Chris PeBenito 625be1
## <summary>Shoreline Firewall high-level tool for configuring netfilter</summary>
Chris PeBenito 625be1
Chris PeBenito 625be1
########################################
Chris PeBenito 625be1
## <summary>
Chris PeBenito 625be1
##	Execute a domain transition to run shorewall.
Chris PeBenito 625be1
## </summary>
Chris PeBenito 625be1
## <param name="domain">
Chris PeBenito 625be1
## <summary>
Chris PeBenito 625be1
##	Domain allowed to transition.
Chris PeBenito 625be1
## </summary>
Chris PeBenito 625be1
## </param>
Chris PeBenito 625be1
#
Chris PeBenito 625be1
interface(`shorewall_domtrans',`
Chris PeBenito 625be1
	gen_require(`
Chris PeBenito 625be1
		type shorewall_t, shorewall_exec_t;
Chris PeBenito 625be1
	')
Chris PeBenito 625be1
Chris PeBenito 625be1
	domtrans_pattern($1, shorewall_exec_t, shorewall_t)
Chris PeBenito 625be1
')
Chris PeBenito 625be1
Dan Walsh 3eaa99
######################################
Dan Walsh 3eaa99
## <summary>
Dan Walsh 3eaa99
##      Execute a domain transition to run shorewall.
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## <param name="domain">
Dan Walsh 3eaa99
## <summary>
Dan Walsh 3eaa99
##      Domain allowed to transition.
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
interface(`shorewall_domtrans_lib',`
Dan Walsh 3eaa99
        gen_require(`
Dan Walsh 3eaa99
                type shorewall_t, shorewall_var_lib_t;
Dan Walsh 3eaa99
        ')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
        domtrans_pattern($1, shorewall_var_lib_t, shorewall_t)
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99
Chris PeBenito 625be1
#######################################
Chris PeBenito 625be1
## <summary>
Chris PeBenito 625be1
##	Read shorewall etc configuration files.
Chris PeBenito 625be1
## </summary>
Chris PeBenito 625be1
## <param name="domain">
Chris PeBenito 625be1
##	<summary>
Chris PeBenito 625be1
##	Domain allowed access.
Chris PeBenito 625be1
##	</summary>
Chris PeBenito 625be1
## </param>
Chris PeBenito 625be1
#
Chris PeBenito 625be1
interface(`shorewall_read_config',`
Chris PeBenito 625be1
	gen_require(`
Chris PeBenito 625be1
		type shorewall_etc_t;
Chris PeBenito 625be1
	')
Chris PeBenito 625be1
Chris PeBenito 625be1
	files_search_etc($1)
Chris PeBenito 625be1
	read_files_pattern($1, shorewall_etc_t, shorewall_etc_t)
Chris PeBenito 625be1
')
Chris PeBenito 625be1
Chris PeBenito 625be1
#######################################
Chris PeBenito 625be1
## <summary>
Chris PeBenito 625be1
##	Read shorewall PID files.
Chris PeBenito 625be1
## </summary>
Chris PeBenito 625be1
## <param name="domain">
Chris PeBenito 625be1
##	<summary>
Chris PeBenito 625be1
##	Domain allowed access.
Chris PeBenito 625be1
##	</summary>
Chris PeBenito 625be1
## </param>
Chris PeBenito 625be1
#
Chris PeBenito 625be1
interface(`shorewall_read_pid_files',`
Chris PeBenito 625be1
	gen_require(`
Chris PeBenito 625be1
		type shorewall_var_run_t;
Chris PeBenito 625be1
	')
Chris PeBenito 625be1
Chris PeBenito 625be1
	files_search_pids($1)
Chris PeBenito 625be1
	read_files_pattern($1, shorewall_var_run_t, shorewall_var_run_t)
Chris PeBenito 625be1
')
Chris PeBenito 625be1
Chris PeBenito 625be1
#######################################
Chris PeBenito 625be1
## <summary>
Chris PeBenito 625be1
##	Read and write shorewall PID files.
Chris PeBenito 625be1
## </summary>
Chris PeBenito 625be1
## <param name="domain">
Chris PeBenito 625be1
##	<summary>
Chris PeBenito 625be1
##	Domain allowed access.
Chris PeBenito 625be1
##	</summary>
Chris PeBenito 625be1
## </param>
Chris PeBenito 625be1
#
Chris PeBenito 625be1
interface(`shorewall_rw_pid_files',`
Chris PeBenito 625be1
	gen_require(`
Chris PeBenito 625be1
		type shorewall_var_run_t;
Chris PeBenito 625be1
	')
Chris PeBenito 625be1
Chris PeBenito 625be1
	files_search_pids($1)
Chris PeBenito 625be1
	rw_files_pattern($1, shorewall_var_run_t, shorewall_var_run_t)
Chris PeBenito 625be1
')
Chris PeBenito 625be1
Chris PeBenito fa03ec
######################################
Chris PeBenito fa03ec
## <summary>
Chris PeBenito fa03ec
##      Read shorewall /var/lib files.
Chris PeBenito fa03ec
## </summary>
Chris PeBenito fa03ec
## <param name="domain">
Chris PeBenito fa03ec
##      <summary>
Chris PeBenito fa03ec
##      Domain allowed access.
Chris PeBenito fa03ec
##      </summary>
Chris PeBenito fa03ec
## </param>
Chris PeBenito fa03ec
#
Chris PeBenito fa03ec
interface(`shorewall_read_lib_files',`
Chris PeBenito fa03ec
        gen_require(`
Chris PeBenito fa03ec
                type shorewall_t;
Chris PeBenito fa03ec
       ')
Chris PeBenito fa03ec
Chris PeBenito fa03ec
        files_search_var_lib($1)
Chris PeBenito fa03ec
        search_dirs_pattern($1, shorewall_var_lib_t, shorewall_var_lib_t)
Chris PeBenito fa03ec
        read_files_pattern($1, shorewall_var_lib_t, shorewall_var_lib_t)
Chris PeBenito fa03ec
')
Chris PeBenito fa03ec
Chris PeBenito fa03ec
#######################################
Chris PeBenito fa03ec
## <summary>
Chris PeBenito fa03ec
##      Read and write shorewall /var/lib files.
Chris PeBenito fa03ec
## </summary>
Chris PeBenito fa03ec
## <param name="domain">
Chris PeBenito fa03ec
##      <summary>
Chris PeBenito fa03ec
##      Domain allowed access.
Chris PeBenito fa03ec
##      </summary>
Chris PeBenito fa03ec
## </param>
Chris PeBenito fa03ec
#
Chris PeBenito fa03ec
interface(`shorewall_rw_lib_files',`
Chris PeBenito fa03ec
        gen_require(`
Chris PeBenito 4fbcd7
                type shorewall_var_lib_t;
Chris PeBenito fa03ec
       ')
Chris PeBenito fa03ec
Chris PeBenito fa03ec
        files_search_var_lib($1)
Chris PeBenito fa03ec
        search_dirs_pattern($1, shorewall_var_lib_t, shorewall_var_lib_t)
Chris PeBenito fa03ec
        rw_files_pattern($1, shorewall_var_lib_t, shorewall_var_lib_t)
Chris PeBenito fa03ec
')
Chris PeBenito fa03ec
Chris PeBenito 625be1
#######################################
Chris PeBenito 625be1
## <summary>
Dan Walsh f5b49a
##      Read shorewall tmp files.
Dan Walsh f5b49a
## </summary>
Dan Walsh f5b49a
## <param name="domain">
Dan Walsh f5b49a
##      <summary>
Dan Walsh f5b49a
##      Domain allowed access.
Dan Walsh f5b49a
##      </summary>
Dan Walsh f5b49a
## </param>
Dan Walsh f5b49a
#
Dan Walsh f5b49a
interface(`shorewall_read_tmp_files',`
Dan Walsh f5b49a
        gen_require(`
Dan Walsh f5b49a
                type shorewall_tmp_t;
Dan Walsh f5b49a
        ')
Dan Walsh f5b49a
Dan Walsh f5b49a
        files_search_tmp($1)
Dan Walsh f5b49a
        read_files_pattern($1, shorewall_tmp_t, shorewall_tmp_t)
Dan Walsh f5b49a
')
Dan Walsh f5b49a
Dan Walsh f5b49a
#######################################
Dan Walsh f5b49a
## <summary>
Chris PeBenito 625be1
##	All of the rules required to administrate 
Chris PeBenito 625be1
##	an shorewall environment
Chris PeBenito 625be1
## </summary>
Chris PeBenito 625be1
## <param name="domain">
Chris PeBenito 625be1
##	<summary>
Chris PeBenito 625be1
##	Domain allowed access.
Chris PeBenito 625be1
##	</summary>
Chris PeBenito 625be1
## </param>
Chris PeBenito 625be1
## <param name="role">
Chris PeBenito 625be1
##	<summary>
Chris PeBenito 625be1
##	The role to be allowed to manage the syslog domain.
Chris PeBenito 625be1
##	</summary>
Chris PeBenito 625be1
## </param>
Chris PeBenito 625be1
## <rolecap/>
Chris PeBenito 625be1
#
Chris PeBenito 625be1
interface(`shorewall_admin',`
Chris PeBenito 625be1
	gen_require(`
Dan Walsh 3eaa99
		type shorewall_t, shorewall_lock_t;
Dan Walsh 3eaa99
		type shorewall_log_t;
Chris PeBenito 625be1
		type shorewall_initrc_exec_t, shorewall_var_lib_t;
Dan Walsh 3eaa99
		type shorewall_tmp_t, shorewall_etc_t;
Chris PeBenito 625be1
	')
Chris PeBenito 625be1
Chris PeBenito 625be1
	allow $1 shorewall_t:process { ptrace signal_perms };
Chris PeBenito 625be1
	ps_process_pattern($1, shorewall_t)
Chris PeBenito 625be1
Chris PeBenito 625be1
	init_labeled_script_domtrans($1, shorewall_initrc_exec_t)
Chris PeBenito 625be1
	domain_system_change_exemption($1)
Chris PeBenito 625be1
	role_transition $2 shorewall_initrc_exec_t system_r;
Chris PeBenito 625be1
	allow $2 system_r;
Chris PeBenito 625be1
Chris PeBenito 625be1
	files_search_etc($1)
Chris PeBenito 625be1
	admin_pattern($1, shorewall_etc_t)
Chris PeBenito 625be1
Chris PeBenito 625be1
	files_search_locks($1)
Chris PeBenito 625be1
	admin_pattern($1, shorewall_lock_t)
Chris PeBenito 625be1
Chris PeBenito 625be1
	files_search_var_lib($1)
Chris PeBenito 625be1
	admin_pattern($1, shorewall_var_lib_t)
Chris PeBenito 625be1
Dan Walsh 3eaa99
	logging_search_logs($1)
Dan Walsh 3eaa99
	admin_pattern($1, shorewall_log_t)
Dan Walsh 3eaa99
Chris PeBenito 625be1
	files_search_tmp($1)
Chris PeBenito 625be1
	admin_pattern($1, shorewall_tmp_t)
Chris PeBenito 625be1
')