## <summary>General system administration role</summary>

########################################

## <summary>

##	Change to the generic user role.

## </summary>

## <param name="prefix">

##	<summary>

##	The prefix of the user role (e.g., user

##	is the prefix for user_r).

##	</summary>

## </param>

## <rolecap/>

#

template(`sysadm_role_change_template',`

	userdom_role_change_template($1, sysadm)

')

########################################

## <summary>

##	Change from the generic user role.

## </summary>

## <desc>

##	

##	Change from the generic user role to

##	the specified role.

##	

##	

##	This is a template to support third party modules

##	and its use is not allowed in upstream reference

##	policy.

##	

## </desc>

## <param name="prefix">

##	<summary>

##	The prefix of the user role (e.g., user

##	is the prefix for user_r).

##	</summary>

## </param>

## <rolecap/>

#

template(`sysadm_role_change_to_template',`

	userdom_role_change_template(sysadm, $1)

')

########################################

## <summary>

##	Execute a shell in the sysadm domain.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_shell_domtrans',`

	gen_require(`

		type sysadm_t;

	')

	corecmd_shell_domtrans($1, sysadm_t)

	allow sysadm_t $1:fd use;

	allow sysadm_t $1:fifo_file rw_file_perms;

	allow sysadm_t $1:process sigchld;

')

########################################

## <summary>

##	Execute a generic bin program in the sysadm domain.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_bin_spec_domtrans',`

	gen_require(`

		type sysadm_t;

	')

	corecmd_bin_spec_domtrans($1, sysadm_t)

	allow sysadm_t $1:fd use;

	allow sysadm_t $1:fifo_file rw_file_perms;

	allow sysadm_t $1:process sigchld;

')

########################################

## <summary>

##	Execute all entrypoint files in the sysadm domain. This

##	is an explicit transition, requiring the

##	caller to use setexeccon().

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_entry_spec_domtrans',`

	gen_require(`

		type sysadm_t;

	')

	domain_entry_file_spec_domtrans($1, sysadm_t)

	allow sysadm_t $1:fd use;

	allow sysadm_t $1:fifo_file rw_file_perms;

	allow sysadm_t $1:process sigchld;

')

########################################

## <summary>

##	Allow sysadm to execute a generic bin program in

##	a specified domain.  This is an explicit transition,

##	requiring the caller to use setexeccon().

## </summary>

## <desc>

##	

##	Allow sysadm to execute a generic bin program in

##	a specified domain.

##	

##	

##	This is a interface to support third party modules

##	and its use is not allowed in upstream reference

##	policy.

##	

## </desc>

## <param name="domain">

##	<summary>

##	Domain to execute in.

##	</summary>

## </param>

#

interface(`sysadm_bin_spec_domtrans_to',`

	gen_require(`

		type sysadm_t;

	')

	corecmd_bin_spec_domtrans(sysadm_t, $1)

	allow $1 sysadm_t:fd use;

	allow $1 sysadm_t:fifo_file rw_file_perms;

	allow $1 sysadm_t:process sigchld;

')

########################################

## <summary>

##	Send a SIGCHLD signal to sysadm users.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_sigchld',`

	gen_require(`

		type sysadm_t;

	')

	allow $1 sysadm_t:process sigchld;

')

########################################

## <summary>

##	Inherit and use sysadm file descriptors

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_use_fds',`

	gen_require(`

		type sysadm_t;

	')

	allow $1 sysadm_t:fd use;

')

########################################

## <summary>

##	Read and write sysadm user unnamed pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_rw_pipes',`

	gen_require(`

		type sysadm_t;

	')

	allow $1 sysadm_t:fifo_file rw_fifo_file_perms;

')

########################################

## <summary>

##	Do not audit attepts to get the attributes

##	of sysadm ttys.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_dontaudit_getattr_ttys',`

	gen_require(`

		type sysadm_tty_device_t;

	')

	dontaudit $1 sysadm_tty_device_t:chr_file getattr;

')

########################################

## <summary>

##	Read and write sysadm ttys.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_use_ttys',`

	gen_require(`

		type sysadm_tty_device_t;

	')

	dev_list_all_dev_nodes($1)

	term_list_ptys($1)

	allow $1 sysadm_tty_device_t:chr_file rw_term_perms;

')

########################################

## <summary>

##	Do not audit attempts to use sysadm ttys.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_dontaudit_use_ttys',`

	gen_require(`

		type sysadm_tty_device_t;

	')

	dontaudit $1 sysadm_tty_device_t:chr_file { read write };

')

########################################

## <summary>

##	Read and write sysadm ptys.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_use_ptys',`

	gen_require(`

		type sysadm_devpts_t;

	')

	dev_list_all_dev_nodes($1)

	term_list_ptys($1)

	allow $1 sysadm_devpts_t:chr_file rw_term_perms;

')

########################################

## <summary>

##	Dont audit attempts to read and write sysadm ptys.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_dontaudit_use_ptys',`

	gen_require(`

		type sysadm_devpts_t;

	')

	dontaudit $1 sysadm_devpts_t:chr_file { read write };

')

########################################

## <summary>

##	Read and write sysadm ttys and ptys.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_use_terms',`

	sysadm_use_ttys($1)

	sysadm_use_ptys($1)

')

########################################

## <summary>

##	Do not audit attempts to use sysadm ttys and ptys.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_dontaudit_use_terms',`

	sysadm_dontaudit_use_ttys($1)

	sysadm_dontaudit_use_ptys($1)

')

########################################

## <summary>

##	Get the attributes of the sysadm users

##	home directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_getattr_home_dirs',`

	gen_require(`

		type sysadm_home_dir_t;

	')

	allow $1 sysadm_home_dir_t:dir getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the

##	attributes of the sysadm users

##	home directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_dontaudit_getattr_home_dirs',`

	gen_require(`

		type sysadm_home_dir_t;

	')

	dontaudit $1 sysadm_home_dir_t:dir getattr;

')

########################################

## <summary>

##	Search the sysadm users home directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_search_home_dirs',`

	gen_require(`

		type sysadm_home_dir_t;

	')

	allow $1 sysadm_home_dir_t:dir search_dir_perms;

')

########################################

## <summary>

##	Do not audit attempts to search the sysadm

##	users home directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_dontaudit_search_home_dirs',`

	gen_require(`

		type sysadm_home_dir_t;

	')

	dontaudit $1 sysadm_home_dir_t:dir search_dir_perms;

')

########################################

## <summary>

##	List the sysadm users home directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_list_home_dirs',`

	gen_require(`

		type sysadm_home_dir_t;

	')

	allow $1 sysadm_home_dir_t:dir list_dir_perms;

')

########################################

## <summary>

##	Do not audit attempts to list the sysadm

##	users home directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_dontaudit_list_home_dirs',`

	gen_require(`

		type sysadm_home_dir_t;

	')

	dontaudit $1 sysadm_home_dir_t:dir list_dir_perms;

')

########################################

## <summary>

##	Create objects in sysadm home directories

##	with automatic file type transition.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <param name="private type">

##	<summary>

##	The type of the object to be created.

##	</summary>

## </param>

## <param name="object_class">

##	<summary>

##	The class of the object to be created.

##	If not specified, file is used.

##	</summary>

## </param>

#

interface(`sysadm_home_dir_filetrans',`

	gen_require(`

		type sysadm_home_dir_t;

	')

	filetrans_pattern($1, sysadm_home_dir_t, $2, $3)

')

########################################

## <summary>

##	Search the sysadm users home sub directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_search_home_content_dirs',`

	gen_require(`

		type sysadm_home_dir_t, sysadm_home_t;

	')

	allow $1 { sysadm_home_dir_t sysadm_home_t }:dir search_dir_perms;

')

########################################

## <summary>

##	Read files in the sysadm home directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_read_home_content_files',`

	gen_require(`

		type sysadm_home_dir_t, sysadm_home_t;

	')

	files_search_home($1)

	allow $1 { sysadm_home_dir_t sysadm_home_t }:dir list_dir_perms;

	read_files_pattern($1, { sysadm_home_dir_t sysadm_home_t }, sysadm_home_t)

	read_lnk_files_pattern($1, { sysadm_home_dir_t sysadm_home_t }, sysadm_home_t)

')

########################################

## <summary>

##	Do not audit attempts to read files in the sysadm

##	home directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`sysadm_dontaudit_read_home_content_files',`

	gen_require(`

		type sysadm_home_dir_t, sysadm_home_t;

	')

	dontaudit $1 sysadm_home_dir_t:dir search_dir_perms;

	dontaudit $1 sysadm_home_t:dir search_dir_perms;

	dontaudit $1 sysadm_home_t:file read_file_perms;

')

########################################

## <summary>

##	Read sysadm temporary files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`sysadm_read_tmp_files',`

	gen_require(`

		type sysadm_tmp_t;

	')

	files_search_tmp($1)

	allow $1 sysadm_tmp_t:dir list_dir_perms;

	read_files_pattern($1, sysadm_tmp_t, sysadm_tmp_t)

	read_lnk_files_pattern($1, sysadm_tmp_t, sysadm_tmp_t)

')