myserver.te

policy_module(myserver, 1.0.0)

#if you declare a policy module in the abstracted way then you
#dont need to require any kernel security classes and kernel av perms
#which would be generated by software i.e. audit2allow.
########################################
#
# Declarations
#

# importing other modules i.e. thats not declared locally.
# these are declared elsewhere but we need to use them in our
# policy for our domtain transition rule

gen_require(` type unconfined_t; role unconfined_r; ' )


# declare types
type myserver_t;

type myserver_exec_t;


# Process environments of programs that user process environments
#transition to are called application # domains, and the type of such a
#process is called a application domain type.
# defining myserver_t & myserver_exec_t as application domain types here.

application_domain(myserver_t, myserver_exec_t)


# some one in the user role can be in myserver domain

role unconfined_r types myserver_t;

# allow the domain transition

domtrans_pattern(unconfined_t, myserver_exec_t, myserver_t)



########################################
#
# Myapp local policy
#


# set the value to allow the exec stack to true , if this is true
#allow the process to have an executable stack for myserver

bool allow_myserver_t_execstack true;
if ( allow_myserver_t_execstack ) {
allow myserver_t self:process execstack;
}



# call to a abstracted rule its a macro4

files_exec_etc_files(myserver_t)


# letting myserver_t read system network configuration

sysnet_read_config(myserver_t)

# allows the myserver process to read and write to the calling users
#psudo terminal

userdom_use_inherited_user_ptys(myserver_t)



# allow the subject create socket & access myserver

allow myserver_t self:tcp_socket { create setopt bind};


# this allows the caller to vind tcp sockets to generic ports e.g.
#ports with type port_t


corenet_tcp_bind_generic_port(myserver_t)

corenet_tcp_bind_generic_node(myserver_t)

#the target is equal to the sourcethe target is identified
#by "self" rather than "myserver_t: which allow the permissions on the tcp socket

allow myserver_t self:tcp_socket { read write accept listen};

# allow myserver to exe on memory
allow myserver_t self:process execmem;