1 # DNS, DHCP services 2 type dnsmasq, domain; 3 type dnsmasq_exec, exec_type, file_type; 4 5 net_domain(dnsmasq) 6 allowxperm dnsmasq self:udp_socket ioctl priv_sock_ioctls; 7 8 # TODO: Run with dhcp group to avoid need for dac_override. 9 allow dnsmasq self:global_capability_class_set dac_override; 10 11 allow dnsmasq self:global_capability_class_set { net_admin net_raw net_bind_service setgid setuid }; 12 13 allow dnsmasq dhcp_data_file:dir w_dir_perms; 14 allow dnsmasq dhcp_data_file:file create_file_perms; 15 16 # Inherit and use open files from netd. 17 allow dnsmasq netd:fd use; 18 allow dnsmasq netd:fifo_file { read write }; 19 # TODO: Investigate whether these inherited sockets should be closed on exec. 20 allow dnsmasq netd:netlink_kobject_uevent_socket { read write }; 21 allow dnsmasq netd:netlink_nflog_socket { read write }; 22 allow dnsmasq netd:netlink_route_socket { read write }; 23 allow dnsmasq netd:unix_stream_socket { read write }; 24 allow dnsmasq netd:unix_dgram_socket { read write }; 25 allow dnsmasq netd:udp_socket { read write }; 26
