Chris PeBenito 17de1b
## <summary>Wine Is Not an Emulator.  Run Windows programs in Linux.</summary>
Chris PeBenito 17de1b
Chris PeBenito 4796d0
#######################################
Chris PeBenito 4796d0
## <summary>
Chris PeBenito 4796d0
##	The per role template for the wine module.
Chris PeBenito 4796d0
## </summary>
Chris PeBenito 4796d0
## <desc>
Chris PeBenito 4796d0
##	

Chris PeBenito 4796d0
##	This template creates a derived domains which are used
Chris PeBenito 4796d0
##	for wine applications.
Chris PeBenito 4796d0
##	

Chris PeBenito 4796d0
## </desc>
Chris PeBenito 4796d0
## <param name="userdomain_prefix">
Chris PeBenito 4796d0
##	<summary>
Chris PeBenito 4796d0
##	The prefix of the user domain (e.g., user
Chris PeBenito 4796d0
##	is the prefix for user_t).
Chris PeBenito 4796d0
##	</summary>
Chris PeBenito 4796d0
## </param>
Chris PeBenito 4796d0
## <param name="user_domain">
Chris PeBenito 4796d0
##	<summary>
Chris PeBenito 4796d0
##	The type of the user domain.
Chris PeBenito 4796d0
##	</summary>
Chris PeBenito 4796d0
## </param>
Chris PeBenito 4796d0
## <param name="user_role">
Chris PeBenito 4796d0
##	<summary>
Chris PeBenito 4796d0
##	The role associated with the user domain.
Chris PeBenito 4796d0
##	</summary>
Chris PeBenito 4796d0
## </param>
Chris PeBenito 4796d0
#
Chris PeBenito 4796d0
template(`wine_role',`
Chris PeBenito 4796d0
	gen_require(`
Dan Walsh 3eaa99
		type wine_t;
Dan Walsh 3eaa99
		type wine_home_t;
Chris PeBenito 4796d0
		type wine_exec_t;
Chris PeBenito 4796d0
	')
Chris PeBenito 4796d0
Chris PeBenito 4796d0
	role $1 types wine_t;
Chris PeBenito 4796d0
Chris PeBenito 4796d0
	domain_auto_trans($2, wine_exec_t, wine_t)
Dan Walsh 3eaa99
	# Unrestricted inheritance from the caller.
Dan Walsh 3eaa99
	allow $2 wine_t:process { noatsecure siginh rlimitinh };
Chris PeBenito 4796d0
	allow wine_t $2:fd use;
Chris PeBenito 4796d0
	allow wine_t $2:process { sigchld signull };
Chris PeBenito 4796d0
	allow wine_t $2:unix_stream_socket connectto;
Chris PeBenito 4796d0
Chris PeBenito 4796d0
	# Allow the user domain to signal/ps.
Chris PeBenito 4796d0
	ps_process_pattern($2, wine_t)
Chris PeBenito 4796d0
	allow $2 wine_t:process signal_perms;
Chris PeBenito 4796d0
Chris PeBenito 4796d0
	allow $2 wine_t:fd use;
Dan Walsh c71f02
	allow $2 wine_t:shm { associate getattr  unix_read unix_write };
Chris PeBenito 4796d0
	allow $2 wine_t:unix_stream_socket connectto;
Chris PeBenito 4796d0
Chris PeBenito 4796d0
	# X access, Home files
Chris PeBenito 4796d0
	manage_dirs_pattern($2, wine_home_t, wine_home_t)
Chris PeBenito 4796d0
	manage_files_pattern($2, wine_home_t, wine_home_t)
Chris PeBenito 4796d0
	manage_lnk_files_pattern($2, wine_home_t, wine_home_t)
Chris PeBenito 4796d0
	relabel_dirs_pattern($2, wine_home_t, wine_home_t)
Chris PeBenito 4796d0
	relabel_files_pattern($2, wine_home_t, wine_home_t)
Chris PeBenito 4796d0
	relabel_lnk_files_pattern($2, wine_home_t, wine_home_t)
Chris PeBenito 4796d0
')
Chris PeBenito 4796d0
Chris PeBenito 4796d0
#######################################
Chris PeBenito 4796d0
## <summary>
Chris PeBenito 4796d0
##	The role template for the wine module.
Chris PeBenito 4796d0
## </summary>
Chris PeBenito 4796d0
## <desc>
Chris PeBenito 4796d0
##	

Chris PeBenito 4796d0
##	This template creates a derived domains which are used
Chris PeBenito 4796d0
##	for wine applications.
Chris PeBenito 4796d0
##	

Chris PeBenito 4796d0
## </desc>
Chris PeBenito 4796d0
## <param name="role_prefix">
Chris PeBenito 4796d0
##	<summary>
Chris PeBenito 4796d0
##	The prefix of the user domain (e.g., user
Chris PeBenito 4796d0
##	is the prefix for user_t).
Chris PeBenito 4796d0
##	</summary>
Chris PeBenito 4796d0
## </param>
Chris PeBenito 4796d0
## <param name="user_role">
Chris PeBenito 4796d0
##	<summary>
Chris PeBenito 4796d0
##	The role associated with the user domain.
Chris PeBenito 4796d0
##	</summary>
Chris PeBenito 4796d0
## </param>
Chris PeBenito 4796d0
## <param name="user_domain">
Chris PeBenito 4796d0
##	<summary>
Chris PeBenito 4796d0
##	The type of the user domain.
Chris PeBenito 4796d0
##	</summary>
Chris PeBenito 4796d0
## </param>
Chris PeBenito 4796d0
#
Chris PeBenito 4796d0
template(`wine_role_template',`
Chris PeBenito 4796d0
	gen_require(`
Dan Walsh 3eaa99
		type wine_t;
Chris PeBenito 4796d0
		type wine_exec_t;
Chris PeBenito 4796d0
	')
Chris PeBenito 4796d0
Chris PeBenito 4796d0
	type $1_wine_t;
Chris PeBenito 4796d0
	domain_type($1_wine_t)
Chris PeBenito 4796d0
	domain_entry_file($1_wine_t, wine_exec_t)
Chris PeBenito 4796d0
	ubac_constrained($1_wine_t)
Chris PeBenito 4796d0
	role $2 types $1_wine_t;
Chris PeBenito 4796d0
Chris PeBenito 4796d0
	allow $1_wine_t self:process { execmem execstack };
Chris PeBenito 4796d0
	allow $3 $1_wine_t:process { getattr ptrace noatsecure signal_perms };
Chris PeBenito 4796d0
	domtrans_pattern($3, wine_exec_t, $1_wine_t)
Chris PeBenito 4796d0
	corecmd_bin_domtrans($1_wine_t, $1_t)
Chris PeBenito 4796d0
Chris PeBenito 4796d0
	userdom_unpriv_usertype($1, $1_wine_t)
Dan Walsh 3eaa99
	userdom_manage_tmpfs_role($2, $1_wine_t)
Chris PeBenito 4796d0
Dan Walsh 3a2e88
	domain_mmap_low($1_wine_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	tunable_policy(`wine_mmap_zero_ignore',`
Dan Walsh 3eaa99
		dontaudit $1_wine_t self:memprotect mmap_zero;
Dan Walsh 3eaa99
	')
Chris PeBenito 4796d0
Dominick Grift 623e4f
	tunable_policy(`wine_mmap_zero_ignore',`
Dominick Grift 623e4f
		dontaudit $1_wine_t self:memprotect mmap_zero;
Dominick Grift 623e4f
	')
Dominick Grift 623e4f
Chris PeBenito 4796d0
	optional_policy(`
Chris PeBenito 4796d0
		xserver_role($1_r, $1_wine_t)
Chris PeBenito 4796d0
	')
Chris PeBenito 4796d0
')
Chris PeBenito 4796d0
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute the wine program in the wine domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift 03b866
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`wine_domtrans',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wine_t, wine_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	corecmd_search_bin($1)
Chris PeBenito c0868a
	domtrans_pattern($1, wine_exec_t, wine_t)
Chris PeBenito 17de1b
')
Chris PeBenito 8a9d6f
Chris PeBenito 8a9d6f
########################################
Chris PeBenito 8a9d6f
## <summary>
Chris PeBenito 8a9d6f
##	Execute wine in the wine domain, and
Chris PeBenito 8a9d6f
##	allow the specified role the wine domain.
Chris PeBenito 8a9d6f
## </summary>
Chris PeBenito 8a9d6f
## <param name="domain">
Chris PeBenito 8a9d6f
##	<summary>
Dominick Grift 03b866
##	Domain allowed to transition.
Chris PeBenito 8a9d6f
##	</summary>
Chris PeBenito 8a9d6f
## </param>
Chris PeBenito 8a9d6f
## <param name="role">
Chris PeBenito 8a9d6f
##	<summary>
Chris PeBenito a7ee7f
##	Role allowed access.
Chris PeBenito 8a9d6f
##	</summary>
Chris PeBenito 8a9d6f
## </param>
Chris PeBenito 8a9d6f
#
Chris PeBenito 8a9d6f
interface(`wine_run',`
Chris PeBenito 8a9d6f
	gen_require(`
Chris PeBenito 8a9d6f
		type wine_t;
Chris PeBenito 8a9d6f
	')
Chris PeBenito 8a9d6f
Chris PeBenito 8a9d6f
	wine_domtrans($1)
Chris PeBenito 8a9d6f
	role $2 types wine_t;
Chris PeBenito 8a9d6f
')
Dan Walsh c71f02
Dan Walsh c71f02
########################################
Dan Walsh c71f02
## <summary>
Dan Walsh c71f02
##	Read and write wine Shared
Dan Walsh c71f02
##	memory segments.
Dan Walsh c71f02
## </summary>
Dan Walsh c71f02
## <param name="domain">
Dan Walsh c71f02
##	<summary>
Dan Walsh c71f02
##	Domain allowed access.
Dan Walsh c71f02
##	</summary>
Dan Walsh c71f02
## </param>
Dan Walsh c71f02
#
Dan Walsh c71f02
interface(`wine_rw_shm',`
Dan Walsh c71f02
	gen_require(`
Dan Walsh c71f02
		type wine_t;
Dan Walsh c71f02
	')
Dan Walsh c71f02
Dan Walsh c71f02
	allow $1 wine_t:shm rw_shm_perms;
Dan Walsh c71f02
')