{
#Defines default protection
domain global;

#default search
allow / s;

#read-only to system files
allow /dev r,s;
allow /var r,s;
allow /mnt r,s;
#can use commands and libs
allow /lib r,x,s;
allow /usr r,x,s;
allow /bin r,x,s;
allow /sbin r,x,s;
allow /etc r,x,s;
##can read tmp
allow /tmp r,s;

#can use some devices 
allow /dev/console r,w;
allow /dev/null r,w;
allow /dev/zero r,w;

###Default deny  files
#some critical device
deny /dev/kmem;
deny /dev/mem;
deny /dev/port;
#protect SELinux config
deny /etc/selinux/seedit;
#password files
deny /etc/shadow-;
deny /etc/shadow;
#admin's root dir
deny /root;

#Cannot access to shell
deny/bin/sh;
deny /bin/bash;
deny /bin/tcsh;
## logs
deny /var/log;
#SELinux logs
deny /var/log/audit;
#Apache lgos
deny /var/log/httpd;
# protect homepages
deny /var/www;

###
# allow communication within domain
allowcom -msg self r,w;
allowcom -msgq self r,w;
allowcom -pipe self r,w;
allowcom -sem self r,w;	
allowcom -shm self r,w;
allowcom -sig init_t c;
allowcom -sig self c,k,s,o;
allowcom -tcp self;
allowcom -udp self;
allowcom -unix self;

#tmpfs is not protected
allowtmpfs global r,w;

#####
## read some proc files
#misc /proc
allowproc -proc r;
#/proc/<self pid>
allowproc -self r;

###
# everyone can read/write tty/pts, but can not create
allowpts general r;
allowpts general w;
allowtty general r;
allowtty general w;
allowtty global r,w;
allowpts global r,w;

}

{
domain auditd_t;

domain_trans initrc_t  /sbin/auditd;

allow /var/log s;
allow /var/log/audit r,w,s;

allow dev_log_t r,w,s;
allowcom -unix syslogd_t;
allownet -netlink;
allow /var/run r,w,s;

}
{
domain cannaserver_t;
domain_trans initrc_t /usr/sbin/cannaserver;

allow /var/run/.iroha_unix r,w,s;
allow /var/log/canna r,w,s;
allow /var/lib/canna r,w,s;

allow dev_log_t r,w,s;
allowcom -unix syslogd_t;
}
{
domain dhclient_t;
domain_trans initrc_t /sbin/dhclient;

allow /bin/bash r,x,s;
allow /bin/sh r,x,s;
allowonly /var/run r,w,s;
allow /etc exclusive etc_runtime;
allow /tmp exclusive dhclient_tmp_t;
allow /etc/resolv.conf r,w,s;
allow /var/lib/dhcp r,w,s;
allownet;
allownet -netlink;
allownet -raw;
allownet -wellknown;
allownet -udp -port 68;
allowcom -unix syslogd_t;
allow dev_log_t r,w,s;
allowadm net;
}
{
domain gdm_t;
domain_trans init_t /usr/bin/gdm-binary;
domain_trans init_t /usr/bin/gdmgreeter;

allow /bin/bash r,x,s;
allow /bin/sh r,s;
allow etc_runtime r,s;

allowonly /var/run r,w,s;
allow /var/gdm r,w,s;
allow /var/log r,w,s;
allow /tmp r,w,s;
allownet -netlink;
allowcom -sig xserver_t o;
allowcom -unix xserver_t;
allowproc -system r;
allow dev_log_t r,w,s;
allow /etc/shadow r,s;

allow /root r,w,s;
allowadm getsecurity;
allowcom -unix syslogd_t;
allowproc -self w;
}
{
domain getty_t;

domain_trans init_t /sbin/mingetty;

allowonly /var/run r,w,s;
allow /var/log s;
allow /var/log/wtmp r,w,s;
allowproc -system r;
}
{
#comment:Apache

domain httpd_t;

domain_trans initrc_t /usr/sbin/httpd;

allow /etc/krb5.conf r,w,s;
allow /etc/passwd r,s;
allow /home r,s;
allow /tmp r,w,s;

allow /var/log s;
allow /var/log/httpd r,w,s;
allowonly /var/run r,w,s;
allow /var/www r,s;
allow /var/www/cgi-bin r,x,s;

allow etc_runtime r,s;

allowcom -sig getty_t c;
allowcom -unix syslogd_t;
allownet -tcp -port 443;
allownet -tcp -port 80;
allownet -udp -port 443;
allownet -udp -port 80;
allownet -wellknown;
allownet;

}
{
domain iiimd_t;
domain_trans initrc_t /usr/bin/iiimd;

allow /var/log/iiim r,w,s;
allow /var/run/iiim r,w,s;

#communicate syslogd
allow dev_log_t r,w,s;
allowcom -unix syslogd_t;

#communicate with canna
allow /var/run/.iroha_unix r,w,s;
allowcom -unix cannaserver_t;
}
{
#comment:Domain for init program

domain init_t;
domain_trans kernel_t /sbin/init;

allow /bin/sh r,x,s;
allow /bin/bash r,x,s;
allow /etc r,x,s;
allow /dev r,w,s;
allow /etc exclusive etc_runtime;
allow /etc r,w,s;
allow /tmp r,w,s;
allow /var/log r,w,s;
allow /var/run r,w,s;
allow dev_log_t r,w,s;
allow etc_runtime r,w,s;
allowadm boot;
allowadm unlabel;
allowcom -sig global c,k,s,o;
allowcom -unix syslogd_t;
allownet;
allowproc -system r;
}
{
#Template:use_all_commands_template

#comment:Domain for init scripts

domain initrc_t;
domain_trans init_t /etc/rc.d/rc;
domain_trans init_t /etc/rc.d/rc.sysinit;
domain_trans init_t /etc/rc.d/rc.local;
domain_trans run_init_t /etc/rc.d/init.d;
domain_trans sysadm_r /etc/rc.d/init.d;
allow /bin/bash r,x,s;
allow /bin/sh r,x,s;
allow /bin/tcsh r,x,s;
allow /dev r,w,s;
allow /etc exclusive etc_runtime;
allow /etc/adjtime r,w,s;
allow /etc/resolv.conf r,w,x,s;
allow /home r,s;
allow /root s;
allow /tmp r,w,s;

allow /var/lib r,w,s;
allow /var/lock r,w,s;
allow /var/log r,w,s;
allow /var/run r,w,s;
allowonly / r,w,s;

allow /usr/share/fonts r,w,s;
allow /usr/X11R6/lib/X11/fonts r,w,s;

allow dev_log_t r,w,s;
allow etc_runtime r,w,s;
allow halt_t r,w,s;

allowadm boot;
allowadm mount;
allowadm net;
allowadm raw_io;
allowadm swapon;
allowadm getsecurity;
allowcom -sig global c,k,s,o;
allowcom -unix syslogd_t;
allownet -netlink;
allownet -raw;
allownet -wellknown;
allownet;
allownet -connect;

allowproc -other r;
allowproc -proc r,w;
allowproc -system r,w;

}
{
domain kernel_t;
allow /bin/bash r,x,s;
allow /bin/sh r,x,s;
allow /dev r,w,s;
allow /etc/hotplug r,x,s;
allow /etc/hotplug.d r,x,s;
allow /var/log s;
allow etc_runtime r,s;
allowadm mount;
allowadm net;
allownet -raw;
allowproc -system r;
allowadm unlabel;
}
{
domain klogd_t;

domain_trans initrc_t /sbin/klogd;

allowcom -unix syslogd_t;

allowadm raw_io;

allow /dev/mem r,s;
allow /dev/kmem r,s;
allow /dev/console r,w,s;

allowonly /var/run r,w,s;
allow dev_log_t r,w,s;

allow /tmp r,w,s;
allowproc -kmsg r;

}
{
domain login_t;
domain_trans getty_t /bin/login;

allow /etc/selinux/seedit r,s;
allow /dev/apm_bios r,w,s;
allow /dev/console r,w,s;
allow /etc/shadow r,s;
allow /home r,s;
allow /root r,s;
allow /var/lock r,w,s;
allow etc_runtime r,s;
allow /etc/alsa/pcm r,w,s;

allow /var/log s;
allow /var/log r,w,s;
allow /var/run r,w,s;
allow dev_log_t r,w,s;


allowadm getsecurity;
allowcom -unix syslogd_t;
allowproc -self w;
allownet -netlink;

allowtty -change general;
allowtty -change global;

allowcom -sig sysadm_r o;
allowcom -sig user_r o;
}
{
domain lvm_t;
domain_trans initrc_t /sbin/lvm.static;

allowadm part_relabel;
allowadm getsecurity;

allow /dev r,w,s;
allow /dev/port r,s;
allow /dev/mem r,s;
allow dev_log_t r,w,s;
allow /etc/selinux/seedit r,s;
allow /etc/lvm r,s,w;
allow etc_runtime r,s;
allow /var/lock/lvm r,w,s;
allowproc -system r;
}
{
#comment:

domain modutils_t;

domain_trans initrc_t /sbin/insmod;
domain_trans initrc_t /sbin/modprobe;
domain_trans initrc_t /sbin/depmod;
domain_trans kernel_t /sbin/insmod;
domain_trans kernel_t /sbin/modprobe;
domain_trans xserver_t /sbin/modprobe;

allowcom -unix syslogd_t;
allowcom -sig global o;

allow /var/log s;
allow /lib/modules r,w,s;
allow /bin/bash r,s,x;
allow /bin/sh r,s;

allow etc_runtime r,s;
allow dev_log_t r,w,s;

allowadm insmod;
allowadm mount;
allownet -raw;
allowproc -system r;
}
{
#comment:

domain mount_t;

domain_trans sysadm_r /bin/mount;
domain_trans sysadm_r /bin/umount;
domain_trans initrc_t /bin/mount;
domain_trans initrc_t /bin/umount;

allowadm mount,raw_io;

allow /dev/fd0 r,w,s;
allow /dev/cdrom r,w,s;
allow /dev/console r,w,s;

allow /etc exclusive etc_runtime;
allow etc_runtime r,w,s;

}
#comment:Domain for newrole program(this domain has big privilege)
{
domain newrole_t;
domain_trans sysadm_r /usr/bin/newrole;
domain_trans user_r /usr/bin/newrole;

allowadm getsecurity;
allowtty -change global;
allowpts -change global;
allowcom -unix syslogd_t;

allow /var/log r,w,s;
allow /etc/selinux/seedit r,s;
allow /etc/shadow r,s;
allow /dev/console r,w,s;

allow dev_log_t r,w,s;
allowproc -self w;
allownet -netlink;
}
{
#Template:use_all_commands_template

#comment:Domain for restorecon command

domain restorecon_t;
domain_trans initrc_t /sbin/restorecon;
domain_trans sysadm_r /sbin/restorecon;
domain_trans webmin_t /sbin/restorecon;

allow /etc/selinux/seedit r,s;

allowadm relabel;
allowadm getsecurity;

}
{
#comment: This domain is domain for scripts that run from rpm. rpm enforces to give script different domain, so this domain is necessary.
domain rpm_script_t;
domain_trans sysadm_r /bin/bash;
allowadm all;
}
{
#comment:Domain for /usr/sbin/run_init command

domain run_init_t;

domain_trans sysadm_r /usr/sbin/run_init;

#allow /bin/sh r,x,s;

#allow /etc/rc.d/init.d r,x,s;

allow /etc/passwd r,s;

allow /etc/shadow r,s;

allow /bin s;

allow /bin/bash r,x,s;

allowproc -self w;
}
{
#comment:

domain sshd_t;
domain_trans initrc_t /usr/sbin/sshd;

allownet;
allownet -wellknown;
allownet -tcp -port 22;
allowcom -unix syslogd_t;

allowpts global w;
allowpts -create;
allowpts global r;
allowpts -change general;
allowpts -change global;

allowadm chroot;
allowadm getsecurity;

allow /root s;
allow /etc/selinux/seedit r,s;
allow /etc/shadow r,s;


allow /var/log s;
allow /var/log r,w,s;
allow /var/log r,w,s;


allow /dev/console r,w,s;


allow /tmp r,w,s;
allowonly /var/run r,w,s;

allow dev_log_t r,w,s;

allowproc -self w;
allownet -netlink;
}
{
domain su_t;
domain_trans user_r /bin/su;
domain_trans sysadm_r /bin/su;
allow /etc/shadow r,s;
allow /root s;
allow /etc/selinux/seedit r,s;

allowadm getsecurity;
allownet -netlink;
allowtty -change global;
allowpts -change global;
allowproc -self r,w;
allow dev_log_t r,s,w;
allowcom -unix syslogd_t;
}
{
role sysadm_r;
user root;
#comment:system administrator

domain_trans su_t /bin/bash;
domain_trans newrole_t /bin/sh;
domain_trans newrole_t /bin/bash;
domain_trans login_t /bin/bash;
domain_trans login_t /bin/sh;
domain_trans gdm_t  /etc/X11/xdm/Xsession;

allowtty -create;
allowpts -create;

allow / exclusive halt_t;
allowadm all;
}
{
domain syslogd_t;

domain_trans initrc_t /sbin/syslogd;
domain_trans initrc_t /sbin/minilogd;
allowcom -unix login_t;
allow /var/log r,w,s;
allow /var/run r,w,s;
allow /dev exclusive dev_log_t;
allow dev_log_t r,w,s;
allow /tmp r,w,s;
}
{
#comment:Domain for udev

domain udev_t;

domain_trans kernel_t /sbin/udevsend;
domain_trans kernel_t /sbin/udevd;   
domain_trans kernel_t /sbin/start_udev; 
domain_trans kernel_t /sbin/udevstart;  
domain_trans kernel_t /usr/bin/udevinfo;


domain_trans initrc_t /sbin/udevsend;
domain_trans initrc_t /sbin/udevd;
domain_trans initrc_t /sbin/start_udev; 
domain_trans initrc_t /sbin/udevstart;  
domain_trans initrc_t /usr/bin/udevinfo;

allowproc -other r;
allowtmpfs general w;

allow /dev r,w,s ;
allow /dev/mem r,w,s;
allow /dev/kmem r,w,s;
allow /dev/port r,w,s;
allow /etc/dev.d r,x,s;
allow /etc/hotplug r,x,s;
allow /etc/hotplug.d r,x,s;
allow /etc/passwd r,s;
allow /etc/shadow r,s,w;
allow /etc/selinux/seedit r,s;
allow etc_runtime r,s;
allow /lib/modules r,s;
allow /etc/rc.d/init.d r,s,x;
allow /etc/udev/scripts r,s,x;
allow /var/log s;
allow /sbin r,x,s;
allow /bin r,x,s;
allowproc -self w;
allow /usr/sbin r,x,s;
allow /usr/bin r,x,s;
allow /bin/bash r,x,s;
allow /bin/sh r,x,s;
allowproc -system r;

allowtty -change general;
allowpts -change general;
allownet -netlink;
allowadm part_relabel;
allowadm getsecurity;

}
{
role user_r;
user user_u;
user root;
#comment:Normal User 
domain_trans sshd_t /bin/bash;
domain_trans sshd_t /bin/sh;
domain_trans newrole_t /bin/bash;
domain_trans newrole_t /bin/sh;
domain_trans login_t /bin/bash;
domain_trans gdm_t /etc/X11/xdm/Xsession;
domain_trans su_t /bin/bash;
allowtty -create;
allowpts -create;
allow /home r,w,x,s;
allow /etc/passwd r,s;
allow /bin/bash r,x,s;
allow /bin/sh r,s;
allow etc_runtime r,s;
allownet -connect;
allownet ;
}
{
#comment:

domain webmin_t;

domain_trans initrc_t /usr/local/webmin-1.210/miniserv.pl;

allownet;
allowcom -unix syslogd_t;

allowadm load_policy;
allowadm relabel;
allowadm getsecurity;

allow /etc/webmin r,w,s;
allow /etc/selinux/seedit/bin r,x,s;
allow /etc/selinux/seedit r,w,s;
allow /var/webmin r,w,s;

allow /root s;
allow /home s;

allow /etc/shadow r,s;
allow /tmp r,w,s;
allow /bin/bash r,x,s;
allow /bin/sh r,x,s;

allow etc_runtime r,s;
allow dev_log_t r,w,s;
}
{
domain xfs_t;
domain_trans initrc_t /usr/X11R6/bin/xfs;

allowcom -unix syslogd_t;


allow etc_runtime r,s;

allowonly /var/run r,w,s;

allow dev_log_t r,w,s;

allow /tmp r,w,s;
}
{
domain xserver_t;
domain_trans init_t /usr/X11R6/bin/Xorg;
domain_trans initrc_t /usr/X11R6/bin/Xorg;
domain_trans gdm_t /usr/X11R6/bin/Xorg;

allow /bin/bash r,x,s;
allow /bin/sh r,s;
allow /dev/mem r,x,w,s;
allow /dev/agpgart r,w,s;
allow /dev/dri r,w,s;
allow /tmp r,w,s;
allow /var/log r,w,s;
allow /var/lib/xkb r,w,s;
allow etc_runtime r,s;
allow /root r,s;

allowcom -shm sysadm_r r,w;
allowcom -shm user_r r,w;
allowproc -proc r,w;
allowcom -sig init_t o;
allowcom -unix xfs_t ;
allowcom -shm gdm_t r,w;
allowadm raw_io;
}
