From 8c2f46403362398b17348da14c551acad1cdc0b4 Mon Sep 17 00:00:00 2001 From: Kenton Groombridge Date: Mon, 6 May 2024 16:33:13 -0400 Subject: matrixd: add tunable for binding to all unreserved ports This is to support using Synapse workers which require binding to multiple TCP ports in lieu of manually labeling unreserved ports for use. Signed-off-by: Kenton Groombridge --- policy/modules/services/matrixd.te | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'policy') diff --git a/policy/modules/services/matrixd.te b/policy/modules/services/matrixd.te index c396a3d7..5f092f31 100644 --- a/policy/modules/services/matrixd.te +++ b/policy/modules/services/matrixd.te @@ -20,6 +20,16 @@ gen_tunable(matrix_allow_federation, true) ## gen_tunable(matrix_postgresql_connect, false) +## +##

+## Determine whether Matrixd is allowed to bind all +## TCP ports. This is intended for more complex Matrix +## server configurations (e.g. Synapse workers) and may +## be used in lieu of manually labeling each port. +##

+## +gen_tunable(matrix_bind_all_unreserved_tcp_ports, false) + type matrixd_t; type matrixd_exec_t; init_daemon_domain(matrixd_t, matrixd_exec_t) @@ -117,7 +127,11 @@ tunable_policy(`matrix_postgresql_connect',` postgresql_tcp_connect(matrixd_t) ') +tunable_policy(`matrix_bind_all_unreserved_tcp_ports',` + corenet_tcp_bind_all_unreserved_ports(matrixd_t) +') + optional_policy(` apache_search_config(matrixd_t) ') - + -- cgit v1.2.3-65-gdbad