Hi,

attached you'll find the policy we use for stunnel [1]

[1] http://www.stunnel.org

        Stunnel is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix and Windows. Stunnel can allow you to secure non-SSL aware daemons and protocols (like POP, IMAP, LDAP, etc) by having Stunnel provide the encryption, requiring no changes to the daemon's code.

bye,
peter

-- 
petre rodan


<kaiowas@gentoo.org>

Developer,
Hardened Gentoo Linux


/usr/sbin/stunnel	--	system_u:object_r:stunnel_exec_t
/etc/stunnel(/.*)?          	system_u:object_r:stunnel_etc_t
/var/run/stunnel(/.*)?		system_u:object_r:stunnel_var_run_t


# DESC: selinux policy for stunnel
#
# Author:   petre rodan <kaiowas@gentoo.org>
#

type stunnel_port_t, port_type;

daemon_domain(stunnel, `, privlog')

can_network(stunnel_t)

type stunnel_etc_t, file_type, sysadmfile;

allow stunnel_t self:capability { setgid setuid sys_chroot };
allow stunnel_t self:fifo_file { read write };
allow stunnel_t self:tcp_socket { read write };
allow stunnel_t self:unix_stream_socket { connect create };

allow stunnel_t stunnel_port_t:tcp_socket { name_bind };

r_dir_file(stunnel_t, stunnel_etc_t)
r_dir_file(stunnel_t, etc_t)




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/pgp-signature attachment: OpenPGP digital signature