Dominick Grift 1031ee
## <summary>Cobbler installation server.</summary>
Dan Walsh 2968e0
## <desc>
Dan Walsh 2968e0
##	

Dominick Grift c5eae5
##	Cobbler is a Linux installation server that allows for
Dominick Grift c5eae5
##	rapid setup of network installation environments. It
Dominick Grift c5eae5
##	glues together and automates many associated Linux
Dominick Grift c5eae5
##	tasks so you do not have to hop between lots of various
Dominick Grift c5eae5
##	commands and applications when rolling out new systems,
Dominick Grift c5eae5
##	and, in some cases, changing existing ones.
Dan Walsh 2968e0
##	

Dan Walsh 2968e0
## </desc>
Dominick Grift 1031ee
Dominick Grift 1031ee
########################################
Dominick Grift 1031ee
## <summary>
Chris PeBenito 27eab8
##	Execute a domain transition to run cobblerd.
Dominick Grift 1031ee
## </summary>
Dominick Grift 1031ee
## <param name="domain">
Dominick Grift c5eae5
##	<summary>
Chris PeBenito 27eab8
##	Domain allowed to transition.
Dominick Grift c5eae5
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
#
Chris PeBenito 27eab8
interface(`cobblerd_domtrans',`
Dominick Grift 1031ee
	gen_require(`
Chris PeBenito 27eab8
		type cobblerd_t, cobblerd_exec_t;
Dominick Grift 1031ee
	')
Dominick Grift 1031ee
Chris PeBenito 27eab8
	domtrans_pattern($1, cobblerd_exec_t, cobblerd_t)
Dan Walsh 3eaa99
	corecmd_search_bin($1)
Dominick Grift 1031ee
')
Dominick Grift 1031ee
Dominick Grift 1031ee
########################################
Dominick Grift 1031ee
## <summary>
Chris PeBenito 27eab8
##	Execute cobblerd server in the cobblerd domain.
Dominick Grift 1031ee
## </summary>
Dominick Grift 1031ee
## <param name="domain">
Dominick Grift 1031ee
##	<summary>
Dominick Grift 288845
##	Domain allowed to transition.
Dominick Grift 1031ee
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
#
Chris PeBenito 27eab8
interface(`cobblerd_initrc_domtrans',`
Dominick Grift 1031ee
	gen_require(`
Chris PeBenito 27eab8
		type cobblerd_initrc_exec_t;
Dominick Grift 1031ee
	')
Dominick Grift 1031ee
Chris PeBenito 27eab8
	init_labeled_script_domtrans($1, cobblerd_initrc_exec_t)
Dominick Grift 1031ee
')
Dominick Grift 1031ee
Dominick Grift 1031ee
########################################
Dominick Grift 1031ee
## <summary>
Dan Walsh 3eaa99
##	List Cobbler configuration.
Dominick Grift 1031ee
## </summary>
Dominick Grift 1031ee
## <param name="domain">
Dominick Grift 1031ee
##	<summary>
Dominick Grift 1031ee
##	Domain allowed access.
Dominick Grift 1031ee
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
#
Dan Walsh 3eaa99
interface(`cobbler_list_config',`
Dominick Grift 1031ee
	gen_require(`
Chris PeBenito 27eab8
		type cobbler_etc_t;
Dominick Grift 1031ee
	')
Dominick Grift 1031ee
Dan Walsh 2968e0
	list_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
Chris PeBenito 27eab8
	files_search_etc($1)
Dominick Grift 1031ee
')
Dominick Grift 1031ee
Dominick Grift 1031ee
########################################
Dominick Grift 1031ee
## <summary>
Dan Walsh 3eaa99
##	Read Cobbler configuration files.
Dominick Grift 1031ee
## </summary>
Dominick Grift 1031ee
## <param name="domain">
Dominick Grift 1031ee
##	<summary>
Dominick Grift 288845
##	Domain to not audit.
Dominick Grift 1031ee
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
#
Dan Walsh 3eaa99
interface(`cobbler_read_config',`
Dominick Grift 1031ee
	gen_require(`
Dan Walsh 3eaa99
		type cobbler_etc_t;
Dominick Grift 1031ee
	')
Dominick Grift 1031ee
Dan Walsh 3eaa99
	read_files_pattern($1, cobbler_etc_t, cobbler_etc_t)
Dan Walsh 3eaa99
	files_search_etc($1)
Dominick Grift 1031ee
')
Dominick Grift 1031ee
Dominick Grift 1031ee
########################################
Dominick Grift 1031ee
## <summary>
Dan Walsh 2968e0
##	Search cobbler dirs in /var/lib
Dominick Grift 1031ee
## </summary>
Dominick Grift 1031ee
## <param name="domain">
Dominick Grift 1031ee
##	<summary>
Dominick Grift 1031ee
##	Domain allowed access.
Dominick Grift 1031ee
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
#
Dan Walsh 2968e0
interface(`cobbler_search_lib',`
Dominick Grift 1031ee
	gen_require(`
Dan Walsh 2968e0
		type cobbler_var_lib_t;
Dominick Grift 1031ee
	')
Dominick Grift 1031ee
Dan Walsh 2968e0
	search_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
Dan Walsh 2968e0
	read_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
Dominick Grift 1031ee
	files_search_var_lib($1)
Dominick Grift 1031ee
')
Dominick Grift 1031ee
Dominick Grift 1031ee
########################################
Dominick Grift 1031ee
## <summary>
Dan Walsh 2968e0
##	Read cobbler files in /var/lib
Dominick Grift 1031ee
## </summary>
Dominick Grift 1031ee
## <param name="domain">
Chris PeBenito 27eab8
##	<summary>
Chris PeBenito 27eab8
##	Domain allowed access.
Chris PeBenito 27eab8
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
#
Dan Walsh 2968e0
interface(`cobbler_read_lib_files',`
Dominick Grift 1031ee
	gen_require(`
Dan Walsh 2968e0
		type cobbler_var_lib_t;
Dominick Grift 1031ee
	')
Dominick Grift 1031ee
Dan Walsh 2968e0
	read_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
Dan Walsh 2968e0
	read_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
Chris PeBenito 27eab8
	files_search_var_lib($1)
Dominick Grift 1031ee
')
Dominick Grift 1031ee
Dominick Grift 1031ee
########################################
Dominick Grift 1031ee
## <summary>
Dan Walsh 2968e0
##	Manage cobbler files in /var/lib
Dominick Grift 1031ee
## </summary>
Dominick Grift 1031ee
## <param name="domain">
Dominick Grift 1031ee
##	<summary>
Chris PeBenito 27eab8
##	Domain allowed access.
Dominick Grift 1031ee
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
#
Dan Walsh 2968e0
interface(`cobbler_manage_lib_files',`
Dominick Grift 1031ee
	gen_require(`
Dan Walsh 2968e0
		type cobbler_var_lib_t;
Dominick Grift 1031ee
	')
Dominick Grift 1031ee
Dan Walsh 2968e0
	manage_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
Dan Walsh 2968e0
	manage_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
Dan Walsh 2968e0
	manage_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
Chris PeBenito 27eab8
	files_search_var_lib($1)
Dominick Grift 1031ee
')
Dominick Grift 1031ee
Dominick Grift 1031ee
########################################
Dominick Grift 1031ee
## <summary>
Dan Walsh 3eaa99
##	Do not audit attempts to read and write
Dan Walsh 3eaa99
##	Cobbler log files (leaked fd).
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## <param name="domain">
Dan Walsh 3eaa99
##	<summary>
Dominick Grift 3c484f
##	Domain to not audit.
Dan Walsh 3eaa99
##	</summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
interface(`cobbler_dontaudit_rw_log',`
Dan Walsh 3eaa99
	gen_require(`
Dan Walsh 3eaa99
		type cobbler_var_log_t;
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	dontaudit $1 cobbler_var_log_t:file rw_inherited_file_perms;
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
########################################
Dan Walsh 3eaa99
## <summary>
Chris PeBenito aeb7a4
##	All of the rules required to administrate
Dominick Grift 1031ee
##	an cobblerd environment
Dominick Grift 1031ee
## </summary>
Dominick Grift 1031ee
## <param name="domain">
Dominick Grift 1031ee
##	<summary>
Dominick Grift 1031ee
##	Domain allowed access.
Dominick Grift 1031ee
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
## <param name="role">
Dominick Grift 1031ee
##	<summary>
Dominick Grift 1031ee
##	Role allowed access.
Dominick Grift 1031ee
##	</summary>
Dominick Grift 1031ee
## </param>
Dominick Grift 1031ee
## <rolecap/>
Dominick Grift 1031ee
#
Dominick Grift 1031ee
interface(`cobblerd_admin',`
Dominick Grift 1031ee
	gen_require(`
Dan Walsh 2968e0
		type cobblerd_t, cobbler_var_lib_t, cobbler_var_log_t;
Dominick Grift 6bb4d4
		type cobbler_etc_t, cobblerd_initrc_exec_t, httpd_cobbler_content_t;
Dominick Grift 6bb4d4
		type httpd_cobbler_content_ra_t, httpd_cobbler_content_rw_t;
Dominick Grift 1031ee
	')
Dominick Grift 1031ee
Dominick Grift 39e118
	allow $1 cobblerd_t:process { ptrace signal_perms };
Dominick Grift 39e118
	ps_process_pattern($1, cobblerd_t)
Dominick Grift 1031ee
Dominick Grift 61f406
	files_list_etc($1)
Dan Walsh 2968e0
	admin_pattern($1, cobbler_etc_t)
Dominick Grift 1031ee
Dominick Grift 1031ee
	files_list_var_lib($1)
Dan Walsh 2968e0
	admin_pattern($1, cobbler_var_lib_t)
Dominick Grift 1031ee
Dominick Grift 61f406
	logging_list_logs($1)
Dan Walsh 2968e0
	admin_pattern($1, cobbler_var_log_t)
Dominick Grift 1031ee
Dominick Grift 61f406
	apache_list_sys_content($1)
Dan Walsh 2968e0
	admin_pattern($1, httpd_cobbler_content_t)
Dan Walsh 2968e0
	admin_pattern($1, httpd_cobbler_content_ra_t)
Dan Walsh 2968e0
	admin_pattern($1, httpd_cobbler_content_rw_t)
Dan Walsh 3eaa99
Dan Walsh 2968e0
	cobblerd_initrc_domtrans($1)
Dan Walsh 2968e0
	domain_system_change_exemption($1)
Dan Walsh 2968e0
	role_transition $2 cobblerd_initrc_exec_t system_r;
Dan Walsh 2968e0
	allow $2 system_r;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 2968e0
		# traverse /var/lib/tftpdir to get to cobbler_var_lib_t there.
Dan Walsh 3eaa99
		tftp_search_rw_content($1)
Dan Walsh 3eaa99
	')
Dominick Grift 1031ee
')