1 # DNS, DHCP services 2 type dnsmasq, domain; 3 type dnsmasq_exec, exec_type, file_type; 4 5 net_domain(dnsmasq) 6 7 # TODO: Run with dhcp group to avoid need for dac_override. 8 allow dnsmasq self:capability dac_override; 9 10 allow dnsmasq self:capability { net_admin net_raw net_bind_service setgid setuid }; 11 12 allow dnsmasq dhcp_data_file:dir w_dir_perms; 13 allow dnsmasq dhcp_data_file:file create_file_perms; 14 15 # Inherit and use open files from netd. 16 allow dnsmasq netd:fd use; 17 allow dnsmasq netd:fifo_file { read write }; 18 # TODO: Investigate whether these inherited sockets should be closed on exec. 19 allow dnsmasq netd:netlink_kobject_uevent_socket { read write }; 20 allow dnsmasq netd:netlink_nflog_socket { read write }; 21 allow dnsmasq netd:netlink_route_socket { read write }; 22 allow dnsmasq netd:unix_stream_socket { read write }; 23 allow dnsmasq netd:unix_dgram_socket { read write }; 24 allow dnsmasq netd:udp_socket { read write }; 25
