unix_stream_socket { read write ioctl };
+allow pritunl_dns_t pritunl_t:fifo_file ioctl;
+allow pritunl_dns_t pritunl_var_log_t:file append;
+allow pritunl_dns_t pritunl_tmp_t:dir search;
+allow pritunl_dns_t pritunl_tmp_t:file { getattr open read };
+
+allow pritunl_dns_t dns_port_t:tcp_socket name_bind;
+allow pritunl_dns_t dns_port_t:udp_socket name_bind;
+allow pritunl_dns_t mongod_port_t:tcp_socket name_connect;
+allow pritunl_dns_t net_conf_t:file { getattr open read };
+allow pritunl_dns_t node_t:tcp_socket node_bind;
+allow pritunl_dns_t node_t:udp_socket node_bind;
+allow pritunl_dns_t proc_net_t:file read;
+allow pritunl_dns_t self:capability { net_bind_service net_admin };
+allow pritunl_dns_t self:capability2 block_suspend;
+allow pritunl_dns_t self:netlink_route_socket { bind create getattr nlmsg_read read write };
+allow pritunl_dns_t self:tcp_socket { accept bind connect create getattr getopt ioctl listen setopt shutdown read write };
+allow pritunl_dns_t self:udp_socket { accept bind connect create getattr getopt ioctl listen setopt shutdown read write };
+allow pritunl_dns_t self:unix_dgram_socket { create ioctl };
+allow pritunl_dns_t sysctl_net_t:dir search;
+allow pritunl_dns_t sysctl_net_t:file { open read };
+allow pritunl_dns_t unreserved_port_t:tcp_socket name_connect;