Chris PeBenito eb4216
## <summary>Libvirt virtualization API</summary>
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito 3079cb
##	Creates types and rules for a basic
Chris PeBenito 3079cb
##	qemu process domain.
Chris PeBenito 3079cb
## </summary>
Chris PeBenito 3079cb
## <param name="prefix">
Chris PeBenito 3079cb
##	<summary>
Chris PeBenito 3079cb
##	Prefix for the domain.
Chris PeBenito 3079cb
##	</summary>
Chris PeBenito 3079cb
## </param>
Chris PeBenito 3079cb
#
Chris PeBenito 3079cb
template(`virt_domain_template',`
Chris PeBenito 3079cb
	gen_require(`
Chris PeBenito 3079cb
		type virtd_t;
Chris PeBenito 3079cb
		attribute virt_image_type;
Chris PeBenito 3079cb
		attribute virt_domain;
Chris PeBenito 3079cb
	')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	type $1_t, virt_domain;
Chris PeBenito 3079cb
	domain_type($1_t)
Chris PeBenito 3079cb
	role system_r types $1_t;
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	type $1_tmp_t;
Chris PeBenito 3079cb
	files_tmp_file($1_tmp_t)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	type $1_tmpfs_t;
Chris PeBenito 3079cb
	files_tmpfs_file($1_tmpfs_t)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	type $1_image_t, virt_image_type;
Chris PeBenito 3079cb
	files_type($1_image_t)
Chris PeBenito 3079cb
	dev_node($1_image_t)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	type $1_var_run_t;
Chris PeBenito 3079cb
	files_pid_file($1_var_run_t)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	manage_dirs_pattern($1_t, $1_image_t, $1_image_t)
Chris PeBenito 3079cb
	manage_files_pattern($1_t, $1_image_t, $1_image_t)
Chris PeBenito 3079cb
	read_lnk_files_pattern($1_t, $1_image_t, $1_image_t)
Chris PeBenito 3079cb
	rw_blk_files_pattern($1_t, $1_image_t, $1_image_t)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	manage_dirs_pattern($1_t, $1_tmp_t, $1_tmp_t)
Chris PeBenito 3079cb
	manage_files_pattern($1_t, $1_tmp_t, $1_tmp_t)
Chris PeBenito 3079cb
	manage_lnk_files_pattern($1_t, $1_tmp_t, $1_tmp_t)
Chris PeBenito 3079cb
	files_tmp_filetrans($1_t, $1_tmp_t, { file dir })
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	manage_dirs_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
Chris PeBenito 3079cb
	manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
Chris PeBenito 3079cb
	manage_lnk_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
Chris PeBenito 3079cb
	fs_tmpfs_filetrans($1_t, $1_tmpfs_t, { dir file lnk_file })
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	stream_connect_pattern(virtd_t, $1_var_run_t, $1_var_run_t, virt_domain)
Chris PeBenito 3079cb
	manage_dirs_pattern(virtd_t, $1_var_run_t, $1_var_run_t)
Chris PeBenito 3079cb
	manage_files_pattern(virtd_t, $1_var_run_t, $1_var_run_t)
Chris PeBenito 3079cb
	manage_sock_files_pattern(virtd_t, $1_var_run_t, $1_var_run_t)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	manage_dirs_pattern($1_t, $1_var_run_t, $1_var_run_t)
Chris PeBenito 3079cb
	manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
Chris PeBenito 3079cb
	manage_sock_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
Chris PeBenito 3079cb
	manage_lnk_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
Chris PeBenito 3079cb
	files_pid_filetrans($1_t, $1_var_run_t, { dir file })
Chris PeBenito 3079cb
	stream_connect_pattern($1_t, $1_var_run_t, $1_var_run_t, virtd_t)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
########################################
Chris PeBenito 3079cb
## <summary>
Chris PeBenito fb4826
##	Make the specified type usable as a virt image
Chris PeBenito fb4826
## </summary>
Chris PeBenito fb4826
## <param name="type">
Chris PeBenito fb4826
##	<summary>
Chris PeBenito fb4826
##	Type to be used as a virtual image
Chris PeBenito fb4826
##	</summary>
Chris PeBenito fb4826
## </param>
Chris PeBenito fb4826
#
Chris PeBenito fb4826
interface(`virt_image',`
Chris PeBenito fb4826
	gen_require(`
Chris PeBenito fb4826
		attribute virt_image_type;
Chris PeBenito fb4826
	')
Chris PeBenito fb4826
Chris PeBenito fb4826
	typeattribute $1 virt_image_type;
Chris PeBenito fb4826
	files_type($1)
Chris PeBenito fb4826
Chris PeBenito fb4826
	# virt images can be assigned to blk devices
Chris PeBenito fb4826
	dev_node($1)
Chris PeBenito fb4826
')
Chris PeBenito fb4826
Chris PeBenito fb4826
########################################
Chris PeBenito fb4826
## <summary>
Chris PeBenito eb4216
##	Execute a domain transition to run virt.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	Domain allowed to transition.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_domtrans',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virtd_t, virtd_exec_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	domtrans_pattern($1, virtd_exec_t, virtd_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito fb4826
#######################################
Chris PeBenito fb4826
## <summary>
Chris PeBenito fb4826
##	Connect to virt over an unix domain stream socket.
Chris PeBenito fb4826
## </summary>
Chris PeBenito fb4826
## <param name="domain">
Chris PeBenito fb4826
##	<summary>
Chris PeBenito fb4826
##	Domain allowed access.
Chris PeBenito fb4826
##	</summary>
Chris PeBenito fb4826
## </param>
Chris PeBenito fb4826
#
Chris PeBenito fb4826
interface(`virt_stream_connect',`
Chris PeBenito fb4826
	gen_require(`
Chris PeBenito fb4826
		type virtd_t, virt_var_run_t;
Chris PeBenito fb4826
	')
Chris PeBenito fb4826
Chris PeBenito fb4826
	files_search_pids($1)
Chris PeBenito fb4826
	stream_connect_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
Chris PeBenito fb4826
')
Chris PeBenito fb4826
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito bd7570
##	Allow domain to attach to virt TUN devices
Chris PeBenito bd7570
## </summary>
Chris PeBenito bd7570
## <param name="domain">
Chris PeBenito bd7570
##	<summary>
Chris PeBenito bd7570
##	Domain allowed access.
Chris PeBenito bd7570
##	</summary>
Chris PeBenito bd7570
## </param>
Chris PeBenito bd7570
#
Chris PeBenito bd7570
interface(`virt_attach_tun_iface',`
Chris PeBenito bd7570
	gen_require(`
Chris PeBenito bd7570
		type virtd_t;
Chris PeBenito bd7570
	')
Chris PeBenito bd7570
Chris PeBenito bd7570
	allow $1 virtd_t:tun_socket relabelfrom;
Chris PeBenito bd7570
	allow $1 self:tun_socket relabelto;
Chris PeBenito bd7570
')
Chris PeBenito bd7570
Chris PeBenito bd7570
########################################
Chris PeBenito bd7570
## <summary>
Chris PeBenito eb4216
##	Read virt config files.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain allowed access.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_read_config',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virt_etc_t;
Chris PeBenito eb4216
		type virt_etc_rw_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	files_search_etc($1)
Chris PeBenito eb4216
	read_files_pattern($1, virt_etc_t, virt_etc_t)
Chris PeBenito eb4216
	read_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito fb4826
##	manage virt config files.
Chris PeBenito fb4826
## </summary>
Chris PeBenito fb4826
## <param name="domain">
Chris PeBenito fb4826
##	<summary>
Chris PeBenito fb4826
##	Domain allowed access.
Chris PeBenito fb4826
##	</summary>
Chris PeBenito fb4826
## </param>
Chris PeBenito fb4826
#
Chris PeBenito fb4826
interface(`virt_manage_config',`
Chris PeBenito fb4826
	gen_require(`
Chris PeBenito fb4826
		type virt_etc_t;
Chris PeBenito fb4826
		type virt_etc_rw_t;
Chris PeBenito fb4826
	')
Chris PeBenito fb4826
Chris PeBenito fb4826
	files_search_etc($1)
Chris PeBenito fb4826
	manage_files_pattern($1, virt_etc_t, virt_etc_t)
Chris PeBenito fb4826
	manage_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t)
Chris PeBenito fb4826
')
Chris PeBenito fb4826
Chris PeBenito fb4826
########################################
Chris PeBenito fb4826
## <summary>
Chris PeBenito 3079cb
##	Allow domain to manage virt image files
Chris PeBenito 3079cb
## </summary>
Chris PeBenito 3079cb
## <param name="domain">
Chris PeBenito 3079cb
##	<summary>
Chris PeBenito 3079cb
##	Domain to not audit.
Chris PeBenito 3079cb
##	</summary>
Chris PeBenito 3079cb
## </param>
Chris PeBenito 3079cb
#
Chris PeBenito 3079cb
interface(`virt_read_content',`
Chris PeBenito 3079cb
	gen_require(`
Chris PeBenito 3079cb
		type virt_content_t;
Chris PeBenito 3079cb
	')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	virt_search_lib($1)
Chris PeBenito 3079cb
	allow $1 virt_content_t:dir list_dir_perms;
Chris PeBenito 3079cb
	list_dirs_pattern($1, virt_content_t, virt_content_t)
Chris PeBenito 3079cb
	read_files_pattern($1, virt_content_t, virt_content_t)
Chris PeBenito 3079cb
	read_lnk_files_pattern($1, virt_content_t, virt_content_t)
Chris PeBenito 3079cb
	read_blk_files_pattern($1, virt_content_t, virt_content_t)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	tunable_policy(`virt_use_nfs',`
Chris PeBenito 3079cb
		fs_list_nfs($1)
Chris PeBenito 3079cb
		fs_read_nfs_files($1)
Chris PeBenito 3079cb
		fs_read_nfs_symlinks($1)
Chris PeBenito 3079cb
	')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	tunable_policy(`virt_use_samba',`
Chris PeBenito 3079cb
		fs_list_cifs($1)
Chris PeBenito 3079cb
		fs_read_cifs_files($1)
Chris PeBenito 3079cb
		fs_read_cifs_symlinks($1)
Chris PeBenito 3079cb
	')
Chris PeBenito 3079cb
')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
########################################
Chris PeBenito 3079cb
## <summary>
Chris PeBenito eb4216
##	Read virt PID files.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain allowed access.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_read_pid_files',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virt_var_run_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	files_search_pids($1)
Chris PeBenito 3079cb
	read_files_pattern($1, virt_var_run_t, virt_var_run_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	Manage virt pid files.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain allowed access.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito aa7c46
interface(`virt_manage_pid_files',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virt_var_run_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito 3079cb
	files_search_pids($1)
Chris PeBenito 3f67f7
	manage_files_pattern($1, virt_var_run_t, virt_var_run_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	Search virt lib directories.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain allowed access.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_search_lib',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virt_var_lib_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	allow $1 virt_var_lib_t:dir search_dir_perms;
Chris PeBenito eb4216
	files_search_var_lib($1)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	Read virt lib files.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain allowed access.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_read_lib_files',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virt_var_lib_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	files_search_var_lib($1)
Chris PeBenito 6073ea
	read_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	Create, read, write, and delete
Chris PeBenito eb4216
##	virt lib files.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain allowed access.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_manage_lib_files',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virt_var_lib_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	files_search_var_lib($1)
Chris PeBenito 6073ea
	manage_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	Allow the specified domain to read virt's log files.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain allowed access.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
## <rolecap/>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_read_log',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virt_log_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	logging_search_logs($1)
Chris PeBenito 6073ea
	read_files_pattern($1, virt_log_t, virt_log_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	Allow the specified domain to append
Chris PeBenito eb4216
##	virt log files.
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
## 	<summary>
Chris PeBenito eb4216
##	Domain allowed to transition.
Chris PeBenito eb4216
## 	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_append_log',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito aa7c46
		type virt_log_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	logging_search_logs($1)
Chris PeBenito 6073ea
	append_files_pattern($1, virt_log_t, virt_log_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	Allow domain to manage virt log files
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain to not audit.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_manage_log',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito eb4216
		type virt_log_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito 6073ea
	manage_dirs_pattern($1, virt_log_t, virt_log_t)
Chris PeBenito 6073ea
	manage_files_pattern($1, virt_log_t, virt_log_t)
Chris PeBenito 6073ea
	manage_lnk_files_pattern($1, virt_log_t, virt_log_t)
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito 3079cb
##	Allow domain to read virt image files
Chris PeBenito 3079cb
## </summary>
Chris PeBenito 3079cb
## <param name="domain">
Chris PeBenito 3079cb
##	<summary>
Chris PeBenito 3079cb
##	Domain to not audit.
Chris PeBenito 3079cb
##	</summary>
Chris PeBenito 3079cb
## </param>
Chris PeBenito 3079cb
#
Chris PeBenito 3079cb
interface(`virt_read_images',`
Chris PeBenito 3079cb
	gen_require(`
Chris PeBenito 3079cb
		type virt_var_lib_t;
Chris PeBenito 3079cb
		attribute virt_image_type;
Chris PeBenito 3079cb
	')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	virt_search_lib($1)
Chris PeBenito 3079cb
	allow $1 virt_image_type:dir list_dir_perms;
Chris PeBenito 3079cb
	list_dirs_pattern($1, virt_image_type, virt_image_type)
Chris PeBenito 3079cb
	read_files_pattern($1, virt_image_type, virt_image_type)
Chris PeBenito 3079cb
	read_lnk_files_pattern($1, virt_image_type, virt_image_type)
Chris PeBenito 3079cb
	read_blk_files_pattern($1, virt_image_type, virt_image_type)
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	tunable_policy(`virt_use_nfs',`
Chris PeBenito 3079cb
		fs_list_nfs($1)
Chris PeBenito 3079cb
		fs_read_nfs_files($1)
Chris PeBenito 3079cb
		fs_read_nfs_symlinks($1)
Chris PeBenito 3079cb
	')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	tunable_policy(`virt_use_samba',`
Chris PeBenito 3079cb
		fs_list_cifs($1)
Chris PeBenito 3079cb
		fs_read_cifs_files($1)
Chris PeBenito 3079cb
		fs_read_cifs_symlinks($1)
Chris PeBenito 3079cb
	')
Chris PeBenito 3079cb
')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
########################################
Chris PeBenito 3079cb
## <summary>
Chris PeBenito 3079cb
##	Create, read, write, and delete
Chris PeBenito 3079cb
##	svirt cache files.
Chris PeBenito 3079cb
## </summary>
Chris PeBenito 3079cb
## <param name="domain">
Chris PeBenito 3079cb
##	<summary>
Chris PeBenito 3079cb
##	Domain allowed access.
Chris PeBenito 3079cb
##	</summary>
Chris PeBenito 3079cb
## </param>
Chris PeBenito 3079cb
#
Chris PeBenito 3079cb
interface(`virt_manage_svirt_cache',`
Chris PeBenito 3079cb
	gen_require(`
Chris PeBenito 3079cb
		type svirt_cache_t;
Chris PeBenito 3079cb
	')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
	files_search_var($1)
Chris PeBenito 3079cb
	manage_dirs_pattern($1, svirt_cache_t, svirt_cache_t)
Chris PeBenito 3079cb
	manage_files_pattern($1, svirt_cache_t, svirt_cache_t)
Chris PeBenito 3079cb
	manage_lnk_files_pattern($1, svirt_cache_t, svirt_cache_t)
Chris PeBenito 3079cb
')
Chris PeBenito 3079cb
Chris PeBenito 3079cb
########################################
Chris PeBenito 3079cb
## <summary>
Chris PeBenito eb4216
##	Allow domain to manage virt image files
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain to not audit.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_manage_images',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito 3079cb
		type virt_var_lib_t;
Chris PeBenito 3079cb
		attribute virt_image_type;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	virt_search_lib($1)
Chris PeBenito 3079cb
	allow $1 virt_image_type:dir list_dir_perms;
Chris PeBenito 3079cb
	manage_dirs_pattern($1, virt_image_type, virt_image_type)
Chris PeBenito 3079cb
	manage_files_pattern($1, virt_image_type, virt_image_type)
Chris PeBenito 3079cb
	read_lnk_files_pattern($1, virt_image_type, virt_image_type)
Chris PeBenito 3079cb
	rw_blk_files_pattern($1, virt_image_type, virt_image_type)
Chris PeBenito eb4216
Chris PeBenito eb4216
	tunable_policy(`virt_use_nfs',`
Chris PeBenito eb4216
		fs_manage_nfs_dirs($1)
Chris PeBenito eb4216
		fs_manage_nfs_files($1)
Chris PeBenito eb4216
		fs_read_nfs_symlinks($1)
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	tunable_policy(`virt_use_samba',`
Chris PeBenito 3079cb
		fs_manage_cifs_files($1)
Chris PeBenito eb4216
		fs_manage_cifs_files($1)
Chris PeBenito eb4216
		fs_read_cifs_symlinks($1)
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
')
Chris PeBenito eb4216
Chris PeBenito eb4216
########################################
Chris PeBenito eb4216
## <summary>
Chris PeBenito eb4216
##	All of the rules required to administrate 
Chris PeBenito eb4216
##	an virt environment
Chris PeBenito eb4216
## </summary>
Chris PeBenito eb4216
## <param name="domain">
Chris PeBenito eb4216
##	<summary>
Chris PeBenito eb4216
##	Domain allowed access.
Chris PeBenito eb4216
##	</summary>
Chris PeBenito eb4216
## </param>
Chris PeBenito a057e0
## <param name="role">
Chris PeBenito a057e0
##	<summary>
Chris PeBenito a057e0
##	Role allowed access.
Chris PeBenito a057e0
##	</summary>
Chris PeBenito a057e0
## </param>
Chris PeBenito eb4216
## <rolecap/>
Chris PeBenito eb4216
#
Chris PeBenito eb4216
interface(`virt_admin',`
Chris PeBenito eb4216
	gen_require(`
Chris PeBenito fb4826
		type virtd_t, virtd_initrc_exec_t;
Chris PeBenito eb4216
	')
Chris PeBenito eb4216
Chris PeBenito eb4216
	allow $1 virtd_t:process { ptrace signal_perms };
Chris PeBenito eb4216
	ps_process_pattern($1, virtd_t)
Chris PeBenito eb4216
Chris PeBenito fb4826
	init_labeled_script_domtrans($1, virtd_initrc_exec_t)
Chris PeBenito fb4826
	domain_system_change_exemption($1)
Chris PeBenito fb4826
	role_transition $2 virtd_initrc_exec_t system_r;
Chris PeBenito fb4826
	allow $2 system_r;
Chris PeBenito fb4826
Chris PeBenito eb4216
	virt_manage_pid_files($1)
Chris PeBenito eb4216
Chris PeBenito eb4216
	virt_manage_lib_files($1)
Chris PeBenito eb4216
Chris PeBenito eb4216
	virt_manage_log($1)
Chris PeBenito eb4216
')