| b.liu | e958203 | 2025-04-17 19:18:16 +0800 | [diff] [blame^] | 1 | ;; -*- mode: CIL; fill-column: 79; indent-tabs-mode: nil; -*- |
| 2 | ;; SPDX-FileCopyrightText: © 2021 Dominick Grift <dominick.grift@defensec.nl> |
| 3 | ;; SPDX-License-Identifier: Unlicense |
| 4 | |
| 5 | (in .sys |
| 6 | (call .rcsquid.subj_type_transition (subj))) |
| 7 | |
| 8 | (in .file |
| 9 | (call .rcsquid.obj_type_transition_initscriptfile |
| 10 | (unconfined.subj_typeattr))) |
| 11 | |
| 12 | (block rcsquid |
| 13 | |
| 14 | ;; |
| 15 | ;; Contexts |
| 16 | ;; |
| 17 | |
| 18 | (filecon |
| 19 | "/etc/init\.d/squid" |
| 20 | file |
| 21 | initscriptfile_file_context) |
| 22 | |
| 23 | ;; |
| 24 | ;; Macros |
| 25 | ;; |
| 26 | |
| 27 | (macro obj_type_transition_initscriptfile ((type ARG1)) |
| 28 | (call .file.initscriptfile_obj_type_transition |
| 29 | (ARG1 initscriptfile file "squid"))) |
| 30 | |
| 31 | ;; |
| 32 | ;; Policy |
| 33 | ;; |
| 34 | |
| 35 | (blockinherit .initscript.base_template) |
| 36 | |
| 37 | (allow subj self (capability (chown dac_override dac_read_search))) |
| 38 | |
| 39 | (call .squid.read_conffile_files (subj)) |
| 40 | (call .squid.search_conffile_dirs (subj)) |
| 41 | |
| 42 | (call .squid.manage_tmpfile_dirs (subj)) |
| 43 | (call .squid.manage_tmpfile_files (subj)) |
| 44 | (call .squid.obj_type_transition_tmpfile (subj dir "squid")) |
| 45 | |
| 46 | (call .squid.sslcrtd.subj_type_transition (subj)) |
| 47 | (call .squid.subj_type_transition (subj)) |
| 48 | |
| 49 | (call .www.search_miscfile_dirs (subj)) |
| 50 | |
| 51 | (optional rcsquid_opt_luci |
| 52 | (call .luci.cgi.use_fds (subj))) |
| 53 | |
| 54 | (optional rcsquid_opt_uhttpd |
| 55 | (call .uhttpd.readinherited_fifo_files (subj)))) |