## <summary>

##	Oddjob provides a mechanism by which unprivileged applications can

##	request that specified privileged operations be performed on their

##	behalf.

## </summary>

########################################

## <summary>

##	Execute a domain transition to run oddjob.

## </summary>

## <param name="domain">

## <summary>

##	Domain allowed to transition.

## </summary>

## </param>

#

interface(`oddjob_domtrans',`

	gen_require(`

		type oddjob_t, oddjob_exec_t;

	')

	domain_auto_trans($1,oddjob_exec_t,oddjob_t)

	allow oddjob_t $1:fd use;

	allow oddjob_t $1:fifo_file rw_file_perms;

	allow oddjob_t $1:process sigchld;

')

########################################

## <summary>

##	Make the specified program domain accessable

##	from the oddjob.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process to transition to.

##	</summary>

## </param>

## <param name="entrypoint">

##	<summary>

##	The type of the file used as an entrypoint to this domain.

##	</summary>

## </param>

#

interface(`oddjob_system_entry',`

	gen_require(`

		type oddjob_t;

	')

	domain_auto_trans(oddjob_t, $2, $1)

	allow $1 oddjob_t:fd use;

	allow $1 oddjob_t:fifo_file rw_file_perms;

	allow $1 oddjob_t:process sigchld;

')

########################################

## <summary>

##	Send and receive messages from

##	oddjob over dbus.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`oddjob_dbus_chat',`

	gen_require(`

		type oddjob_t;

		class dbus send_msg;

	')

	allow $1 oddjob_t:dbus send_msg;

	allow oddjob_t $1:dbus send_msg;

')

########################################

## <summary>

##	Execute a domain transition to run oddjob_mkhomedir.

## </summary>

## <param name="domain">

## <summary>

##	Domain allowed to transition.

## </summary>

## </param>

#

interface(`oddjob_domtrans_mkhomedir',`

	gen_require(`

		type oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t;

	')

	domain_auto_trans($1,oddjob_mkhomedir_exec_t,oddjob_mkhomedir_t)

	allow oddjob_mkhomedir_t $1:fd use;

	allow oddjob_mkhomedir_t $1:fifo_file rw_file_perms;

	allow oddjob_mkhomedir_t $1:process sigchld;

')