sam.hadow/selinux-archlinux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policy modification openvpn

Browse Source
This commit is contained in:
Sam Hadow
2026-02-05 11:30:36 +01:00
parent 2dcac3720a
commit 80be64969d
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
local_vpn.te → local_openvpn.te
View File

@@ -10,9 +10,9 @@ require {
type xdg_data_t; type xdg_data_t;
class file { execute_no_trans getattr open read }; class file { execute_no_trans getattr open read };
class unix_stream_socket connectto; class unix_stream_socket connectto;
class dir { add_name search }; class dir { add_name search remove_name write };
class process { getcap setcap }; class process { getcap setcap };
class sock_file create; class sock_file { create write getattr setattr unlink };
class lnk_file read; class lnk_file read;
} }
@@ -20,10 +20,12 @@ require {
allow NetworkManager_t lib_t:file execute_no_trans; allow NetworkManager_t lib_t:file execute_no_trans;
allow NetworkManager_t openvpn_t:unix_stream_socket connectto; allow NetworkManager_t openvpn_t:unix_stream_socket connectto;
allow NetworkManager_t systemd_machined_t:unix_stream_socket connectto; allow NetworkManager_t systemd_machined_t:unix_stream_socket connectto;
allow openvpn_t NetworkManager_runtime_t:dir { write remove_name };
allow openvpn_t NetworkManager_runtime_t:sock_file { write getattr setattr unlink };
#============= openvpn_t ============== #============= openvpn_t ==============
allow openvpn_t NetworkManager_runtime_t:dir add_name; allow openvpn_t NetworkManager_runtime_t:dir { write remove_name add_name };
allow openvpn_t NetworkManager_runtime_t:sock_file create; allow openvpn_t NetworkManager_runtime_t:sock_file { create write getattr setattr unlink };
allow openvpn_t lib_t:file execute_no_trans; allow openvpn_t lib_t:file execute_no_trans;
allow openvpn_t self:process { getcap setcap }; allow openvpn_t self:process { getcap setcap };
allow openvpn_t selinux_config_t:lnk_file read; allow openvpn_t selinux_config_t:lnk_file read;