diff --git a/mpd_local.te b/mpd_local.te index ddd8ca0..ce0afbb 100644 --- a/mpd_local.te +++ b/mpd_local.te @@ -1,40 +1,28 @@ module mpd_local 1.0; require { - type var_run_t; - type automount_t; - type unconfined_service_t; type alsa_home_t; type alsa_var_lib_t; type config_home_t; - type mpd_t; type mpd_home_t; type mpd_port_t; + type mpd_t; type nfs_t; + type unconfined_service_t; type user_home_dir_t; - class sock_file write; - class unix_stream_socket connectto; - class file { getattr open read }; + type var_run_t; class dir { search }; + class file { getattr open read }; + class sock_file write; class tcp_socket { listen name_bind name_connect accept create node_bind setopt bind getattr }; + class unix_stream_socket connectto; } #============= mpd_t ============== allow mpd_t alsa_home_t:file { getattr open read }; allow mpd_t alsa_var_lib_t:dir search; -allow mpd_t unconfined_service_t:unix_stream_socket connectto; -allow mpd_t var_run_t:sock_file write; - -#============= automount_t ============== -allow automount_t var_run_t:sock_file write; - -#!!!! This avc is allowed in the current policy allow mpd_t config_home_t:dir search; - -#!!!! This avc is allowed in the current policy allow mpd_t mpd_port_t:tcp_socket name_connect; - -#!!!! This avc is allowed in the current policy allow mpd_t nfs_t:dir search; - -#!!!! This avc is allowed in the current policy +allow mpd_t var_run_t:sock_file write; allow mpd_t user_home_dir_t:dir search; +allow mpd_t unconfined_service_t:unix_stream_socket connectto;