##

policy for keystone

######################################## ##

## Transition to keystone. ##

## ##

## Domain allowed to transition. ##

## # interface(`keystone_domtrans',` gen_require(` type keystone_t, keystone_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, keystone_exec_t, keystone_t) ') ######################################## ##

## Read keystone's log files. ##

## ##

## Domain allowed access. ##

## ## # interface(`keystone_read_log',` gen_require(` type keystone_log_t; ') logging_search_logs($1) read_files_pattern($1, keystone_log_t, keystone_log_t) ') ######################################## ##

## Append to keystone log files. ##

## ##

## Domain allowed access. ##

## # interface(`keystone_append_log',` gen_require(` type keystone_log_t; ') logging_search_logs($1) append_files_pattern($1, keystone_log_t, keystone_log_t) ') ######################################## ##

## Manage keystone log files ##

## ##

## Domain allowed access. ##

## # interface(`keystone_manage_log',` gen_require(` type keystone_log_t; ') logging_search_logs($1) manage_dirs_pattern($1, keystone_log_t, keystone_log_t) manage_files_pattern($1, keystone_log_t, keystone_log_t) manage_lnk_files_pattern($1, keystone_log_t, keystone_log_t) ') ######################################## ##

## Search keystone lib directories. ##

## ##

## Domain allowed access. ##

## # interface(`keystone_search_lib',` gen_require(` type keystone_var_lib_t; ') allow $1 keystone_var_lib_t:dir search_dir_perms; files_search_var_lib($1) ') ######################################## ##

## Read keystone lib files. ##

## ##

## Domain allowed access. ##

## # interface(`keystone_read_lib_files',` gen_require(` type keystone_var_lib_t; ') files_search_var_lib($1) read_files_pattern($1, keystone_var_lib_t, keystone_var_lib_t) ') ######################################## ##

## Manage keystone lib files. ##

## ##

## Domain allowed access. ##

## # interface(`keystone_manage_lib_files',` gen_require(` type keystone_var_lib_t; ') files_search_var_lib($1) manage_files_pattern($1, keystone_var_lib_t, keystone_var_lib_t) ') ######################################## ##

## Manage keystone lib directories. ##

## ##

## Domain allowed access. ##

## # interface(`keystone_manage_lib_dirs',` gen_require(` type keystone_var_lib_t; ') files_search_var_lib($1) manage_dirs_pattern($1, keystone_var_lib_t, keystone_var_lib_t) ') ######################################## ##

## All of the rules required to administrate ## an keystone environment ##

## ##

## Domain allowed access. ##

## ## ##

## Role allowed access. ##

## ## # interface(`keystone_admin',` gen_require(` type keystone_t; type keystone_log_t; type keystone_var_lib_t; type keystone_var_run_t; type keystone_initrc_exec_t; ') init_labeled_script_domtrans($1, keystone_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 keystone_initrc_exec_t system_r; allow $2 system_r; allow $1 keystone_t:process { ptrace signal_perms }; ps_process_pattern($1, keystone_t) logging_search_logs($1) admin_pattern($1, keystone_log_t) files_list_pids($1) admin_pattern($1, keystone_var_run_t) files_search_var_lib($1) admin_pattern($1, keystone_var_lib_t) ')