Chris PeBenito 17de1b
## <summary>full-featured SSL VPN solution</summary>
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 72f82c
##	Execute OPENVPN clients in the openvpn domain.
Chris PeBenito 72f82c
## </summary>
Chris PeBenito 72f82c
## <param name="domain">
Chris PeBenito 72f82c
##	<summary>
Chris PeBenito 72f82c
##	Domain allowed access.
Chris PeBenito 72f82c
##	</summary>
Chris PeBenito 72f82c
## </param>
Chris PeBenito 72f82c
#
Chris PeBenito 72f82c
interface(`openvpn_domtrans',`
Chris PeBenito 72f82c
	gen_require(`
Chris PeBenito 72f82c
		type openvpn_t, openvpn_exec_t;
Chris PeBenito 72f82c
	')
Chris PeBenito 72f82c
Chris PeBenito 72f82c
	domtrans_pattern($1, openvpn_exec_t, openvpn_t)
Chris PeBenito 72f82c
')
Chris PeBenito 72f82c
Chris PeBenito 72f82c
########################################
Chris PeBenito 72f82c
## <summary>
Chris PeBenito 72f82c
##	Execute OPENVPN clients in the openvpn domain, and
Chris PeBenito 72f82c
##	allow the specified role the openvpn domain.
Chris PeBenito 72f82c
## </summary>
Chris PeBenito 72f82c
## <param name="domain">
Chris PeBenito 72f82c
##	<summary>
Chris PeBenito 72f82c
##	Domain allowed access.
Chris PeBenito 72f82c
##	</summary>
Chris PeBenito 72f82c
## </param>
Chris PeBenito 72f82c
## <param name="role">
Chris PeBenito 72f82c
##	<summary>
Chris PeBenito 72f82c
##	The role to be allowed the openvpn domain.
Chris PeBenito 72f82c
##	</summary>
Chris PeBenito 72f82c
## </param>
Chris PeBenito 72f82c
## <rolecap/>
Chris PeBenito 72f82c
#
Chris PeBenito 72f82c
interface(`openvpn_run',`
Chris PeBenito 72f82c
	gen_require(`
Chris PeBenito 72f82c
		type openvpn_t;
Chris PeBenito 72f82c
	')
Chris PeBenito 72f82c
Chris PeBenito 72f82c
	openvpn_domtrans($1)
Chris PeBenito 72f82c
	role $2 types openvpn_t;
Chris PeBenito 72f82c
')
Chris PeBenito 72f82c
Chris PeBenito 72f82c
########################################
Chris PeBenito 72f82c
## <summary>
Chris PeBenito 8f800d
##	Send OPENVPN clients the kill signal.
Chris PeBenito 8f800d
## </summary>
Chris PeBenito 8f800d
## <param name="domain">
Chris PeBenito 8f800d
##	<summary>
Chris PeBenito 8f800d
##	Domain allowed access.
Chris PeBenito 8f800d
##	</summary>
Chris PeBenito 8f800d
## </param>
Chris PeBenito 8f800d
#
Chris PeBenito 8f800d
interface(`openvpn_kill',`
Chris PeBenito 8f800d
	gen_require(`
Chris PeBenito 8f800d
		type openvpn_t;
Chris PeBenito 8f800d
	')
Chris PeBenito 8f800d
Chris PeBenito 8f800d
	allow $1 openvpn_t:process sigkill;
Chris PeBenito 8f800d
')
Chris PeBenito 8f800d
Chris PeBenito 8f800d
########################################
Chris PeBenito 8f800d
## <summary>
Chris PeBenito 72f82c
##	Send generic signals to OPENVPN clients.
Chris PeBenito 72f82c
## </summary>
Chris PeBenito 72f82c
## <param name="domain">
Chris PeBenito 72f82c
##	<summary>
Chris PeBenito 72f82c
##	Domain allowed access.
Chris PeBenito 72f82c
##	</summary>
Chris PeBenito 72f82c
## </param>
Chris PeBenito 72f82c
#
Chris PeBenito 72f82c
interface(`openvpn_signal',`
Chris PeBenito 72f82c
	gen_require(`
Chris PeBenito 72f82c
		type openvpn_t;
Chris PeBenito 72f82c
	')
Chris PeBenito 72f82c
Chris PeBenito 72f82c
	allow $1 openvpn_t:process signal;
Chris PeBenito 72f82c
')
Chris PeBenito 72f82c
Chris PeBenito 72f82c
########################################
Chris PeBenito 72f82c
## <summary>
Chris PeBenito 8f800d
##	Send signulls to OPENVPN clients.
Chris PeBenito 8f800d
## </summary>
Chris PeBenito 8f800d
## <param name="domain">
Chris PeBenito 8f800d
##	<summary>
Chris PeBenito 8f800d
##	Domain allowed access.
Chris PeBenito 8f800d
##	</summary>
Chris PeBenito 8f800d
## </param>
Chris PeBenito 8f800d
#
Chris PeBenito 8f800d
interface(`openvpn_signull',`
Chris PeBenito 8f800d
	gen_require(`
Chris PeBenito 8f800d
		type openvpn_t;
Chris PeBenito 8f800d
	')
Chris PeBenito 8f800d
Chris PeBenito 8f800d
	allow $1 openvpn_t:process signull;
Chris PeBenito 8f800d
')
Chris PeBenito 8f800d
Chris PeBenito 8f800d
########################################
Chris PeBenito 8f800d
## <summary>
Chris PeBenito 17de1b
##	Allow the specified domain to read
Chris PeBenito 17de1b
##	OpenVPN configuration files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`openvpn_read_config',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type openvpn_etc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_etc($1)
Chris PeBenito c0868a
	allow $1 openvpn_etc_t:dir list_dir_perms;
Chris PeBenito 0bfccd
	read_files_pattern($1, openvpn_etc_t, openvpn_etc_t)
Chris PeBenito 0bfccd
	read_lnk_files_pattern($1, openvpn_etc_t, openvpn_etc_t)
Chris PeBenito 17de1b
')
Chris PeBenito 967fd1
Chris PeBenito 967fd1
########################################
Chris PeBenito 967fd1
## <summary>
Chris PeBenito 967fd1
##	All of the rules required to administrate 
Chris PeBenito 967fd1
##	an openvpn environment
Chris PeBenito 967fd1
## </summary>
Chris PeBenito 967fd1
## <param name="domain">
Chris PeBenito 967fd1
##	<summary>
Chris PeBenito 967fd1
##	Domain allowed access.
Chris PeBenito 967fd1
##	</summary>
Chris PeBenito 967fd1
## </param>
Chris PeBenito 967fd1
## <param name="role">
Chris PeBenito 967fd1
##	<summary>
Chris PeBenito 967fd1
##	The role to be allowed to manage the openvpn domain.
Chris PeBenito 967fd1
##	</summary>
Chris PeBenito 967fd1
## </param>
Chris PeBenito 967fd1
## <rolecap/>
Chris PeBenito 967fd1
#
Chris PeBenito 967fd1
interface(`openvpn_admin',`
Chris PeBenito 967fd1
	gen_require(`
Chris PeBenito 967fd1
		type openvpn_t, openvpn_etc_t, openvpn_var_log_t;
Chris PeBenito 967fd1
		type openvpn_var_run_t, openvpn_initrc_exec_t;
Chris PeBenito 967fd1
	')
Chris PeBenito 967fd1
Chris PeBenito 967fd1
	allow $1 openvpn_t:process { ptrace signal_perms };
Chris PeBenito 967fd1
	ps_process_pattern($1, openvpn_t)
Chris PeBenito 967fd1
Chris PeBenito 967fd1
	init_labeled_script_domtrans($1, openvpn_initrc_exec_t)
Chris PeBenito 967fd1
	domain_system_change_exemption($1)
Chris PeBenito 967fd1
	role_transition $2 openvpn_initrc_exec_t system_r;
Chris PeBenito 967fd1
	allow $2 system_r;
Chris PeBenito 967fd1
Chris PeBenito 967fd1
	files_list_etc($1)
Chris PeBenito 967fd1
	admin_pattern($1, openvpn_etc_t)
Chris PeBenito 967fd1
Chris PeBenito 967fd1
	logging_list_logs($1)
Chris PeBenito 967fd1
	admin_pattern($1, openvpn_var_log_t)
Chris PeBenito 967fd1
Chris PeBenito 967fd1
	files_list_pids($1)
Chris PeBenito 967fd1
	admin_pattern($1, openvpn_var_run_t)
Chris PeBenito 967fd1
')