Index: policy/modules/kernel/corenetwork.te.in
===================================================================
--- policy/modules/kernel/corenetwork.te.in (revision 2481)
+++ policy/modules/kernel/corenetwork.te.in (working copy)
@@ -177,7 +177,11 @@
network_port(xserver, tcp, 6000, s0, tcp,6001,s0, tcp,6002,s0, tcp,6003,s0, tcp,6004,s0, tcp,6005,s0, tcp,6006,s0, tcp,6007,s0, tcp,6008,s0, tcp,6009,s0, tcp,6010,s0, tcp,6011,s0, tcp,6012,s0, tcp,6013,s0, tcp,6014,s0, tcp,6015,s0, tcp,6016,s0, tcp,6017,s0, tcp,6018,s0, tcp,6019,s0, tcp,6020,s0)
network_port(zebra, tcp,2600,s0, tcp,2601,s0, tcp,2602,s0, tcp,2603,s0, tcp,2604,s0, tcp,2606,s0, udp,2600,s0, udp,2601,s0, udp,2602,s0, udp,2603,s0, udp,2604,s0, udp,2606,s0)
network_port(zope, tcp,8021,s0)
+network_port(eggdrop, tcp, 3333, s0)
+network_port(eggdropdcc, tcp, 2010, s0, tcp, 2011, s0, tcp, 2012, s0, tcp, 2013, s0, tcp, 2014, s0, tcp, 2015, s0, tcp, 2016, s0, tcp, 2017, s0, tcp, 2018, s0, tcp, 2019, s0, tcp, 2020, s0)
+network_port(ircdcc, tcp, 4990, s0, tcp, 4991, s0, tcp, 4992, s0, tcp, 4993, s0, tcp, 4994, s0, tcp, 4995, s0, tcp, 4996, s0, tcp, 4997, s0, tcp, 4998, s0, tcp, 4999, s0, tcp, 5000, s0)
+
# Defaults for reserved ports. Earlier portcon entries take precedence;
# these entries just cover any remaining reserved ports not otherwise declared.
Index: policy/modules/apps/irssi.fc
===================================================================
--- policy/modules/apps/irssi.fc (revision 0)
+++ policy/modules/apps/irssi.fc (revision 0)
@@ -0,0 +1,7 @@
+/usr/bin/irssi -- gen_context(system_u:object_r:irssi_exec_t,s0)
+
+/usr/bin/motti -- gen_context(system_u:object_r:irssi_exec_t,s0)
+
+HOME_DIR/\.irssi(/.*)? gen_context(system_u:object_r:ROLE_irssi_home_t,s0)
+
+/etc/irssi.conf -- gen_context(system_u:object_r:irssi_etc_t,s0)
Index: policy/modules/apps/eggdrop.if
===================================================================
--- policy/modules/apps/eggdrop.if (revision 0)
+++ policy/modules/apps/eggdrop.if (revision 0)
@@ -0,0 +1,347 @@
+## SELinux policy module
+##
+##
+## SELinux policy module for Eggdrop
+##
+##
+
+#######################################
+##
+## The per role template for the Eggdrop module.
+##
+##
+##
+## This template creates derived domains which are used
+## for Eggdrop.
+##
+##
+## This template is invoked automatically for each user, and
+## generally does not need to be invoked directly
+## by policy writers.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## The type of the user domain.
+##
+##
+##
+##
+## The role associated with the user domain.
+##
+##
+#
+template(`eggdrop_per_role_template',`
+ gen_require(`
+ type eggdrop_exec_t;
+ ')
+ gen_tunable(eggdrop_confine_$1,false)
+
+ ########################################
+ #
+ # Declarations
+ #
+ type $1_eggdrop_t;
+ application_domain($1_eggdrop_t,eggdrop_exec_t)
+ role $3 types $1_eggdrop_t;
+
+ type $1_eggdrop_home_t;
+ files_poly_member($1_eggdrop_home_t)
+ userdom_user_home_content($1,$1_eggdrop_home_t)
+
+ type $1_eggdrop_tmp_t;
+ files_poly_member_tmp($1_eggdrop_t,$1_eggdrop_tmp_t)
+ files_tmp_file($1_eggdrop_tmp_t)
+
+ ########################################
+ #
+ # Local Policy
+ #
+ allow $1_eggdrop_t self:fifo_file rw_fifo_file_perms;
+ allow $1_eggdrop_t self:process setpgid;
+ allow $1_eggdrop_t self:tcp_socket { setopt read bind create write getattr connect listen accept };
+ allow $1_eggdrop_t self:udp_socket { write bind create read setopt connect };
+
+ allow $1_eggdrop_t $2:fd use;
+ allow $1_eggdrop_t $2:process sigchld;
+
+ allow $2 $1_eggdrop_t:fd use;
+ allow $2 $1_eggdrop_t:process ptrace;
+
+ manage_dirs_pattern($1_eggdrop_t,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ manage_files_pattern($1_eggdrop_t,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ manage_sock_files_pattern($1_eggdrop_t,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ manage_lnk_files_pattern($1_eggdrop_t,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ manage_fifo_files_pattern($1_eggdrop_t,$1_eggdrop_home_t,$1_eggdrop_home_t)
+
+ userdom_user_home_dir_filetrans($1,$1_eggdrop_t,$1_eggdrop_home_t,{ dir sock_file file lnk_file fifo_file })
+
+ userdom_search_user_home_dirs($1,$1_eggdrop_t)
+
+ manage_dirs_pattern($1_eggdrop_t,$1_eggdrop_tmp_t,$1_eggdrop_tmp_t)
+ manage_files_pattern($1_eggdrop_t,$1_eggdrop_tmp_t,$1_eggdrop_tmp_t)
+ manage_sock_files_pattern($1_eggdrop_t,$1_eggdrop_tmp_t,$1_eggdrop_tmp_t)
+ manage_lnk_files_pattern($1_eggdrop_t,$1_eggdrop_tmp_t,$1_eggdrop_tmp_t)
+ manage_fifo_files_pattern($1_eggdrop_t,$1_eggdrop_tmp_t,$1_eggdrop_tmp_t)
+
+ files_tmp_filetrans($1_eggdrop_t,$1_eggdrop_tmp_t,{ file dir lnk_file fifo_file sock_file })
+
+ manage_dirs_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ manage_files_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ manage_sock_files_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ manage_lnk_files_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ manage_fifo_files_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+
+ relabel_dirs_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ relabel_files_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ relabel_sock_files_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ relabel_fifo_files_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+ relabel_lnk_files_pattern($2,$1_eggdrop_home_t,$1_eggdrop_home_t)
+
+ corenet_tcp_bind_eggdrop_port($1_eggdrop_t)
+ corenet_tcp_connect_eggdrop_port($1_eggdrop_t)
+ corenet_tcp_sendrecv_eggdrop_port($1_eggdrop_t)
+
+ corenet_tcp_bind_eggdropdcc_port($1_eggdrop_t)
+ corenet_tcp_connect_eggdropdcc_port($1_eggdrop_t)
+ corenet_tcp_sendrecv_eggdropdcc_port($1_eggdrop_t)
+
+ corenet_tcp_connect_ircd_port($1_eggdrop_t)
+ corenet_tcp_sendrecv_ircd_port($1_eggdrop_t)
+
+ corenet_tcp_connect_auth_port($1_eggdrop_t)
+ corenet_tcp_sendrecv_auth_port($1_eggdrop_t)
+
+ corenet_tcp_connect_ircdcc_port($1_eggdrop_t)
+ corenet_tcp_sendrecv_ircdcc_port($1_eggdrop_t)
+
+ corenet_all_recvfrom_netlabel($1_eggdrop_t)
+ corenet_all_recvfrom_unlabeled($1_eggdrop_t)
+ corenet_tcp_sendrecv_all_if($1_eggdrop_t)
+ corenet_tcp_sendrecv_all_nodes($1_eggdrop_t)
+ corenet_tcp_bind_all_nodes($1_eggdrop_t)
+ # Could this be corenet_udp_bind_all_nodes?
+ corenet_udp_bind_inaddr_any_node($1_eggdrop_t)
+ corenet_raw_sendrecv_generic_if($1_eggdrop_t)
+ corenet_raw_sendrecv_all_nodes($1_eggdrop_t)
+ corenet_sendrecv_generic_client_packets($1_eggdrop_t)
+
+ corenet_dontaudit_tcp_sendrecv_generic_port($1_eggdrop_t)
+ corenet_dontaudit_tcp_bind_generic_port($1_eggdrop_t)
+ corenet_dontaudit_tcp_connect_all_ports($1_eggdrop_t)
+
+ kernel_dontaudit_list_unlabeled($1_eggdrop_t)
+ kernel_dontaudit_getattr_unlabeled_files($1_eggdrop_t)
+ kernel_dontaudit_read_unlabeled_files($1_eggdrop_t)
+
+ files_dontaudit_list_non_security($1_eggdrop_t)
+ files_dontaudit_getattr_non_security_files($1_eggdrop_t)
+
+ fs_dontaudit_getattr_all_fs($1_eggdrop_t)
+
+ term_dontaudit_getattr_pty_dirs($1_eggdrop_t)
+
+ selinux_dontaudit_getattr_fs($1_eggdrop_t)
+
+ dev_dontaudit_getattr_all_blk_files($1_eggdrop_t)
+ dev_dontaudit_getattr_all_chr_files($1_eggdrop_t)
+
+ fs_search_auto_mountpoints($1_eggdrop_t)
+
+ can_exec($1_eggdrop_t,eggdrop_exec_t)
+
+ allow $2 $1_eggdrop_t:process { noatsecure siginh rlimitinh };
+
+ ps_process_pattern($2,$1_eggdrop_t)
+ allow $2 $1_eggdrop_t:process signal_perms;
+
+ sysnet_read_config($1_eggdrop_t)
+
+ libs_exec_lib_files($1_eggdrop_t)
+ libs_use_ld_so($1_eggdrop_t)
+
+ files_read_etc_files($1_eggdrop_t)
+
+ files_read_usr_files($1_eggdrop_t)
+ files_read_usr_symlinks($1_eggdrop_t)
+
+ miscfiles_read_localization($1_eggdrop_t)
+
+ corecmd_exec_bin($1_eggdrop_t)
+ corecmd_bin_entry_type($1_eggdrop_t)
+ corecmd_read_bin_symlinks($1_eggdrop_t)
+
+ corecmd_shell_entry_type($1_eggdrop_t)
+
+ corecmd_dontaudit_exec_all_executables($1_eggdrop_t)
+
+ dev_read_urand($1_eggdrop_t)
+
+ userdom_use_user_terminals($1,$1_eggdrop_t)
+
+ ifdef(`enable_mls',`',`
+ fs_search_removable($1_eggdrop_t)
+ fs_read_removable_files($1_eggdrop_t)
+ fs_read_removable_symlinks($1_eggdrop_t)
+ ')
+
+ tunable_policy(`eggdrop_confine_$1',`
+ domain_auto_trans($2,eggdrop_exec_t,$1_eggdrop_t)
+ ',`
+ can_exec($2,eggdrop_exec_t)
+ ')
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_dirs($1_eggdrop_t)
+ fs_manage_nfs_files($1_eggdrop_t)
+ fs_manage_nfs_symlinks($1_eggdrop_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_dirs($1_eggdrop_t)
+ fs_manage_cifs_files($1_eggdrop_t)
+ fs_manage_cifs_symlinks($1_eggdrop_t)
+ ')
+')
+
+########################################
+##
+## Read Eggdrop per user homedir
+##
+##
+##
+## Read Eggdrop per user homedir
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`eggdrop_read_user_home_files',`
+ gen_require(`
+ type $1_eggdrop_home_t;
+ ')
+
+ allow $2 $1_eggdrop_home_t:dir list_dir_perms;
+ allow $2 $1_eggdrop_home_t:file read_file_perms;
+')
+
+########################################
+##
+## Write Eggdrop per user homedir
+##
+##
+##
+## Write Eggdrop per user homedir
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`eggdrop_write_user_home_files',`
+ gen_require(`
+ type $1_eggdrop_home_t;
+ ')
+
+ allow $2 $1_eggdrop_home_t:dir list_dir_perms;
+ allow $2 $1_eggdrop_home_t:file write;
+')
+
+########################################
+##
+## Run Eggdrop in user Eggdrop domain.
+##
+##
+##
+## Run Eggdrop in user Eggdrop domain.
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`eggdrop_domtrans_user_eggdrop',`
+ gen_require(`
+ type $1_eggdrop_t,eggdrop_exec_t;
+ ')
+
+ domtrans_pattern($2,eggdrop_exec_t,$1_eggdrop_t)
+')
+
+########################################
+##
+## Read/write Eggdrop per user tcp_socket
+##
+##
+##
+## Read/write Eggdrop per user tcp_socket
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`eggdrop_rw_user_tcp_sockets',`
+ gen_require(`
+ type $1_eggdrop_t;
+ ')
+
+ allow $2 $1_eggdrop_t:tcp_socket rw_socket_perms;
+')
+
+
Index: policy/modules/apps/eggdrop.fc
===================================================================
--- policy/modules/apps/eggdrop.fc (revision 0)
+++ policy/modules/apps/eggdrop.fc (revision 0)
@@ -0,0 +1,3 @@
+/usr/bin/eggdrop -- gen_context(system_u:object_r:eggdrop_exec_t,s0)
+
+HOME_DIR/\eggdrop(/.*)? gen_context(system_u:object_r:ROLE_eggdrop_home_t,s0)
Index: policy/modules/apps/irssi.te
===================================================================
--- policy/modules/apps/irssi.te (revision 0)
+++ policy/modules/apps/irssi.te (revision 0)
@@ -0,0 +1,11 @@
+policy_module(irssi,1.0.0)
+
+########################################
+#
+# Declarations
+#
+type irssi_exec_t;
+application_executable_file(irssi_exec_t)
+
+type irssi_etc_t;
+files_config_file(irssi_etc_t)
Index: policy/modules/apps/irssi.if
===================================================================
--- policy/modules/apps/irssi.if (revision 0)
+++ policy/modules/apps/irssi.if (revision 0)
@@ -0,0 +1,341 @@
+## SELinux policy module
+##
+##
+## SELinux policy module for Irssi
+##
+##
+
+#######################################
+##
+## The per role template for the Irssi module.
+##
+##
+##
+## This template creates derived domains which are used
+## for Irssi.
+##
+##
+## This template is invoked automatically for each user, and
+## generally does not need to be invoked directly
+## by policy writers.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## The type of the user domain.
+##
+##
+##
+##
+## The role associated with the user domain.
+##
+##
+#
+template(`irssi_per_role_template',`
+ gen_require(`
+ type irssi_exec_t;
+ ')
+ gen_tunable(irssi_confine_$1,false)
+
+ ########################################
+ #
+ # Declarations
+ #
+ type $1_irssi_t;
+ application_domain($1_irssi_t,irssi_exec_t)
+ role $3 types $1_irssi_t;
+
+ type $1_irssi_home_t;
+ files_poly_member($1_irssi_home_t)
+ userdom_user_home_content($1,$1_irssi_home_t)
+
+ type $1_irssi_tmp_t;
+ files_poly_member_tmp($1_irssi_t,$1_irssi_tmp_t)
+ files_tmp_file($1_irssi_tmp_t)
+
+ ########################################
+ #
+ # Local Policy
+ #
+ allow $1_irssi_t self:fifo_file rw_fifo_file_perms;
+ allow $1_irssi_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
+ allow $1_irssi_t self:tcp_socket { write accept getattr bind listen setopt read getopt create connect };
+ allow $1_irssi_t self:udp_socket { write read create connect getattr };
+
+ allow $1_irssi_t $2:fd use;
+ allow $1_irssi_t $2:process sigchld;
+
+ allow $2 $1_irssi_t:fd use;
+ allow $2 $1_irssi_t:process ptrace;
+
+ manage_dirs_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
+ manage_files_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
+ manage_sock_files_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
+ manage_lnk_files_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
+ manage_fifo_files_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
+
+ userdom_user_home_dir_filetrans($1,$1_irssi_t,$1_irssi_home_t,{ dir sock_file file lnk_file fifo_file })
+
+ userdom_search_user_home_dirs($1,$1_irssi_t)
+
+ manage_dirs_pattern($1_irssi_t,$1_irssi_tmp_t,$1_irssi_tmp_t)
+ manage_files_pattern($1_irssi_t,$1_irssi_tmp_t,$1_irssi_tmp_t)
+ manage_sock_files_pattern($1_irssi_t,$1_irssi_tmp_t,$1_irssi_tmp_t)
+ manage_lnk_files_pattern($1_irssi_t,$1_irssi_tmp_t,$1_irssi_tmp_t)
+ manage_fifo_files_pattern($1_irssi_t,$1_irssi_tmp_t,$1_irssi_tmp_t)
+
+ files_tmp_filetrans($1_irssi_t,$1_irssi_tmp_t,{ file dir lnk_file fifo_file sock_file })
+
+ manage_dirs_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+ manage_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+ manage_sock_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+ manage_lnk_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+ manage_fifo_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+
+ relabel_dirs_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+ relabel_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+ relabel_sock_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+ relabel_fifo_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+ relabel_lnk_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
+
+ corenet_tcp_bind_ircdcc_port($1_irssi_t)
+ corenet_tcp_connect_ircdcc_port($1_irssi_t)
+ corenet_tcp_sendrecv_ircdcc_port($1_irssi_t)
+
+ corenet_tcp_connect_ircd_port($1_irssi_t)
+ corenet_tcp_sendrecv_ircd_port($1_irssi_t)
+
+ corenet_tcp_connect_auth_port($1_irssi_t)
+ corenet_tcp_sendrecv_auth_port($1_irssi_t)
+
+ corenet_tcp_connect_eggdrop_port($1_irssi_t)
+ corenet_tcp_sendrecv_eggdrop_port($1_irssi_t)
+
+ corenet_all_recvfrom_netlabel($1_irssi_t)
+ corenet_all_recvfrom_unlabeled($1_irssi_t)
+ corenet_tcp_sendrecv_all_if($1_irssi_t)
+ corenet_tcp_sendrecv_all_nodes($1_irssi_t)
+ corenet_tcp_bind_all_nodes($1_irssi_t)
+ corenet_raw_sendrecv_generic_if($1_irssi_t)
+ corenet_raw_sendrecv_all_nodes($1_irssi_t)
+ corenet_sendrecv_generic_client_packets($1_irssi_t)
+
+ corenet_dontaudit_tcp_sendrecv_generic_port($1_irssi_t)
+ corenet_dontaudit_tcp_bind_generic_port($1_irssi_t)
+ corenet_dontaudit_tcp_connect_all_ports($1_irssi_t)
+
+ kernel_dontaudit_list_unlabeled($1_irssi_t)
+ kernel_dontaudit_getattr_unlabeled_files($1_irssi_t)
+ kernel_dontaudit_read_unlabeled_files($1_irssi_t)
+
+ files_dontaudit_list_non_security($1_irssi_t)
+ files_dontaudit_getattr_non_security_files($1_irssi_t)
+
+ fs_dontaudit_getattr_all_fs($1_irssi_t)
+
+ term_dontaudit_getattr_pty_dirs($1_irssi_t)
+
+ selinux_dontaudit_getattr_fs($1_irssi_t)
+
+ dev_dontaudit_getattr_all_blk_files($1_irssi_t)
+ dev_dontaudit_getattr_all_chr_files($1_irssi_t)
+
+ fs_search_auto_mountpoints($1_irssi_t)
+
+ can_exec($1_irssi_t,irssi_exec_t)
+
+ allow $2 $1_irssi_t:process { noatsecure siginh rlimitinh };
+
+ ps_process_pattern($2,$1_irssi_t)
+ allow $2 $1_irssi_t:process signal_perms;
+
+ sysnet_read_config($1_irssi_t)
+
+ libs_exec_lib_files($1_irssi_t)
+ libs_use_ld_so($1_irssi_t)
+
+ files_read_etc_files($1_irssi_t)
+
+ files_read_usr_files($1_irssi_t)
+ files_read_usr_symlinks($1_irssi_t)
+
+ miscfiles_read_localization($1_irssi_t)
+
+ corecmd_exec_bin($1_irssi_t)
+ corecmd_bin_entry_type($1_irssi_t)
+ corecmd_read_bin_symlinks($1_irssi_t)
+
+ corecmd_shell_entry_type($1_irssi_t)
+
+ corecmd_dontaudit_exec_all_executables($1_irssi_t)
+
+ dev_read_urand($1_irssi_t)
+
+ userdom_use_user_terminals($1,$1_irssi_t)
+
+ ifdef(`enable_mls',`',`
+ fs_search_removable($1_irssi_t)
+ fs_read_removable_files($1_irssi_t)
+ fs_read_removable_symlinks($1_irssi_t)
+ ')
+
+ tunable_policy(`irssi_confine_$1',`
+ domain_auto_trans($2,irssi_exec_t,$1_irssi_t)
+ ',`
+ can_exec($2,irssi_exec_t)
+ ')
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_dirs($1_irssi_t)
+ fs_manage_nfs_files($1_irssi_t)
+ fs_manage_nfs_symlinks($1_irssi_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_dirs($1_irssi_t)
+ fs_manage_cifs_files($1_irssi_t)
+ fs_manage_cifs_symlinks($1_irssi_t)
+ ')
+')
+
+########################################
+##
+## Read Irssi per user homedir
+##
+##
+##
+## Read Irssi per user homedir
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`irssi_read_user_home_files',`
+ gen_require(`
+ type $1_irssi_home_t;
+ ')
+
+ allow $2 $1_irssi_home_t:dir list_dir_perms;
+ allow $2 $1_irssi_home_t:file read_file_perms;
+')
+
+########################################
+##
+## Write Irssi per user homedir
+##
+##
+##
+## Write Irssi per user homedir
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`irssi_write_user_home_files',`
+ gen_require(`
+ type $1_irssi_home_t;
+ ')
+
+ allow $2 $1_irssi_home_t:dir list_dir_perms;
+ allow $2 $1_irssi_home_t:file write;
+')
+
+########################################
+##
+## Run Irssi in user Eggdrop domain.
+##
+##
+##
+## Run Irssi in user Eggdrop domain.
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`irssi_domtrans_user_eggdrop',`
+ gen_require(`
+ type $1_irssi_t,irssi_exec_t;
+ ')
+
+ domtrans_pattern($2,irssi_exec_t,$1_irssi_t)
+')
+
+########################################
+##
+## Read/write Irssi per user tcp_socket
+##
+##
+##
+## Read/write Irssi per user tcp_socket
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`irssi_rw_user_tcp_sockets',`
+ gen_require(`
+ type $1_irssi_t;
+ ')
+
+ allow $2 $1_irssi_t:tcp_socket rw_socket_perms;
+')
+
+
Index: policy/modules/apps/eggdrop.te
===================================================================
--- policy/modules/apps/eggdrop.te (revision 0)
+++ policy/modules/apps/eggdrop.te (revision 0)
@@ -0,0 +1,8 @@
+policy_module(eggdrop,1.0.0)
+
+########################################
+#
+# Declarations
+#
+type eggdrop_exec_t;
+application_executable_file(eggdrop_exec_t)