#

# Macros for lockdev domains.

#

#

# Authors:  Daniel Walsh <dwalsh@redhat.com> 

#

#

# lockdev_domain(domain_prefix)

#

# Define a derived domain for the lockdev programs when executed

# by a user domain.

#

# The type declaration for the executable type for this program is

# provided separately in domains/program/lockdev.te. 

#

undefine(`lockdev_domain')

define(`lockdev_domain',`

# Derived domain based on the calling user domain and the program

type $1_lockdev_t, domain, privlog;

# Transition from the user domain to the derived domain.

domain_auto_trans($1_t, lockdev_exec_t, $1_lockdev_t)

# The user role is authorized for this domain.

role $1_r types $1_lockdev_t;

# Use capabilities.

allow $1_lockdev_t self:capability setgid;

allow $1_lockdev_t $1_t:process signull;

allow $1_lockdev_t var_t:dir search;

lock_domain($1_lockdev)

r_dir_file($1_lockdev_t, lockfile)

allow $1_lockdev_t device_t:dir search;

allow $1_lockdev_t null_device_t:chr_file rw_file_perms;

access_terminal($1_lockdev_t, $1)

dontaudit $1_lockdev_t root_t:dir search;

uses_shlib($1_lockdev_t)

allow $1_lockdev_t fs_t:filesystem getattr;

')dnl end macro definition