mirror of
https://github.com/containers/udica
synced 2024-05-25 01:56:14 +02:00
09bf6b339f
Cil parser was recently updated to reject the following: (block template1 (type t) ) (block template2 (blockinherit template1)) (block b (blockinherit template1) (blockinherit template2)) Re-declaration of type t Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1 Failed to copy block contents into blockinherit Failed to resolve AST semodule: Failed! Remove (blockinherit container) from all templates so that "process" and "socket" are only defined once (by inheriting "container" block in the generated policy). All allow rules referencing "process" and "socket" now need to be enclosed in an optional block. While at it, unify indentation. Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
26 lines
1.0 KiB
Plaintext
26 lines
1.0 KiB
Plaintext
(block net_container
|
|
(optional net_container_optional
|
|
(typeattributeset sandbox_net_domain (process))
|
|
)
|
|
)
|
|
|
|
(block restricted_net_container
|
|
(optional restricted_net_container_optional
|
|
(allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept)))
|
|
(allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
|
|
(allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
|
|
|
|
(allow process proc_t (lnk_file (read)))
|
|
|
|
(allow process node_t (node (tcp_recv tcp_send recvfrom sendto)))
|
|
(allow process node_t (node (udp_recv recvfrom)))
|
|
(allow process node_t (node (udp_send sendto)))
|
|
|
|
(allow process node_t (udp_socket (node_bind)))
|
|
(allow process node_t (tcp_socket (node_bind)))
|
|
|
|
(allow process http_port_t (tcp_socket (name_connect)))
|
|
(allow process http_port_t (tcp_socket (recv_msg send_msg)))
|
|
)
|
|
)
|