Gecko [ 122.154.134.11 ]

Name	Size	Permission
application.if	4.2 KB	-rw-r--r--
authlogin.if	33.85 KB	-rw-r--r--
clock.if	1.9 KB	-rw-r--r--
daemontools.if	4.21 KB	-rw-r--r--
fstools.if	2.95 KB	-rw-r--r--
getty.if	1.72 KB	-rw-r--r--
hostname.if	1.24 KB	-rw-r--r--
hotplug.if	3.29 KB	-rw-r--r--
init.if	41.11 KB	-rw-r--r--
ipsec.if	8 KB	-rw-r--r--
iptables.if	3.27 KB	-rw-r--r--
iscsi.if	1.51 KB	-rw-r--r--
kdump.if	2.18 KB	-rw-r--r--
libraries.if	10.88 KB	-rw-r--r--
locallogin.if	2.85 KB	-rw-r--r--
logging.if	23.83 KB	-rw-r--r--
lvm.if	3.91 KB	-rw-r--r--
miscfiles.if	15.45 KB	-rw-r--r--
modutils.if	6.94 KB	-rw-r--r--
mount.if	7.07 KB	-rw-r--r--
netlabel.if	1013 B	-rw-r--r--
pcmcia.if	3.01 KB	-rw-r--r--
raid.if	1.38 KB	-rw-r--r--
selinuxutil.if	35.72 KB	-rw-r--r--
setrans.if	977 B	-rw-r--r--
sosreport.if	2.41 KB	-rw-r--r--
sysnetwork.if	16.6 KB	-rw-r--r--
udev.if	5.99 KB	-rw-r--r--
unconfined.if	4.33 KB	-rw-r--r--
userdomain.if	103.05 KB	-rw-r--r--
xen.if	4.76 KB	-rw-r--r--

Code Editor : ipsec.if

## <summary>TCP/IP encryption</summary>

########################################
## <summary>
##	Execute ipsec in the ipsec domain.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_domtrans',`
	gen_require(`
		type ipsec_t, ipsec_exec_t;
	')

domtrans_pattern($1, ipsec_exec_t, ipsec_t)
')

#######################################
## <summary>
##  Execute ipsec in the ipsec_mgmt domain.
## </summary>
## <param name="domain">
##  <summary>
##  The type of the process performing this action.
##  </summary>
## </param>
#
interface(`ipsec_domtrans_mgmt',`
	gen_require(`
        type ipsec_mgmt_t, ipsec_mgmt_exec_t;
    ')

domtrans_pattern($1, ipsec_mgmt_exec_t, ipsec_mgmt_t)
')

########################################
## <summary>
##	Connect to IPSEC using a unix domain stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_stream_connect',`
	gen_require(`
		type ipsec_t, ipsec_var_run_t;
	')

files_search_pids($1)
	stream_connect_pattern($1, ipsec_var_run_t, ipsec_var_run_t, ipsec_t)
')

########################################
## <summary>
##	Connect to racoon using a unix domain stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_stream_connect_racoon',`
	gen_require(`
		type racoon_t, ipsec_var_run_t;
	')

files_search_pids($1)
	stream_connect_pattern($1, ipsec_var_run_t, ipsec_var_run_t, racoon_t)
')

########################################
## <summary>
##	Get the attributes of an IPSEC key socket.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_getattr_key_sockets',`
	gen_require(`
		type ipsec_t;
	')

allow $1 ipsec_t:key_socket getattr;
')

########################################
## <summary>
##	Execute the IPSEC management program in the caller domain.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_exec_mgmt',`
	gen_require(`
		type ipsec_exec_t;
	')

can_exec($1, ipsec_exec_t)
')

########################################
## <summary>
##	Read the IPSEC configuration
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
## <rolecap/>
#
interface(`ipsec_read_config',`
	gen_require(`
		type ipsec_conf_file_t;
	')

files_search_etc($1)
	allow $1 ipsec_conf_file_t:file read_file_perms;
')

########################################
## <summary>
##	Match the default SPD entry.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ipsec_match_default_spd',`
	gen_require(`
		type ipsec_spd_t;
	')

allow $1 ipsec_spd_t:association polmatch;
	allow $1 self:association sendto;
	allow $1 self:peer recv;
')

########################################
## <summary>
##	Set the context of a SPD entry to
##	the default context.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ipsec_setcontext_default_spd',`
	gen_require(`
		type ipsec_spd_t;
	')

allow $1 ipsec_spd_t:association setcontext;
')

########################################
## <summary>
##	write the ipsec_var_run_t files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ipsec_write_pid',`
	gen_require(`
		type ipsec_var_run_t;
	')

files_search_pids($1)
	write_files_pattern($1, ipsec_var_run_t, ipsec_var_run_t)
')

########################################
## <summary>
##	Allow read the IPSEC pid files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ipsec_read_pid',`
	gen_require(`
		type ipsec_var_run_t;
	')

files_search_pids($1)
	read_files_pattern($1, ipsec_var_run_t, ipsec_var_run_t)
	read_sock_files_pattern($1, ipsec_var_run_t, ipsec_var_run_t)
')

########################################
## <summary>
##	Create, read, write, and delete the IPSEC pid files.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_manage_pid',`
	gen_require(`
		type ipsec_var_run_t;
	')

files_search_pids($1)
	manage_files_pattern($1, ipsec_var_run_t, ipsec_var_run_t)
')

########################################
## <summary>
##	Execute racoon in the racoon domain.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_domtrans_racoon',`
	gen_require(`
		type racoon_t, racoon_exec_t;
	')

domtrans_pattern($1, racoon_exec_t, racoon_t)
')

########################################
## <summary>
##	Execute racoon and allow the specified role the domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`ipsec_run_racoon',`
	gen_require(`
		type racoon_t;
	')

ipsec_domtrans_racoon($1)
	role $2 types racoon_t;
')

########################################
## <summary>
##	Execute setkey in the setkey domain.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_domtrans_setkey',`
	gen_require(`
		type setkey_t, setkey_exec_t;
	')

domtrans_pattern($1, setkey_exec_t, setkey_t)
')

########################################
## <summary>
##	Execute setkey and allow the specified role the domains.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the racoon and setkey domains.
##	</summary>
## </param>
## <rolecap/>
#
interface(`ipsec_run_setkey',`
	gen_require(`
		type setkey_t;
	')

ipsec_domtrans_setkey($1)
	role $2 types setkey_t;
')

#######################################
## <summary>
##  Send the kill signal to ipsec-mgmt
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
#
interface(`ipsec_mgmt_kill',`
    gen_require(`
        type ipsec_mgmt_t;
    ')

allow $1 ipsec_mgmt_t:process sigkill;
')

########################################
## <summary>
##	Send a generic signal to ipsec-mgmt
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ipsec_mgmt_signal',`
	gen_require(`
		type ipsec_mgmt_t;
	')

allow $1 ipsec_mgmt_t:process signal;
')

########################################
## <summary>
##  Send a generic signull to ipsec-mgmt.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
#
interface(`ipsec_mgmt_signull',`
    gen_require(`
        type ipsec_mgmt_t;
    ')

allow $1 ipsec_mgmt_t:process signull;
')

#######################################
## <summary>
##      Send and receive messages from
##      ipsec-mgmt over dbus.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`ipsec_mgmt_dbus_chat',`
        gen_require(`
                type ipsec_mgmt_t;
                class dbus send_msg;
        ')

allow $1 ipsec_mgmt_t:dbus send_msg;
        allow ipsec_mgmt_t $1:dbus send_msg;
')

########################################
## <summary>
##	Create, read, write, and delete ipsec-mgmt lock files.
## </summary>
## <param name="domain">
##	<summary>
##	The type of the process performing this action.
##	</summary>
## </param>
#
interface(`ipsec_mgmt_manage_lock_files',`
    gen_require(`
        type ipsec_mgmt_lock_t;
    ')

files_search_locks($1)
    manage_files_pattern($1, ipsec_mgmt_lock_t, ipsec_mgmt_lock_t)
')

${this.title}

Code Editor : ipsec.if