From ac71312ae6def80e9770c391db317b2b731a61d7 Mon Sep 17 00:00:00 2001 From: Marius Gavrilescu Date: Tue, 11 Feb 2014 14:20:09 +0200 Subject: [PATCH] Let gruntmasterd_t connect to DNS and HTTP --- selinux/gruntmasterd.te | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/selinux/gruntmasterd.te b/selinux/gruntmasterd.te index 9bcba33..1cb8f12 100644 --- a/selinux/gruntmasterd.te +++ b/selinux/gruntmasterd.te @@ -11,10 +11,12 @@ define(`gruntmaster_everything', `domain_everything_files(gruntmasterd_t, $1)') require{ type bin_t; + type http_port_t; type httpd_sys_content_rw_t; type httpd_sys_content_t; type httpd_t; type httpd_tmp_t; + type net_conf_t; type port_t; type proc_t; type urandom_device_t; @@ -65,6 +67,9 @@ allow gruntmasterd_t self:fifo_file everything_file_perms; allow gruntmasterd_t urandom_device_t:chr_file read_file_perms; allow gruntmasterd_t { gruntmaster_compile_exec_t gruntmaster_job_exec_t } : file execute; allow gruntmasterd_t port_t:tcp_socket name_connect; +allow gruntmasterd_t http_port_t:tcp_socket name_connect; +allow gruntmasterd_t net_conf_t:file { read getattr open }; +allow gruntmasterd_t self:udp_socket { write read create connect getattr }; allow gruntmasterd_t self:tcp_socket { read write create ioctl connect }; dontaudit gruntmasterd_t { gruntmaster_compile_t gruntmaster_job_t } : process noatsecure; -- 2.30.2