SELinux: Varnish + reading symlinks in /etc/varnish

varnishlnkfile.te

module varnishlnkfile 1.0.0;

# The changes linked below did not trigger a version bump so on some systems reading usr_t in .vcl's is restricted
# http://j.mp/selinux-varnish-symlinks

# @gist https://gist.github.com/Zamber/7d82850abf3a17fdd401

require {
  type usr_t;
  type varnishd_t;
  type varnishd_etc_t;
  class process sigkill;
  class file { read open getattr };
  class lnk_file { read getattr };
};

allow varnishd_t self:process sigkill;
allow varnishd_t usr_t:file { read open getattr };
allow varnishd_t varnishd_etc_t:lnk_file { read getattr };