##

policy for matahari

###################################### ##

## Creates types and rules for a basic ## matahari init daemon domain. ##

## ##

## Prefix for the domain. ##

## # template(`matahari_domain_template',` gen_require(` attribute matahari_domain; ') ############################## # # Declarations # type matahari_$1_t, matahari_domain; type matahari_$1_exec_t; init_daemon_domain(matahari_$1_t, matahari_$1_exec_t) ') ######################################## ##

## Search matahari lib directories. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_search_lib',` gen_require(` type matahari_var_lib_t; ') allow $1 matahari_var_lib_t:dir search_dir_perms; files_search_var_lib($1) ') ######################################## ##

## Read matahari lib files. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_read_lib_files',` gen_require(` type matahari_var_lib_t; ') files_search_var_lib($1) read_files_pattern($1, matahari_var_lib_t, matahari_var_lib_t) ') ######################################## ##

## Create, read, write, and delete ## matahari lib files. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_manage_lib_files',` gen_require(` type matahari_var_lib_t; ') files_search_var_lib($1) manage_files_pattern($1, matahari_var_lib_t, matahari_var_lib_t) ') ######################################## ##

## Manage matahari lib dirs files. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_manage_lib_dirs',` gen_require(` type matahari_var_lib_t; ') files_search_var_lib($1) manage_dirs_pattern($1, matahari_var_lib_t, matahari_var_lib_t) ') ######################################## ##

## Read matahari PID files. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_read_pid_files',` gen_require(` type matahari_var_run_t; ') files_search_pids($1) allow $1 matahari_var_run_t:file read_file_perms; ') ######################################## ##

## Read matahari PID files. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_manage_pid_files',` gen_require(` type matahari_var_run_t; ') files_search_pids($1) manage_files_pattern($1, matahari_var_run_t, matahari_var_run_t) ') ######################################## ##

## Execute a domain transition to run matahari_hostd. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_hostd_domtrans',` gen_require(` type matahari_hostd_t, matahari_hostd_exec_t; ') domtrans_pattern($1, matahari_hostd_exec_t, matahari_hostd_t) ') ######################################## ##

## Execute a domain transition to run matahari_netd. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_netd_domtrans',` gen_require(` type matahari_netd_t, matahari_netd_exec_t; ') domtrans_pattern($1, matahari_netd_exec_t, matahari_netd_t) ') ######################################## ##

## Execute a domain transition to run matahari_serviced. ##

## ##

## Domain allowed access. ##

## # interface(`matahari_serviced_domtrans',` gen_require(` type matahari_serviced_t, matahari_serviced_exec_t; ') domtrans_pattern($1, matahari_serviced_exec_t, matahari_serviced_t) ') ######################################## ##

## All of the rules required to administrate ## an matahari environment ##

## ##

## Domain allowed access. ##

## ## ##

## Role allowed access. ##

## ## # interface(`matahari_admin',` gen_require(` type matahari_initrc_exec_t, matahari_hostd_t; type matahari_netd_t, matahari_serviced_t, matahari_sysconfigd_t; type matahari_var_lib_t, matahari_var_run_t; ') init_labeled_script_domtrans($1, matahari_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 matahari_initrc_exec_t system_r; allow $2 system_r; allow $1 matahari_netd_t:process { ptrace signal_perms }; ps_process_pattern($1, matahari_netd_t) allow $1 matahari_hostd_t:process { ptrace signal_perms }; ps_process_pattern($1, matahari_hostd_t) allow $1 matahari_serviced_t:process { ptrace signal_perms }; ps_process_pattern($1, matahari_serviced_t) allow $1 matahari_sysconfigd_t:process { ptrace signal_perms }; ps_process_pattern($1, matahari_sysconfigd_t) files_search_var_lib($1) admin_pattern($1, matahari_var_lib_t) files_search_pids($1) admin_pattern($1, matahari_var_run_t) ')