You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

starwels.if 2.9KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157
  1. ## <summary>policy for starwels</summary>
  2. ########################################
  3. ## <summary>
  4. ## Transition to starwels.
  5. ## </summary>
  6. ## <param name="domain">
  7. ## <summary>
  8. ## Domain allowed to transition.
  9. ## </summary>
  10. ## </param>
  11. #
  12. interface(`starwels_domtrans',`
  13. gen_require(`
  14. type starwels_t, starwels_exec_t;
  15. ')
  16. corecmd_search_bin($1)
  17. domtrans_pattern($1, starwels_exec_t, starwels_t)
  18. ')
  19. ########################################
  20. ## <summary>
  21. ## Execute starwels server in the starwels domain.
  22. ## </summary>
  23. ## <param name="domain">
  24. ## <summary>
  25. ## Domain allowed access.
  26. ## </summary>
  27. ## </param>
  28. #
  29. interface(`starwels_initrc_domtrans',`
  30. gen_require(`
  31. type starwels_initrc_exec_t;
  32. ')
  33. init_labeled_script_domtrans($1, starwels_initrc_exec_t)
  34. ')
  35. ########################################
  36. ## <summary>
  37. ## Search starwels lib directories.
  38. ## </summary>
  39. ## <param name="domain">
  40. ## <summary>
  41. ## Domain allowed access.
  42. ## </summary>
  43. ## </param>
  44. #
  45. interface(`starwels_search_lib',`
  46. gen_require(`
  47. type starwels_var_lib_t;
  48. ')
  49. allow $1 starwels_var_lib_t:dir search_dir_perms;
  50. files_search_var_lib($1)
  51. ')
  52. ########################################
  53. ## <summary>
  54. ## Read starwels lib files.
  55. ## </summary>
  56. ## <param name="domain">
  57. ## <summary>
  58. ## Domain allowed access.
  59. ## </summary>
  60. ## </param>
  61. #
  62. interface(`starwels_read_lib_files',`
  63. gen_require(`
  64. type starwels_var_lib_t;
  65. ')
  66. files_search_var_lib($1)
  67. read_files_pattern($1, starwels_var_lib_t, starwels_var_lib_t)
  68. ')
  69. ########################################
  70. ## <summary>
  71. ## Manage starwels lib files.
  72. ## </summary>
  73. ## <param name="domain">
  74. ## <summary>
  75. ## Domain allowed access.
  76. ## </summary>
  77. ## </param>
  78. #
  79. interface(`starwels_manage_lib_files',`
  80. gen_require(`
  81. type starwels_var_lib_t;
  82. ')
  83. files_search_var_lib($1)
  84. manage_files_pattern($1, starwels_var_lib_t, starwels_var_lib_t)
  85. ')
  86. ########################################
  87. ## <summary>
  88. ## Manage starwels lib directories.
  89. ## </summary>
  90. ## <param name="domain">
  91. ## <summary>
  92. ## Domain allowed access.
  93. ## </summary>
  94. ## </param>
  95. #
  96. interface(`starwels_manage_lib_dirs',`
  97. gen_require(`
  98. type starwels_var_lib_t;
  99. ')
  100. files_search_var_lib($1)
  101. manage_dirs_pattern($1, starwels_var_lib_t, starwels_var_lib_t)
  102. ')
  103. ########################################
  104. ## <summary>
  105. ## All of the rules required to administrate
  106. ## a starwels environment
  107. ## </summary>
  108. ## <param name="domain">
  109. ## <summary>
  110. ## Domain allowed access.
  111. ## </summary>
  112. ## </param>
  113. ## <param name="role">
  114. ## <summary>
  115. ## Role allowed access.
  116. ## </summary>
  117. ## </param>
  118. ## <rolecap/>
  119. #
  120. interface(`starwels_admin',`
  121. gen_require(`
  122. type starwels_t;
  123. type starwels_initrc_exec_t;
  124. type starwels_var_lib_t;
  125. ')
  126. allow $1 starwels_t:process { ptrace signal_perms };
  127. ps_process_pattern($1, starwels_t)
  128. starwels_initrc_domtrans($1)
  129. domain_system_change_exemption($1)
  130. role_transition $2 starwels_initrc_exec_t system_r;
  131. allow $2 system_r;
  132. files_search_var_lib($1)
  133. admin_pattern($1, starwels_var_lib_t)
  134. ')