-
Notifications
You must be signed in to change notification settings - Fork 0
/
trafficserver.te
120 lines (92 loc) · 4.02 KB
/
trafficserver.te
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
policy_module(trafficserver, 1.0.0)
########################################
#
# Declarations
#
## <desc>
## <p>
## Allow trafficserver to bind to all ports
## </p>
## </desc>
gen_tunable(trafficserver_can_bind_all, false)
## <desc>
## <p>
## Allow trafficserver to connect to all ports
## </p>
## </desc>
gen_tunable(trafficserver_can_connect_all, false)
# Define our types & attach file attributes
type trafficserver_t;
type trafficserver_exec_t;
init_daemon_domain(trafficserver_t, trafficserver_exec_t)
type trafficserver_cache_t;
files_type(trafficserver_cache_t)
type trafficserver_etc_t;
files_config_file(trafficserver_etc_t)
type trafficserver_log_t;
logging_log_file(trafficserver_log_t)
type trafficserver_run_t;
files_type(trafficserver_run_t)
type trafficserver_unit_file_t;
systemd_unit_file(trafficserver_unit_file_t)
########################################
#
# trafficserver local policy
#
# We run as the trafficserver user and use capabilities to bind privileged ports,
# so this permission is not required and should not be granted!
# allow trafficserver_t self:capability { setgid setuid };
allow trafficserver_t self:process { execmem fork setcap setrlimit signal_perms setsched };
allow trafficserver_t self:fifo_file rw_fifo_file_perms;
allow trafficserver_t self:tcp_socket create_stream_socket_perms;
allow trafficserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow trafficserver_t trafficserver_exec_t:file execute_no_trans;
# etc files are read-only to trafficserver
list_dirs_pattern(trafficserver_t, trafficserver_etc_t, trafficserver_etc_t)
read_files_pattern(trafficserver_t, trafficserver_etc_t, trafficserver_etc_t)
read_lnk_files_pattern(trafficserver_t, trafficserver_etc_t, trafficserver_etc_t)
# trafficserver has free rein over cache
manage_dirs_pattern(trafficserver_t, trafficserver_cache_t, trafficserver_cache_t)
manage_files_pattern(trafficserver_t, trafficserver_cache_t, trafficserver_cache_t)
# trafficserver does its own log management, rotation, etc
manage_dirs_pattern(trafficserver_t, trafficserver_log_t, trafficserver_log_t)
manage_files_pattern(trafficserver_t, trafficserver_log_t, trafficserver_log_t)
manage_lnk_files_pattern(trafficserver_t, trafficserver_log_t, trafficserver_log_t)
logging_log_filetrans(trafficserver_t, trafficserver_log_t, { dir file lnk_file })
# run - communications sockets and lockfiles, runtime copies of plugins
manage_dirs_pattern(trafficserver_t, trafficserver_run_t, trafficserver_run_t)
mmap_exec_files_pattern(trafficserver_t, trafficserver_run_t, trafficserver_run_t)
manage_files_pattern(trafficserver_t, trafficserver_run_t, trafficserver_run_t)
manage_sock_files_pattern(trafficserver_t, trafficserver_run_t, trafficserver_run_t)
# hwloc reads a bunch of system files
dev_list_sysfs(trafficserver_t)
dev_read_sysfs(trafficserver_t)
fs_getattr_xattr_fs(trafficserver_t)
fs_read_cgroup_files(trafficserver_t)
fs_search_cgroup_dirs(trafficserver_t)
kernel_read_fs_sysctls(trafficserver_t)
kernel_read_net_sysctls(trafficserver_t)
kernel_search_network_sysctl(trafficserver_t)
kernel_read_system_state(trafficserver_t)
logging_send_syslog_msg(trafficserver_t)
miscfiles_read_generic_certs(trafficserver_t)
sysnet_dns_name_resolve(trafficserver_t)
# By default we can only connect to the standard http and http_cache ports
# UDP is used for QUIC
corenet_tcp_bind_generic_node(trafficserver_t)
corenet_udp_bind_generic_node(trafficserver_t)
corenet_tcp_bind_http_port(trafficserver_t)
corenet_udp_bind_http_port(trafficserver_t)
corenet_tcp_bind_http_cache_port(trafficserver_t)
corenet_udp_bind_http_cache_port(trafficserver_t)
corenet_tcp_connect_http_port(trafficserver_t)
corenet_tcp_connect_http_cache_port(trafficserver_t)
# Internal DNS resolver binds a random port
corenet_udp_bind_all_unreserved_ports(trafficserver_t)
tunable_policy(`trafficserver_can_bind_all',`
corenet_tcp_bind_all_ports(trafficserver_t)
corenet_udp_bind_all_ports(trafficserver_t)
')
tunable_policy(`trafficserver_can_connect_all',`
corenet_tcp_connect_all_ports(trafficserver_t)
')