subject /sbin/insmod o
/ h
/var/log/ksymoop rlacwxd
/lib rx
/etc/modules.conf r
-CAP_ALL
+CAP_SYS_MODULE
bind disabled
connect disabled
subject /usr/sbin/named
/ h
/etc/bind rx
/usr/sbin/named rx
/var/cache/bind rwx
/var/run/bind/run/named.pid w
/sbin/insmod rx
/dev/log rw
-CAP_ALL
+CAP_SYS_MODULE
connect 0.0.0.0/0:53 dgram udp
connect 0.0.0.0/0:53 stream tcp
bind 0.0.0.0/0:53 dgram udp
bind 0.0.0.0/0:53 stream tcp