-
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
8 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,40 +1,28 @@ | ||
module mpd_local 1.0; | ||
|
||
require { | ||
type var_run_t; | ||
type automount_t; | ||
type unconfined_service_t; | ||
type alsa_home_t; | ||
type alsa_var_lib_t; | ||
type config_home_t; | ||
type mpd_t; | ||
type mpd_home_t; | ||
type mpd_port_t; | ||
type mpd_t; | ||
type nfs_t; | ||
type unconfined_service_t; | ||
type user_home_dir_t; | ||
class sock_file write; | ||
class unix_stream_socket connectto; | ||
class file { getattr open read }; | ||
type var_run_t; | ||
class dir { search }; | ||
class file { getattr open read }; | ||
class sock_file write; | ||
class tcp_socket { listen name_bind name_connect accept create node_bind setopt bind getattr }; | ||
class unix_stream_socket connectto; | ||
} | ||
#============= mpd_t ============== | ||
allow mpd_t alsa_home_t:file { getattr open read }; | ||
allow mpd_t alsa_var_lib_t:dir search; | ||
allow mpd_t unconfined_service_t:unix_stream_socket connectto; | ||
allow mpd_t var_run_t:sock_file write; | ||
|
||
#============= automount_t ============== | ||
allow automount_t var_run_t:sock_file write; | ||
|
||
#!!!! This avc is allowed in the current policy | ||
allow mpd_t config_home_t:dir search; | ||
|
||
#!!!! This avc is allowed in the current policy | ||
allow mpd_t mpd_port_t:tcp_socket name_connect; | ||
|
||
#!!!! This avc is allowed in the current policy | ||
allow mpd_t nfs_t:dir search; | ||
|
||
#!!!! This avc is allowed in the current policy | ||
allow mpd_t var_run_t:sock_file write; | ||
allow mpd_t user_home_dir_t:dir search; | ||
allow mpd_t unconfined_service_t:unix_stream_socket connectto; |