Changeset View
Changeset View
Standalone View
Standalone View
resources/selinux/phabricator.te
- This file was added.
policy_module(phabricator,0.9) | |||||
gen_require(` | |||||
type libphutil_t; | |||||
type arcanist_t; | |||||
type httpd_t; | |||||
') | |||||
# Private type declarations | |||||
type phabricator_t; | |||||
type phabricator_exec_t; | |||||
type phabricator_etc_t; | |||||
files_config_file(phabricator_etc_t) | |||||
type phabricator_initrc_exec_t; | |||||
type phabricator_log_t; | |||||
logging_log_file(phabricator_log_t) | |||||
type phabricator_tmp_t; | |||||
files_tmp_file(phabricator_tmp_t) | |||||
type phabricator_var_lib_t; | |||||
files_type(phabricator_var_lib_t) | |||||
type phabricator_var_run_t; | |||||
files_pid_file(phabricator_var_run_t) | |||||
# ---- | |||||
# Init scripts | |||||
init_daemon_domain(phabricator_t, phabricator_exec_t) | |||||
init_script_file(phabricator_initrc_exec_t) | |||||
init_all_labeled_script_domtrans(phabricator_t) | |||||
init_domtrans_script(phabricator_t) | |||||
init_read_utmp(phabricator_t) | |||||
init_signull_script(phabricator_t) | |||||
# access libphutil | |||||
read_files_pattern(phabricator_t,libphutil_t,libphutil_t) | |||||
# read configs | |||||
read_files_pattern(phabricator_t,phabricator_etc_t,phabricator_etc_t) | |||||
# create/read logfiles | |||||
create_files_pattern(phabricator_t,phabricator_log_t,phabricator_log_t) | |||||
append_files_pattern(phabricator_t,phabricator_log_t,phabricator_log_t) | |||||
read_files_pattern(phabricator_t,phabricator_log_t,phabricator_log_t) | |||||
logging_log_filetrans(phabricator_t,phabricator_log_t, { file dir }) | |||||
# allow httpd | |||||
read_files_pattern(httpd_t,arcanist_t,arcanist_t) | |||||
read_files_pattern(httpd_t,libphutil_t,libphutil_t) | |||||
read_files_pattern(httpd_t,phabricator_t,phabricator_t) | |||||
read_files_pattern(httpd_t,phabricator_var_lib_t,phabricator_var_lib_t) | |||||
allow httpd_t arcanist_t:dir read; | |||||
allow httpd_t libphutil_t:dir read; | |||||
allow httpd_t phabricator_t:dir read; | |||||
allow httpd_t phabricator_var_lib_t:dir read; | |||||