Add selinux conf for alist

- and allow caddy to connect to alist/comiclib
karuboniru · Feb 1, 2024 · 6dc99b4 · 6dc99b4
1 parent 6253ed1
commit 6dc99b4
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/cils/container_alist.cil b/cils/container_alist.cil
@@ -0,0 +1,10 @@
+(block container_alist
+    (blockinherit container)
+    (blockinherit restricted_net_container)
+
+    (allow process user_home_t ( dir (  watch add_name create getattr ioctl lock open read remove_name rmdir search setattr write ))) 
+    (allow process user_home_t ( file ( watch append create getattr ioctl lock map open read rename setattr unlink write )))
+
+    (allow process port_type ( tcp_socket ( name_connect recv_msg send_msg )))
+    (allow process port_type ( udp_socket ( recv_msg send_msg )))
+)
diff --git a/cils/container_caddy.cil b/cils/container_caddy.cil
@@ -5,4 +5,6 @@
 
     (allow process var_run_t ( sock_file ( write )))
     (allow process cockpit_ws_t ( unix_stream_socket ( connectto )))
+    (allow process container_alist.process ( unix_stream_socket ( connectto )))
+    (allow process comiclib.process ( unix_stream_socket ( connectto )))
 )