Chris PeBenito 17de1b
## <summary>Line printer daemon</summary>
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito bbcd3c
##	The per role template for the lpd module.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	This template creates a derived domains which are used
Chris PeBenito 17de1b
##	for lpr printing client.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	This template is invoked automatically for each user, and
Chris PeBenito 17de1b
##	generally does not need to be invoked directly
Chris PeBenito 17de1b
##	by policy writers.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="userdomain_prefix">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The prefix of the user domain (e.g., user
Chris PeBenito 17de1b
##	is the prefix for user_t).
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="user_domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The type of the user domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="user_role">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The role associated with the user domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito bbcd3c
template(`lpd_per_role_template',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type lpr_exec_t, lpd_t, print_spool_t, printconf_t, lpd_var_run_t, printer_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	##############################
Chris PeBenito 17de1b
	#
Chris PeBenito 17de1b
	# Declarations
Chris PeBenito 17de1b
	#
Chris PeBenito 17de1b
	# Derived domain based on the calling user domain and the program
Chris PeBenito 17de1b
	type $1_lpr_t;
Chris PeBenito d46cfe
	application_domain($1_lpr_t,lpr_exec_t)
Chris PeBenito 17de1b
	role $3 types $1_lpr_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	type $1_lpr_tmp_t;
Chris PeBenito 17de1b
	files_tmp_file($1_lpr_tmp_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	# Type for spool files.
Chris PeBenito 17de1b
	type $1_print_spool_t;
Chris PeBenito 17de1b
	files_type($1_print_spool_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	##############################
Chris PeBenito 17de1b
	#
Chris PeBenito 17de1b
	# Local policy
Chris PeBenito 17de1b
	#
Chris PeBenito 17de1b
	allow $1_lpr_t self:capability { setuid dac_override net_bind_service chown };
Chris PeBenito 17de1b
	allow $1_lpr_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito 17de1b
	allow $1_lpr_t self:tcp_socket create_socket_perms;
Chris PeBenito 17de1b
	allow $1_lpr_t self:udp_socket create_socket_perms;
Chris PeBenito 465510
	allow $1_lpr_t self:netlink_route_socket r_netlink_socket_perms;
Chris PeBenito 17de1b
	
Chris PeBenito 17de1b
	can_exec($1_lpr_t,lpr_exec_t)
Chris PeBenito 17de1b
Chris PeBenito 6b19be
	tunable_policy(`use_lpd_server',`
Chris PeBenito 6b19be
		# lpr can run in lightweight mode, without a local print spooler.
Chris PeBenito 6b19be
		allow $1_lpr_t lpd_var_run_t:dir search;
Chris PeBenito 6b19be
		allow $1_lpr_t lpd_var_run_t:sock_file write;
Chris PeBenito 6b19be
		files_read_var_files($1_lpr_t)
Chris PeBenito 6b19be
Chris PeBenito 6b19be
		# Connect to lpd via a Unix domain socket.
Chris PeBenito 6b19be
		allow $1_lpr_t printer_t:sock_file rw_sock_file_perms;
Chris PeBenito 6b19be
		allow $1_lpr_t lpd_t:unix_stream_socket connectto;
Chris PeBenito 6b19be
		# Send SIGHUP to lpd.
Chris PeBenito 6b19be
		allow $1_lpr_t lpd_t:process signal;
Chris PeBenito 6b19be
Chris PeBenito 6b19be
		manage_dirs_pattern($1_lpr_t,$1_lpr_tmp_t,$1_lpr_tmp_t)
Chris PeBenito 6b19be
		manage_files_pattern($1_lpr_t,$1_lpr_tmp_t,$1_lpr_tmp_t)
Chris PeBenito 6b19be
		files_tmp_filetrans($1_lpr_t, $1_lpr_tmp_t, { file dir })
Chris PeBenito 6b19be
Chris PeBenito 6b19be
		manage_files_pattern($1_lpr_t,print_spool_t,$1_print_spool_t)
Chris PeBenito 6b19be
		filetrans_pattern($1_lpr_t,print_spool_t,$1_print_spool_t,file)
Chris PeBenito 6b19be
		# Read and write shared files in the spool directory.
Chris PeBenito 6b19be
		allow $1_lpr_t print_spool_t:file rw_file_perms;
Chris PeBenito 6b19be
Chris PeBenito 6b19be
		allow $1_lpr_t printconf_t:dir list_dir_perms;
Chris PeBenito 6b19be
		read_files_pattern($1_lpr_t,printconf_t,printconf_t)
Chris PeBenito 6b19be
		read_lnk_files_pattern($1_lpr_t,printconf_t,printconf_t)
Chris PeBenito 6b19be
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1_lpr_t $2:unix_stream_socket { read write };
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	# Transition from the user domain to the derived domain.
Chris PeBenito c0868a
	domtrans_pattern($2,lpr_exec_t,$1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $2 $1_lpr_t:process signull;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	# Allow lpd to read, rename, and unlink spool files.
Chris PeBenito c0868a
	allow lpd_t $1_print_spool_t:file { read_file_perms rename_file_perms delete_file_perms };
Chris PeBenito 17de1b
Chris PeBenito 465510
	kernel_read_kernel_sysctls($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 190066
	corenet_all_recvfrom_unlabeled($1_lpr_t)
Chris PeBenito 190066
	corenet_all_recvfrom_netlabel($1_lpr_t)
Chris PeBenito 17de1b
	corenet_tcp_sendrecv_generic_if($1_lpr_t)
Chris PeBenito 17de1b
	corenet_udp_sendrecv_generic_if($1_lpr_t)
Chris PeBenito 17de1b
	corenet_tcp_sendrecv_all_nodes($1_lpr_t)
Chris PeBenito 17de1b
	corenet_udp_sendrecv_all_nodes($1_lpr_t)
Chris PeBenito 17de1b
	corenet_tcp_sendrecv_all_ports($1_lpr_t)
Chris PeBenito 17de1b
	corenet_udp_sendrecv_all_ports($1_lpr_t)
Chris PeBenito 17de1b
	corenet_tcp_connect_all_ports($1_lpr_t)
Chris PeBenito 17de1b
	corenet_sendrecv_all_client_packets($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 465510
	dev_read_rand($1_lpr_t)
Chris PeBenito 465510
	dev_read_urand($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	domain_use_interactive_fds($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_spool($1_lpr_t)
Chris PeBenito 17de1b
	# for lpd config files (should have a new type)
Chris PeBenito 17de1b
	files_read_etc_files($1_lpr_t)
Chris PeBenito 17de1b
	# for test print
Chris PeBenito 17de1b
	files_read_usr_files($1_lpr_t)
Chris PeBenito 17de1b
	#Added to cover read_content macro
Chris PeBenito 17de1b
	files_list_home($1_lpr_t)
Chris PeBenito 17de1b
	files_read_generic_tmp_files($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	fs_getattr_xattr_fs($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	# Access the terminal.
Chris PeBenito 17de1b
	term_use_controlling_term($1_lpr_t)
Chris PeBenito 17de1b
	term_use_generic_ptys($1_lpr_t)
Chris PeBenito 17de1b
	
Chris PeBenito 17de1b
	libs_use_ld_so($1_lpr_t)
Chris PeBenito 17de1b
	libs_use_shared_libs($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	miscfiles_read_localization($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	sysnet_read_config($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	userdom_read_user_tmp_symlinks($1,$1_lpr_t)
Chris PeBenito 17de1b
	# Write to the user domain tty.
Chris PeBenito 17de1b
	userdom_use_user_terminals($1,$1_lpr_t)
Chris PeBenito 465510
	userdom_read_user_home_content_files($1,$1_lpr_t)
Chris PeBenito 465510
	userdom_read_user_tmp_files($1,$1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	tunable_policy(`read_default_t',`
Chris PeBenito 17de1b
		files_list_default($1_lpr_t)
Chris PeBenito 17de1b
		files_read_default_symlinks($1_lpr_t)
Chris PeBenito 17de1b
		files_read_default_files($1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	tunable_policy(`read_untrusted_content',`
Chris PeBenito 17de1b
		#list and read user specific untrusted content
Chris PeBenito 17de1b
		userdom_read_user_untrusted_content_files($1,$1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
		#list and read user specific temporary untrusted content
Chris PeBenito 17de1b
		files_list_tmp($1_lpr_t)
Chris PeBenito 17de1b
		userdom_read_user_tmp_untrusted_content_files($1,$1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	tunable_policy(`use_nfs_home_dirs',`
Chris PeBenito 17de1b
		files_list_home($1_lpr_t)
Chris PeBenito 17de1b
		fs_list_auto_mountpoints($1_lpr_t)
Chris PeBenito 17de1b
		fs_read_nfs_files($1_lpr_t)
Chris PeBenito 17de1b
		fs_read_nfs_symlinks($1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	tunable_policy(`use_samba_home_dirs',`
Chris PeBenito 17de1b
		files_list_home($1_lpr_t)
Chris PeBenito 17de1b
		fs_list_auto_mountpoints($1_lpr_t)
Chris PeBenito 17de1b
		fs_read_cifs_files($1_lpr_t)
Chris PeBenito 17de1b
		fs_read_cifs_symlinks($1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito 17de1b
		cups_read_config($1_lpr_t)
Chris PeBenito 17de1b
		cups_read_config($2)
Chris PeBenito 465510
		cups_stream_connect($1_lpr_t)
Chris PeBenito d9845a
		cups_read_pid_files($1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito 17de1b
		logging_send_syslog_msg($1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito 17de1b
		nscd_socket_use($1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito 17de1b
		nis_use_ypbind($1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	The administrative functions template for the lpd module.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	This template creates rules for administrating the ldp service,
Chris PeBenito 17de1b
##	allowing the specified user to manage lpr files.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="userdomain_prefix">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The prefix of the user domain (e.g., user
Chris PeBenito 17de1b
##	is the prefix for user_t).
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
template(`lpr_admin_template',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type $1_lpr_t;
Chris PeBenito 6b19be
		type print_spool_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	userdom_read_all_users_home_content_files($1_lpr_t)
Chris PeBenito 17de1b
Chris PeBenito 6b19be
	# Read and write shared files in the spool directory.
Chris PeBenito 6b19be
	allow $1_lpr_t print_spool_t:file rw_file_perms;
Chris PeBenito 6b19be
Chris PeBenito 17de1b
	# Allow per user lpr domain read acces for specific user.
Chris PeBenito 17de1b
	tunable_policy(`read_untrusted_content',`
Chris PeBenito 17de1b
		userdom_read_all_untrusted_content($1_lpr_t)
Chris PeBenito 17de1b
		userdom_read_all_tmp_untrusted_content($1_lpr_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute lpd in the lpd domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`lpd_domtrans_checkpc',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type checkpc_t, checkpc_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito c0868a
	domtrans_pattern($1,checkpc_exec_t,checkpc_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute amrecover in the lpd domain, and
Chris PeBenito 17de1b
##	allow the specified role the lpd domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="role">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The role to be allowed the lpd domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="terminal">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The type of the terminal allow the lpd domain to use.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`lpd_run_checkpc',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type checkpc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	lpd_domtrans_checkpc($1)
Chris PeBenito 17de1b
	role $2 types checkpc_t;
Chris PeBenito 17de1b
	allow checkpc_t $3:chr_file rw_term_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	List the contents of the printer spool directories.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`lpd_list_spool',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type print_spool_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_spool($1)
Chris PeBenito 17de1b
	allow $1 print_spool_t:dir list_dir_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 226c06
##	Read the printer spool files.
Chris PeBenito 226c06
## </summary>
Chris PeBenito 226c06
## <param name="domain">
Chris PeBenito 226c06
##	<summary>
Chris PeBenito 226c06
##	Domain allowed access.
Chris PeBenito 226c06
##	</summary>
Chris PeBenito 226c06
## </param>
Chris PeBenito 226c06
#
Chris PeBenito 226c06
interface(`lpd_read_spool',`
Chris PeBenito 226c06
	gen_require(`
Chris PeBenito 226c06
		type print_spool_t;
Chris PeBenito 226c06
	')
Chris PeBenito 226c06
Chris PeBenito 226c06
	files_search_spool($1)
Chris PeBenito 226c06
	read_files_pattern($1,print_spool_t,print_spool_t)
Chris PeBenito 226c06
')
Chris PeBenito 226c06
Chris PeBenito 226c06
########################################
Chris PeBenito 226c06
## <summary>
Chris PeBenito 17de1b
##	Create, read, write, and delete printer spool files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`lpd_manage_spool',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type print_spool_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_spool($1)
Chris PeBenito c0868a
	manage_files_pattern($1,print_spool_t,print_spool_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	# cjp: cups wants setattr
Chris PeBenito c0868a
	allow $1 print_spool_t:dir setattr;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito d9845a
##	Relabel from and to the spool files.
Chris PeBenito d9845a
## </summary>
Chris PeBenito d9845a
## <param name="domain">
Chris PeBenito d9845a
##	<summary>
Chris PeBenito d9845a
##	Domain allowed access.
Chris PeBenito d9845a
##	</summary>
Chris PeBenito d9845a
## </param>
Chris PeBenito d9845a
#
Chris PeBenito d9845a
interface(`lpd_relabel_spool',`
Chris PeBenito d9845a
	gen_require(`
Chris PeBenito d9845a
		type print_spool_t;
Chris PeBenito d9845a
	')
Chris PeBenito d9845a
Chris PeBenito d9845a
	files_search_spool($1)
Chris PeBenito d9845a
	allow $1 print_spool_t:file { relabelto relabelfrom };
Chris PeBenito d9845a
')
Chris PeBenito d9845a
Chris PeBenito d9845a
########################################
Chris PeBenito d9845a
## <summary>
Chris PeBenito 17de1b
##	List the contents of the printer spool directories.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`lpd_read_config',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type printconf_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 printconf_t:dir list_dir_perms;
Chris PeBenito c0868a
	read_files_pattern($1,printconf_t,printconf_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##      Transition to a user lpr domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##      

Chris PeBenito 17de1b
##      Transition to a user lpr domain.
Chris PeBenito 17de1b
##      

Chris PeBenito 17de1b
##      

Chris PeBenito 17de1b
##      This is a templated interface, and should only
Chris PeBenito 17de1b
##      be called from a per-userdomain template.
Chris PeBenito 17de1b
##      

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="userdomain_prefix">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##      The prefix of the user domain (e.g., user
Chris PeBenito 17de1b
##      is the prefix for user_t).
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##      Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
template(`lpd_domtrans_user_lpr',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type $1_lpr_t, lpr_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito c0868a
	domtrans_pattern($2, lpr_exec_t, $1_lpr_t)
Chris PeBenito 17de1b
')
Chris PeBenito 8a9d6f
Chris PeBenito 8a9d6f
########################################
Chris PeBenito 8a9d6f
## <summary>
Chris PeBenito 8a9d6f
##	Allow the specified domain to execute lpr
Chris PeBenito 8a9d6f
##	in the caller domain.
Chris PeBenito 8a9d6f
## </summary>
Chris PeBenito 8a9d6f
## <param name="domain">
Chris PeBenito 8a9d6f
##	<summary>
Chris PeBenito 8a9d6f
##	Domain allowed access.
Chris PeBenito 8a9d6f
##	</summary>
Chris PeBenito 8a9d6f
## </param>
Chris PeBenito 8a9d6f
#
Chris PeBenito 8a9d6f
interface(`lpd_exec_lpr',`
Chris PeBenito 8a9d6f
	gen_require(`
Chris PeBenito 8a9d6f
		type lpr_exec_t;
Chris PeBenito 8a9d6f
	')
Chris PeBenito 8a9d6f
Chris PeBenito 8a9d6f
	can_exec($1, lpr_exec_t)
Chris PeBenito 8a9d6f
')