## <summary>SELinux policy module</summary>
## <desc>
## <p>
## SELinux policy module for Irssi
## </p>
## </desc>
#######################################
## <summary>
## The per role template for the Irssi module.
## </summary>
## <desc>
## <p>
## This template creates derived domains which are used
## for Irssi.
## </p>
## <p>
## This template is invoked automatically for each user, and
## generally does not need to be invoked directly
## by policy writers.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## The type of the user domain.
## </summary>
## </param>
## <param name="user_role">
## <summary>
## The role associated with the user domain.
## </summary>
## </param>
#
template(`irssi_per_role_template',`
gen_require(`
type irssi_exec_t;
type irssi_etc_t;
')
## <desc>
## <p>
## Confine Irssi for user groups
## </p>
## </desc>
gen_tunable(irssi_confine_$1,false)
########################################
#
# Declarations
#
type $1_irssi_t;
application_domain($1_irssi_t,irssi_exec_t)
role $3 types $1_irssi_t;
type $1_irssi_home_t;
files_poly_member($1_irssi_home_t)
userdom_user_home_content($1,$1_irssi_home_t)
########################################
#
# Local Policy
#
allow $1_irssi_t self:fifo_file rw_fifo_file_perms;
allow $1_irssi_t self:process signal;
allow $1_irssi_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
allow $1_irssi_t self:tcp_socket { write accept getattr bind listen setopt read getopt create connect };
allow $1_irssi_t self:udp_socket { write read create connect getattr };
allow $1_irssi_t $2:process sigchld;
allow $2 $1_irssi_t:process { ptrace signal_perms noatsecure siginh rlimitinh };
allow $1_irssi_t irssi_etc_t:file { getattr read };
manage_dirs_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
manage_files_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
manage_lnk_files_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
userdom_user_home_dir_filetrans($1,$1_irssi_t,$1_irssi_home_t,{ dir file lnk_file })
userdom_search_user_home_dirs($1,$1_irssi_t)
manage_dirs_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
manage_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
manage_lnk_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
relabel_dirs_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
relabel_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
relabel_lnk_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
corenet_tcp_connect_ircd_port($1_irssi_t)
corenet_sendrecv_ircd_client_packets($1_irssi_t)
corenet_all_recvfrom_netlabel($1_irssi_t)
corenet_all_recvfrom_unlabeled($1_irssi_t)
corenet_tcp_sendrecv_all_if($1_irssi_t)
corenet_tcp_sendrecv_all_nodes($1_irssi_t)
corenet_tcp_bind_all_nodes($1_irssi_t)
corenet_udp_bind_all_nodes($1_irssi_t)
fs_search_auto_mountpoints($1_irssi_t)
ps_process_pattern($2,$1_irssi_t)
sysnet_read_config($1_irssi_t)
libs_exec_lib_files($1_irssi_t)
libs_use_ld_so($1_irssi_t)
files_read_etc_files($1_irssi_t)
files_read_usr_files($1_irssi_t)
miscfiles_read_localization($1_irssi_t)
nscd_read_pid($1_irssi_t)
corecmd_dontaudit_search_bin($1_irssi_t)
userdom_use_user_terminals($1,$1_irssi_t)
optional_policy(`
nis_use_ypbind($1_irssi_t)
')
ifdef(`enable_mls',`',`
fs_search_removable($1_irssi_t)
fs_read_removable_files($1_irssi_t)
fs_read_removable_symlinks($1_irssi_t)
')
tunable_policy(`irssi_confine_$1',`
domain_auto_trans($2,irssi_exec_t,$1_irssi_t)
',`
can_exec($2,irssi_exec_t)
')
# Server 4990-5000:tcp/ Client 2010:2020:tcp
tunable_policy(`irssi_can_dcc',`
corenet_tcp_bind_ircdcc_port($1_irssi_t)
corenet_tcp_connect_ircdcc_port($1_irssi_t)
corenet_tcp_sendrecv_ircdcc_port($1_irssi_t)
corenet_sendrecv_ircdcc_client_packets($1_irssi_t)
corenet_tcp_connect_eggdropdcc_port($1_irssi_t)
corenet_sendrecv_eggdropdcc_client_packets($1_irssi_t)
corenet_tcp_connect_eggdrop_port($1_irssi_t)
corenet_sendrecv_eggdrop_client_packets($1_irssi_t)
')
tunable_policy(`irssi_can_unconfined_tcp_network',`
corenet_tcp_bind_all_unreserved_ports($1_irssi_t)
corenet_tcp_connect_all_ports($1_irssi_t)
corenet_tcp_sendrecv_all_ports($1_irssi_t)
corenet_sendrecv_all_client_packets($1_irssi_t)
')
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs($1_irssi_t)
fs_manage_nfs_files($1_irssi_t)
fs_manage_nfs_symlinks($1_irssi_t)
')
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_dirs($1_irssi_t)
fs_manage_cifs_files($1_irssi_t)
fs_manage_cifs_symlinks($1_irssi_t)
')
')
########################################
## <summary>
## Read Irssi per user homedir
## </summary>
## <desc>
## <p>
## Read Irssi per user homedir
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`irssi_read_user_home_files',`
gen_require(`
type $1_irssi_home_t;
')
allow $2 $1_irssi_home_t:dir list_dir_perms;
allow $2 $1_irssi_home_t:file read_file_perms;
')
########################################
## <summary>
## Write Irssi per user homedir
## </summary>
## <desc>
## <p>
## Write Irssi per user homedir
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`irssi_write_user_home_files',`
gen_require(`
type $1_irssi_home_t;
')
allow $2 $1_irssi_home_t:dir list_dir_perms;
allow $2 $1_irssi_home_t:file write;
')
########################################
## <summary>
## Run Irssi in user Irssi domain.
## </summary>
## <desc>
## <p>
## Run Irssi in user Irssi domain.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`irssi_domtrans_user_irssi',`
gen_require(`
type $1_irssi_t,irssi_exec_t;
')
domtrans_pattern($2,irssi_exec_t,$1_irssi_t)
')
########################################
## <summary>
## Read/write Irssi per user tcp_socket
## </summary>
## <desc>
## <p>
## Read/write Irssi per user tcp_socket
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`irssi_rw_user_tcp_sockets',`
gen_require(`
type $1_irssi_t;
')
allow $2 $1_irssi_t:tcp_socket rw_socket_perms;
')
policy_module(irssi,1.0.0)
########################################
#
# Declarations
#
## <desc>
## <p>
## Allow Irssi unconfined TCP networking
## </p>
## </desc>
gen_tunable(irssi_can_unconfined_tcp_network,false)
## <desc>
## <p>
## Allow Irssi to bind and connect to IRC DCC tcp network port range 4990 to 5000
## </p>
## </desc>
gen_tunable(irssi_can_dcc,false)
type irssi_exec_t;
application_executable_file(irssi_exec_t)
type irssi_etc_t;
files_config_file(irssi_etc_t)
/usr/bin/irssi -- gen_context(system_u:object_r:irssi_exec_t,s0)
HOME_DIR/\.irssi(/.*)? gen_context(system_u:object_r:ROLE_irssi_home_t,s0)
/etc/irssi.conf -- gen_context(system_u:object_r:irssi_etc_t,s0)