From 04748e86d3e20080fa98df81b40cf022f0e4f90c Mon Sep 17 00:00:00 2001
From: aphralG <108004222+aphralG@users.noreply.github.com>
Date: Fri, 8 Sep 2023 10:56:30 +0100
Subject: [PATCH] Fix SELinux Policy & Fix SELinux README (#467)

* fix selinux policy
---
 scripts/selinux/README.md      |   2 +-
 scripts/selinux/nginx_agent.pp | Bin 143279 -> 95276 bytes
 scripts/selinux/nginx_agent.te | 210 ++++++++++++++-------------------
 3 files changed, 91 insertions(+), 121 deletions(-)

diff --git a/scripts/selinux/README.md b/scripts/selinux/README.md
index 5bf83b164..340a7c29a 100644
--- a/scripts/selinux/README.md
+++ b/scripts/selinux/README.md
@@ -56,7 +56,7 @@ sudo ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR --raw -se nginx_agent
 ```
 Generate new rule based on the errors by using `audit2allow`:
 ```
-sudo ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR --raw -se nms -ts recent | audit2allow
+sudo ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR --raw -se nginx_agent -ts recent | audit2allow
 ```
 
 Update the `scripts/selinux/nginx_agent.te` file with the output from the `audit2allow` command.
diff --git a/scripts/selinux/nginx_agent.pp b/scripts/selinux/nginx_agent.pp
index 6834be7e8f2d0374fea104c8f0f2162c83e1fd86..6a2735074973ed8b2583d1fc6ef3fa4af8e92081 100644
GIT binary patch
delta 1630
zcmZ8hZA_C_6n;<JmzL7<RirN;E#Md`V+<C@7RUI|4Md;=vyTLWwa{uCS&LAW(aKQ#
z0JACX{J3VxHh(NJGA1)*A#nk80)N~9myxUp7Kn+9%gAsUV+-2ddrRH4$xYAm+~=Ho
z?mg!{eSTH%FQV>j!234{f*_+Sj;@Yfa7Cw4iAmH>>Q7hYfL3HCU5731dOKP~17^kO
z`j3b2KcLN{G+PmLDe#IX3H6?QJmyJ8mnRB)JsDyo-Pw%LmZWQLZnl~aS(?lZjykhD
zobr*l)R}_Xb`?JIgk!GvJX(%qK`v9{<dGamrB;d<MwMBNi*UNEHnW>yBiDS?riN#@
z)!&xQPs-qEqDzU6560j*j>_93L=E-HWJuj?w>31FZ7sHXY-`^Jo491QT`Q`oWIab)
zkJfSY5<@Dd&26rCIrrk~vCU!(6+O@BD0h>^+1%LVYI)z>=xTD~x#LBccH$LLM-_Qg
zk*s&L*sNx&qj|sCYCGhpr<t>dOkv*YI)^iOk!%KW@q`*);Fil1hQ%j0h)k;EQulj}
zK~Do0l%C22E#`Kls@Zck9;|C{)Z?e8_VFujcpPI-ry4efki5aQ4+lFBLK<gGT^dnK
z<G;w!M3+`%#Yo5Mqp2b<4Ni8X^tYb27Rg<LfG|~z-?ql#nV&TMTW|iV#j^PXEcmf}
z?Y|6Uc%U^NAN^jrW-Ts+tlcXi>oG^126z*{nom%&ItoP!8vk{oJq!t?M}!I-nwIdB
zIlG+pBio^eSlK~rQ-jO16?lL48VDHWFU2!=B;Fh{j%ubQrIJQujxqi>ux8pymqgZk
zAs>z7ky!P8B0p2HCNR!PxaGE8t`Icb;r?w2$L7mfZn*HXT^=i3;C!}ELbcyYxeC1M
zH^_?8Ic=IrmJ32Eru|leh5zWW$EU&1W~*p8fpdK;dhT+0Mf%@WxA8Pso(lTGz*G>k
zr%(m`NMSMPRZ)~+9C3Q!ZCN*j5`l1XHWtcAsuB`IA_Wt@B^T@hncoGq%Aju%0RRhL
z_H8Ex#UO>)P@pGX!ZZ_1Q5L)o31~o1t{#U<(ia1IE)AnwOS9EVdOJa;5Xe#lSk}rw
z-!T-8RA)ggD^(?azO2K=1vUA)74p#Ni)Mv=q83<iGYq5sC7A6?X5Fp;>^_}>#y>Lf
z!g4Gr$cLTGpnYW`lU{g-2FW5$3AQr_+%aB)-M&OL{aHb=M8+lBJJ~)X<}9#?5;1K7
z6V5$|XW5j?Qe`-Cx1KlG?x|qs8t<}ZOU647caRVD5YL;37L-6DeMD9vR^9oBrFecd
zk-npfR<}YKO<5@#C||2(Lyuwp!#%A@B<~{awJ*II<!WFt5C{|woVy5L04TB88;98w
z8jPIMke*ABIN-em_jHg)tb<TPW(FZXoDE7oBFU{W`Y|jI!aDNo5LA&{Ltr4{FuY3M
z9j4+3!_XVa=GlLfjPzWC3SzttJ2h;Ig(eoU+yEUhe+LE~n_Ev!EVi3NuHS%->)6cN
z`}DXX5hL&#F^|9|^34d%<*yOQjACPhCm9?(BzKgi_3<dYOzw?>nRv#)Fz~||EZF}A
Dhn*Fp

delta 8921
zcmeGhYiv{3Img)XBX)4e(|KSAnCOGhbR}C_LhB4hcmxP5Y-1vF9NQ!wiEZqgju1i|
zpw+a8#`aCUttzJOU#E3z5SpfLZO0Eniik_st+135285<S6F}RKJ&M@(o$GsjuODpE
z#J^aw&N<)vob!F>ocn#Re`<K+lBxJd_xAsj<>lq+@Lz)e{Bqr~VynqeiT%psOHB3b
zxYzv39>WeC?*KO7Ve7#=@CYk}_5mlf9n!<_Ks{U<XfRliVj~nCs4ff$eL}D&<`K*Y
zvcZ<aPS`YR0{8wNF18sVOP#v|(NLhr6YGx&fnHBc@CpG>G~o3Iq9kY~Dyf>^6^lip
z;l2GH!Nk=g3{@JL0I%;~23H2Ft^RIb#OD!=i2f$Az~A@Rvqs)?59$pBe~L!du7Dt*
zoO}d)jf}K}{Q+tCWlsIQK?_^Xdn1F(4Mj-S07nL@$~wI<v@7h{73@L!{z$-%s1_nD
zl}z`0dcs}7kl!N|B4!g}YC(TsjBUW4)9Q(Yqk>1EDQzPrQ!Li)_k;ohR1d9YTL}aM
zLpDPN5<E(y8d<8;`h*@&U~d4YNFtu$^sfzd8j5lB2#qRy-O+HU-|y)Q1%;%QRzz+m
zWKlGNOY4gUBWME|zLrC|4Jvv&yn1NS0@?;2%KCP=(<6{Qj}x(CPjZ&ed83|aUr3@@
zp`nO)W3lh}Jqkqu%2-4c_DHxV=<DB&1_}!hsKX6d3LWu$LlusmAQG26?W7QIS0E%L
zXHIU}L_`k7AJoPpb`4=mBjK2^E4bIw>qVD}N)!Hq1``STcK1a*0&Q;_VruOwL1fu#
zA}{y$`GbOHMTy}_!j(yWl*VS~KK}c7rGfnPD@15Z3gMnx$05G1XqdFq+M39@$d}>s
zcoFAvbDCsSaIRGZfj=BF<_iX7S;mJQ!)Ep@^^Cp%d6p3hhn-g1H}pVq_brI5g=51@
zx$}RWNUgozkRLadod2r?DBvEzr54lJBJ`qN#Jz;m3w@ygiX-}U1km^S1JA*~hg%Kg
z;|~$2SYGWty<NE0L~6uUcnE%eu+dP4qc0LwRn~14$U$2XUkmpRTG(dlS<t_v5L!x%
zR*BK$@9c~DVfmpx_B4TUHLM2WUPz;&zK|~*+7;x+(pmE`K?~)G5Nrtg27+o$KCiDE
z!`BKw9(3A*(LJ5s9&gBp5Hr*cIt!x_UndV?67m>VRB_k_Ylf?jHy`%9=QZf^U}UTr
zPcheV^XN?*y!vqsIHuRZ(aRNZcft>))2*=nBkH$8|G5er`+0xj0`*&gTEcCblE#~+
zs-gXS3zVF5Abulne>J%i9DjL>%dMHHhPn&uAaPNmPh6~l<ri9@;S*`x@CosEa9;O$
zKa70nfIAm9{^W`Sdat(vyHWu&XEj3tKYz8tNE`L+nkCRSxfb5JQqIZWMsoA@4KQ%3
zl8^s*ts3qoTHyU_HN1T*DVFHk-`fc4@yyv=d~0F)v>)D>s)WS&2IhhzV>R&h%z7xh
zR*u@%A!N_KVmPu-4|h+uszyINXM*1GH7ZD5LWM7&+o~M@6htFqt5HiOO_r|#S;Mt{
zD9xnwS_PjGwnlQB5}lqlG9_CjEuI5|=jMOa^D^!WtuVE;lJ~PoO-rk(pLHm^^8Qpi
zmlK?=hNCyuL2wrR=0+>F%9zh%=qWv%m}!CCvz0QPk-VMYBV!Jj`LqIV<H}w<X@$^X
z6V#2``Aq4Sck%gTrLoc4((#0Ai>v#yQ(KIB8rZq}r&i5Ebn`d{!k0R6yIP>_lEb(P
zLC>K0w#jyQb7m8~I9bJUKb=H%xJB3+$%MQ-#vM?XbigeBO6-VMR)%JKcD8aJ`7ZXE
z8*ZQJAmexkzI)4o8aKoDZ<TQur7>y5R-^HQYgOE(T~{T%?BdjtbEfb$+;SP8jox;B
zE&TGMO8CXt25c9?#Jg*`yQ2dzbfzgO7LQ@b(>7CxzI>w<S1k_lQx2&6tYt1-=fd>?
zg)4@L4ukB@Nj#UvTj=?~M<q&#asnL;Cp;Xf(~#=m*v(EIzSHiUEYXC|eFApwf|<Ku
zq|Zp#|9`>o%SyUn^60qN;ccY$Wg4aVGJc3AeOa#|)l0riz?3g*-T?o@`(ulA(<IMr
z<=RO?6CD&o?s~X$Mv5kv+5!!n;>vAT5hjgxyA>GrQc<gcBeQhx@sM>Z6OJpq*h}%^
zMU$ZpEu6b`=5Cz_bnA?aHQ3^G)lfL#U#~pzrAK{Zb}Wx}`R#}@%yH!9GT_&vPJB=|
zr9s-?ONY#y)j}5I;lVN=id!`Xm=yDlo^j{EWHUU)SC`1ar@Xew4EolZyE*5g?tw*J
zbL!Jfb91K0W9pNe+<M|&Z9FR2^mx>ShCOG{q%hfnCWTE88U>>XnsnRUir%}YwLzD{
zWYe3%)+LhHxa!MMdmzLW9q9)`3X@Go3Y$JR1*4hUiI3ZpDIzKLgQ+2WN@(tS)jh6(
zXTAa2REOh%KRe;*RU<ROv9T3}$}x(^DIP;xMi<V@&vT&{HrO>N)D4#t3!!TIOPPq~
z^Go2($u_-?sMzK0x|bM?e9#X4(@k0hCRDHp_Kd$YUn3lI2S>)XXMxqglQ$Z(z_)9~
zVs3SmzO5UzrcqYra$;L1t&|M<Ya+W!+x6^nGKFs)-<Ao?sgY7X2QjmdHX#>Hz6LV1
zx+Lqh3J92?HA$(RrwiAF=9#twZVo;@#WN>7kCY{`GWVS}_nr1&zSA<!6+8#Xp|!pn
zCnr_X5XhrF0^B(w#+^-;<nY<!K*?L63e^cYJLbf6T$5HQW;)tN9pJcPh2M-lEoG1~
zZ;k0Xp!D6{8|ug9JJab;Qi3GLwKR({@6xE!n~lavA*?+E@?1HNVnQ^ZPdkz*F`M<^
zCPXH+DHk;&GO2MV@VHA`D7So`rNQHT0qf3Dep8d0-KtuHg=f-Njv(5{JVCUNd4wo?
zd1+q_jNWp?>04I&=l5ps(GNW%4;uzs|Fw*g-N)D8jxlKZTPYt*+$kzyJH(p?_AL_?
zuYy=66(7rI%f$YC<|wov2&=KldbRjMKHJ$wrSII;Y5Fda|HQ4-Bn25tE!6=@RTL|?
z;<<eGu$~Il;%E76vzh8_yo@L=GqUaisx2m~%;J0#D_cN?TDfi}Rb9mwjO=$-(k7RW
z#my$xT1lyTnNn)yda?Ke6YChFDzRJ*Q<W^$hSFiEt`e(p+z_f)=ip5lnkpQt`HR%{
z@tKIr^I5qD%<H`zY%4%hluEJq4-=~&qWZ8r!7P<wwXzZ<RrcaO2FrCzxk{{-K@*bk
zR4d*^<ytiX?NzrRL~<?(6_GQ`$LS){ipb(hGpk=hE+ZF>)eHoeOUI(e%vLNSh+HU6
zr^MAl9}r(NvsDIO6&C+wW-FcKbIB^OnuDr=<WetM*kVqTto)|aQ2kddwXjAz#gM#2
zRQeTnTG&eQriEDxR2w8dZeqpaD;D+yXOOl~D&~qOEUZ^_o0xvFx_qnFXht1Lw-ucQ
X?9rv<r0S||I&rdo``e}hcDwsOzzZro

diff --git a/scripts/selinux/nginx_agent.te b/scripts/selinux/nginx_agent.te
index 541111474..16acfdfab 100644
--- a/scripts/selinux/nginx_agent.te
+++ b/scripts/selinux/nginx_agent.te
@@ -35,141 +35,111 @@ files_read_etc_files(nginx_agent_t)
 
 miscfiles_read_localization(nginx_agent_t)
 
+domain_read_all_domains_state(nginx_agent_t)
+
 require {
-	type unconfined_t;
+	type bin_t;
+	type fs_t;
+	type sysctl_net_t;
+	type proc_net_t;
+	type sysfs_t;
+	type var_lib_t;
 	type var_run_t;
-	type rpcbind_t;
-	type system_cronjob_t;
-	type policykit_t;
-	type irqbalance_t;
-	type tuned_t;
-	type postfix_pickup_t;
-	type dhcpc_t;
-	type system_dbusd_t;
-	type postfix_qmgr_t;
-	type nginx_agent_t;
-	class sock_file { create setattr unlink };
-	class netlink_route_socket { bind create getattr nlmsg_read };
-	class capability sys_ptrace;
-	class dir { getattr search };
-	class file { getattr open read };
+	type httpd_config_t;
+	type httpd_exec_t;
+	type httpd_log_t;
+	type passwd_file_t;
+	type shell_exec_t;
+	type http_port_t;
+	type node_t;
+	type transproxy_port_t;
+	type cert_t;
+	type httpd_t;
+	type httpd_var_run_t;
+	type dosfs_t;
+	type httpd_cache_t;
+	class dir watch;
+	type sssd_public_t;
+	type sssd_var_lib_t;
+	type net_conf_t;
+	type fixed_disk_device_t;
 }
 
-#============= nginx_agent_t ==============
-allow nginx_agent_t dhcpc_t:dir { getattr search };
-allow nginx_agent_t dhcpc_t:file { getattr open read };
-allow nginx_agent_t irqbalance_t:dir { getattr search };
-allow nginx_agent_t irqbalance_t:file { getattr open read };
-allow nginx_agent_t policykit_t:dir { getattr search };
-allow nginx_agent_t policykit_t:file { getattr open read };
-allow nginx_agent_t postfix_pickup_t:dir { getattr search };
-allow nginx_agent_t postfix_pickup_t:file { getattr open read };
-allow nginx_agent_t postfix_qmgr_t:dir { getattr search };
-allow nginx_agent_t postfix_qmgr_t:file { getattr open read };
-allow nginx_agent_t rpcbind_t:dir { getattr search };
-allow nginx_agent_t rpcbind_t:file { getattr open read };
+allow nginx_agent_t bin_t:file { execute execute_no_trans };
+allow nginx_agent_t fs_t:filesystem getattr;
+allow nginx_agent_t proc_net_t:file { getattr open read };
+allow nginx_agent_t proc_t:dir read;
+allow nginx_agent_t proc_t:file { getattr open read };
+allow nginx_agent_t proc_t:filesystem getattr;
 allow nginx_agent_t self:capability sys_ptrace;
 allow nginx_agent_t self:netlink_route_socket { bind create getattr nlmsg_read };
-allow nginx_agent_t system_cronjob_t:dir { getattr search };
-allow nginx_agent_t system_cronjob_t:file { getattr open read };
-allow nginx_agent_t system_dbusd_t:dir { getattr search };
-allow nginx_agent_t system_dbusd_t:file { getattr open read };
-allow nginx_agent_t tuned_t:dir { getattr search };
-allow nginx_agent_t tuned_t:file { getattr open read };
-allow nginx_agent_t unconfined_t:dir { getattr search };
-allow nginx_agent_t unconfined_t:file { getattr open read };
-allow nginx_agent_t var_run_t:sock_file { create setattr unlink };
-chronyd_systemctl(nginx_agent_t)
-corecmd_exec_ls(nginx_agent_t)
-cron_read_state_crond(nginx_agent_t)
-dev_list_sysfs(nginx_agent_t)
-dev_read_sysfs(nginx_agent_t)
-files_manage_generic_tmp_files(nginx_agent_t)
-files_read_var_lib_files(nginx_agent_t)
-files_rw_pid_dirs(nginx_agent_t)
-fs_getattr_xattr_fs(nginx_agent_t)
-getty_systemctl(nginx_agent_t)
-gssproxy_systemctl(nginx_agent_t)
-init_read_state(nginx_agent_t)
-kernel_getattr_proc(nginx_agent_t)
-kernel_list_proc(nginx_agent_t)
-kernel_read_net_sysctls(nginx_agent_t)
-kernel_read_network_state(nginx_agent_t)
-kernel_read_state(nginx_agent_t)
-kernel_read_system_state(nginx_agent_t)
-kernel_search_network_sysctl(nginx_agent_t)
-logging_systemctl_audit(nginx_agent_t)
-postfix_read_master_state(nginx_agent_t)
-ssh_systemctl(nginx_agent_t)
-systemd_logind_read_state(nginx_agent_t)
-udev_read_state(nginx_agent_t)
+allow nginx_agent_t sysctl_net_t:dir search;
+allow nginx_agent_t sysctl_net_t:file { open read };
+allow nginx_agent_t sysfs_t:dir read;
+allow nginx_agent_t sysfs_t:file { getattr open read };
+allow nginx_agent_t sysfs_t:lnk_file read;
 
-require {
-	type policykit_t;
-	type dhcpc_t;
-	type rpcbind_t;
-	type nginx_agent_t;
-	class dir { getattr search };
-	class file { getattr open read };
-}
-
-#============= nginx_agent_t ==============
+#!!!! WARNING: 'tmp_t' is a base type.
+allow nginx_agent_t tmp_t:file write;
 
-#!!!! This avc is allowed in the current policy
-allow nginx_agent_t dhcpc_t:dir { getattr search };
+#!!!! WARNING: 'var_lib_t' is a base type.
+allow nginx_agent_t var_lib_t:file { getattr open read };
 
-#!!!! This avc is allowed in the current policy
-allow nginx_agent_t policykit_t:file { getattr open read };
+#!!!! WARNING: 'var_run_t' is a base type.
+allow nginx_agent_t var_run_t:dir { add_name remove_name write };
 
-#!!!! This avc is allowed in the current policy
-allow nginx_agent_t rpcbind_t:file { getattr open read };
-kernel_read_network_state(nginx_agent_t)
-
-require {
-	type unconfined_t;
-	type httpd_var_run_t;
-	type http_port_t;
-	type nginx_agent_t;
-	type netutils_t;
-	class capability { dac_override net_bind_service };
-	class tcp_socket { bind connect create getattr getopt name_bind name_connect setopt };
-	class lnk_file read;
-	class dir { getattr search };
-	class file { getattr open read write };
-}
+#!!!! WARNING: 'var_run_t' is a base type.
+allow nginx_agent_t var_run_t:sock_file { create setattr unlink };
 
-#============= nginx_agent_t ==============
-allow nginx_agent_t http_port_t:tcp_socket { name_bind name_connect };
+#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
+allow nginx_agent_t bin_t:file map;
+allow nginx_agent_t httpd_config_t:dir { getattr open read search };
+allow nginx_agent_t httpd_config_t:file { getattr open read };
+
+#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
+allow nginx_agent_t httpd_exec_t:file map;
+allow nginx_agent_t httpd_exec_t:file { execute execute_no_trans getattr open read };
+allow nginx_agent_t httpd_log_t:dir search;
+allow nginx_agent_t passwd_file_t:file { getattr open read };
+allow nginx_agent_t self:capability dac_read_search;
+
+#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
+allow nginx_agent_t shell_exec_t:file map;
+allow nginx_agent_t shell_exec_t:file { execute execute_no_trans };
+allow nginx_agent_t tmp_t:dir { add_name write };
+allow nginx_agent_t tmp_t:file create;
+allow nginx_agent_t http_port_t:tcp_socket name_connect;
+allow nginx_agent_t self:tcp_socket { connect create getattr getopt setopt };
+allow nginx_agent_t httpd_config_t:lnk_file getattr;
+allow nginx_agent_t node_t:tcp_socket node_bind;
+allow nginx_agent_t self:tcp_socket { accept bind listen };
+allow nginx_agent_t transproxy_port_t:tcp_socket name_bind;
+
+allow nginx_agent_t cert_t:file { getattr open read };
+allow nginx_agent_t http_port_t:tcp_socket name_bind;
+allow nginx_agent_t httpd_config_t:file write;
+allow nginx_agent_t httpd_log_t:file { open read };
+allow nginx_agent_t httpd_t:process signal;
 allow nginx_agent_t httpd_var_run_t:file { open read write };
-allow nginx_agent_t netutils_t:dir { getattr search };
-allow nginx_agent_t netutils_t:file { getattr open read };
 allow nginx_agent_t self:capability { dac_override net_bind_service };
-allow nginx_agent_t self:tcp_socket { bind connect create getattr getopt setopt };
-allow nginx_agent_t unconfined_t:lnk_file read;
-apache_exec(nginx_agent_t)
-apache_manage_config(nginx_agent_t)
-apache_read_config(nginx_agent_t)
-apache_read_log(nginx_agent_t)
-apache_signal(nginx_agent_t)
-apache_systemctl(nginx_agent_t)
-auth_read_passwd(nginx_agent_t)
-corenet_tcp_bind_generic_node(nginx_agent_t)
-files_manage_urandom_seed(nginx_agent_t)
-miscfiles_read_certs(nginx_agent_t)
+allow nginx_agent_t cert_t:dir search;
 
-require {
-	type sshd_net_t;
-	type rpm_script_t;
-	type mandb_t;
-}
+#!!!! WARNING: 'var_lib_t' is a base type.
+allow nginx_agent_t var_lib_t:file write;
 
-allow nginx_agent_t mandb_t:dir { getattr search };
-allow nginx_agent_t mandb_t:file { getattr open read };
-allow nginx_agent_t rpm_script_t:dir { getattr search };
-allow nginx_agent_t rpm_script_t:file { getattr open read };
-allow nginx_agent_t sshd_net_t:dir { getattr search };
-allow nginx_agent_t sshd_net_t:file { getattr open read };
+allow nginx_agent_t dosfs_t:filesystem getattr;
+allow nginx_agent_t httpd_cache_t:dir { getattr search };
+allow nginx_agent_t proc_net_t:lnk_file read;
+allow nginx_agent_t tmp_t:file open;
+allow nginx_agent_t httpd_config_t:dir watch;
 
 apache_list_cache(nginx_agent_t)
+apache_manage_config(nginx_agent_t)
 fs_getattr_dos_fs(nginx_agent_t)
-init_read_script_state(nginx_agent_t)
+kernel_read_network_state_symlinks(nginx_agent_t)
+
+allow nginx_agent_t sssd_public_t:dir search;
+allow nginx_agent_t sssd_var_lib_t:dir search;
+allow nginx_agent_t net_conf_t:file { getattr open read };
+allow nginx_agent_t self:udp_socket { connect create getattr setopt };
+allow nginx_agent_t fixed_disk_device_t:blk_file getattr;
\ No newline at end of file