Chris PeBenito 17de1b
## <summary>System initialization programs (init and init scripts).</summary>
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Create a domain which can be started by init.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type to be used as a domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="entry_point">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_domain',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
		role system_r;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	domain_type($1)
Chris PeBenito 17de1b
	domain_entry_file($1,$2)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	role system_r types $1;
Chris PeBenito 17de1b
Chris PeBenito c0868a
	domtrans_pattern(init_t,$2,$1)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	ifdef(`hide_broken_symptoms',`
Chris PeBenito 17de1b
		# RHEL4 systems seem to have a stray
Chris PeBenito 17de1b
		# fds open from the initrd
Chris PeBenito 17de1b
		ifdef(`distro_rhel4',`
Chris PeBenito 17de1b
			kernel_dontaudit_use_fds($1)
Chris PeBenito 17de1b
		')
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito e070dd
##	Create a domain which can be started by init,
Chris PeBenito e070dd
##	with a range transition.
Chris PeBenito e070dd
## </summary>
Chris PeBenito e070dd
## <param name="domain">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type to be used as a domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="entry_point">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="range">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Range for the domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
#
Chris PeBenito e070dd
interface(`init_ranged_domain',`
Chris PeBenito e070dd
	gen_require(`
Chris PeBenito e070dd
		type init_t;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	init_domain($1,$2)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito e070dd
		range_transition init_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito e070dd
		range_transition init_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
')
Chris PeBenito e070dd
Chris PeBenito e070dd
########################################
Chris PeBenito e070dd
## <summary>
Chris PeBenito 17de1b
##	Create a domain for long running processes
Chris PeBenito 17de1b
##	(daemons) which can be started by init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type to be used as a domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="entry_point">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_daemon_domain',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute direct_run_init, direct_init, direct_init_entry;
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
		role system_r;
Chris PeBenito 693d4a
		attribute daemon;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 693d4a
	typeattribute $1 daemon;
Chris PeBenito 693d4a
Chris PeBenito 17de1b
	domain_type($1)
Chris PeBenito 17de1b
	domain_entry_file($1,$2)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	role system_r types $1;
Chris PeBenito 17de1b
Chris PeBenito ab514d
	domtrans_pattern(initrc_t,$2,$1)
Chris PeBenito ab514d
Chris PeBenito a5f5eb
	# daemons started from init will
Chris PeBenito a5f5eb
	# inherit fds from init for the console
Chris PeBenito a5f5eb
	init_dontaudit_use_fds($1)
Chris PeBenito a5f5eb
	term_dontaudit_use_console($1)
Chris PeBenito a5f5eb
Chris PeBenito a5f5eb
	# init script ptys are the stdin/out/err 
Chris PeBenito a5f5eb
	# when using run_init
Chris PeBenito a5f5eb
	init_use_script_ptys($1)
Chris PeBenito a5f5eb
Chris PeBenito 17de1b
	ifdef(`direct_sysadm_daemon',`
Chris PeBenito c0868a
		domtrans_pattern(direct_run_init,$2,$1)
Chris PeBenito 17de1b
		allow direct_run_init $1:process { noatsecure siginh rlimitinh };
Chris PeBenito 17de1b
Chris PeBenito 17de1b
		typeattribute $1 direct_init;
Chris PeBenito 17de1b
		typeattribute $2 direct_init_entry;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	ifdef(`hide_broken_symptoms',`
Chris PeBenito 17de1b
		# RHEL4 systems seem to have a stray
Chris PeBenito 17de1b
		# fds open from the initrd
Chris PeBenito 17de1b
		ifdef(`distro_rhel4',`
Chris PeBenito 17de1b
			kernel_dontaudit_use_fds($1)
Chris PeBenito 17de1b
		')
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito 17de1b
		nscd_socket_use($1)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito e070dd
##	Create a domain for long running processes
Chris PeBenito e070dd
##	(daemons) which can be started by init scripts.
Chris PeBenito e070dd
## </summary>
Chris PeBenito e070dd
## <param name="domain">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type to be used as a domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="entry_point">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="range">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Range for the domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
#
Chris PeBenito e070dd
interface(`init_ranged_daemon_domain',`
Chris PeBenito e070dd
	gen_require(`
Chris PeBenito e070dd
		type initrc_t;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	init_daemon_domain($1,$2)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito e070dd
		range_transition initrc_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito e070dd
		range_transition initrc_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
')
Chris PeBenito e070dd
Chris PeBenito e070dd
########################################
Chris PeBenito e070dd
## <summary>
Chris PeBenito 17de1b
##	Create a domain for short running processes
Chris PeBenito 17de1b
##	which can be started by init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type to be used as a domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="entry_point">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_system_domain',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
		role system_r;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	domain_type($1)
Chris PeBenito 17de1b
	domain_entry_file($1,$2)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	role system_r types $1;
Chris PeBenito 17de1b
Chris PeBenito c0868a
	domtrans_pattern(initrc_t,$2,$1)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	ifdef(`hide_broken_symptoms',`
Chris PeBenito 17de1b
		# RHEL4 systems seem to have a stray
Chris PeBenito 17de1b
		# fds open from the initrd
Chris PeBenito 17de1b
		ifdef(`distro_rhel4',`
Chris PeBenito 17de1b
			kernel_dontaudit_use_fds($1)
Chris PeBenito 17de1b
		')
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito e070dd
##	Create a domain for short running processes
Chris PeBenito e070dd
##	which can be started by init scripts.
Chris PeBenito e070dd
## </summary>
Chris PeBenito e070dd
## <param name="domain">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type to be used as a domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="entry_point">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="range">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Range for the domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
#
Chris PeBenito e070dd
interface(`init_ranged_system_domain',`
Chris PeBenito e070dd
	gen_require(`
Chris PeBenito e070dd
		type initrc_t;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	init_system_domain($1,$2)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito e070dd
		range_transition initrc_t $2 $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito e070dd
		range_transition initrc_t $2 $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
')
Chris PeBenito e070dd
Chris PeBenito e070dd
########################################
Chris PeBenito e070dd
## <summary>
Chris PeBenito 17de1b
##	Execute init (/sbin/init) with a domain transition.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_domtrans',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t, init_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito c0868a
	domtrans_pattern($1,init_exec_t,init_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute the init program in the caller domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_exec',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 8021cb
	corecmd_search_bin($1)
Chris PeBenito 17de1b
	can_exec($1,init_exec_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Get the process group of init.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_getpgid',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
		# cjp: remove this when init_t decl is moved back to this module
Chris PeBenito 17de1b
		attribute direct_run_init;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 init_t:process getpgid;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send init a null signal.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_signull',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
		# cjp: remove this when init_t decl is moved back to this module
Chris PeBenito 17de1b
		attribute direct_run_init;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 init_t:process signull;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send init a SIGCHLD signal.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_sigchld',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
		# cjp: remove this when init_t decl is moved back to this module
Chris PeBenito 17de1b
		attribute direct_run_init;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 init_t:process sigchld;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Inherit and use file descriptors from init.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_use_fds',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
		# cjp: remove this when init_t decl is moved back to this module
Chris PeBenito 17de1b
		attribute direct_run_init;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 init_t:fd use;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to inherit file
Chris PeBenito 17de1b
##	descriptors from init.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_use_fds',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
		# cjp: remove this when init_t decl is moved back to this module
Chris PeBenito 17de1b
		attribute direct_run_init;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 init_t:fd use;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 33c7e6
##	Send UDP network traffic to init.  (Deprecated)
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_udp_send',`
Chris PeBenito 33c7e6
	refpolicywarn(`$0($*) has been deprecated.')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Get the attributes of initctl.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_getattr_initctl',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initctl_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initctl_t:fifo_file getattr;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to get the
Chris PeBenito 17de1b
##	attributes of initctl.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_getattr_initctl',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initctl_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initctl_t:fifo_file getattr;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Write to initctl.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_write_initctl',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initctl_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dev_list_all_dev_nodes($1)
Chris PeBenito 17de1b
	allow $1 initctl_t:fifo_file write;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito bbcd3c
##	Use telinit (Read and write initctl).
Chris PeBenito bbcd3c
## </summary>
Chris PeBenito bbcd3c
## <param name="domain">
Chris PeBenito bbcd3c
##	<summary>
Chris PeBenito bbcd3c
##	Domain allowed access.
Chris PeBenito bbcd3c
##	</summary>
Chris PeBenito bbcd3c
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito bbcd3c
#
Chris PeBenito bbcd3c
interface(`init_telinit',`
Chris PeBenito bbcd3c
	gen_require(`
Chris PeBenito bbcd3c
		type initctl_t;
Chris PeBenito bbcd3c
	')
Chris PeBenito bbcd3c
Chris PeBenito bbcd3c
	dev_list_all_dev_nodes($1)
Chris PeBenito c0868a
	allow $1 initctl_t:fifo_file rw_fifo_file_perms;
Chris PeBenito ca448b
Chris PeBenito ca448b
	init_exec($1)
Chris PeBenito bbcd3c
')
Chris PeBenito bbcd3c
Chris PeBenito bbcd3c
########################################
Chris PeBenito bbcd3c
## <summary>
Chris PeBenito 17de1b
##	Read and write initctl.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_rw_initctl',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initctl_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dev_list_all_dev_nodes($1)
Chris PeBenito c0868a
	allow $1 initctl_t:fifo_file rw_fifo_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to read and
Chris PeBenito 17de1b
##	write initctl.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_rw_initctl',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initctl_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initctl_t:fifo_file { read write };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Make init scripts an entry point for
Chris PeBenito 17de1b
##	the specified domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The domain for which init scripts are an entrypoint.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
# cjp: added for gentoo integrated run_init
Chris PeBenito 17de1b
interface(`init_script_file_entry_type',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	domain_entry_file($1,initrc_exec_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 93ddc6
##	Execute init scripts with a specified domain transition.
Chris PeBenito 93ddc6
## </summary>
Chris PeBenito 93ddc6
## <param name="domain">
Chris PeBenito 93ddc6
##	<summary>
Chris PeBenito 93ddc6
##	Domain allowed access.
Chris PeBenito 93ddc6
##	</summary>
Chris PeBenito 93ddc6
## </param>
Chris PeBenito 93ddc6
#
Chris PeBenito 93ddc6
interface(`init_spec_domtrans_script',`
Chris PeBenito 93ddc6
	gen_require(`
Chris PeBenito 93ddc6
		type initrc_t, initrc_exec_t;
Chris PeBenito 93ddc6
	')
Chris PeBenito 93ddc6
Chris PeBenito 93ddc6
	files_list_etc($1)
Chris PeBenito c0868a
	spec_domtrans_pattern($1,initrc_exec_t,initrc_t)
Chris PeBenito 93ddc6
Chris PeBenito 93ddc6
	ifdef(`enable_mcs',`
Chris PeBenito 93ddc6
		range_transition $1 initrc_exec_t:process s0;
Chris PeBenito 93ddc6
	')
Chris PeBenito 93ddc6
Chris PeBenito 93ddc6
	ifdef(`enable_mls',`
Chris PeBenito 93ddc6
		range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
Chris PeBenito 93ddc6
	')
Chris PeBenito 93ddc6
')
Chris PeBenito 93ddc6
Chris PeBenito 93ddc6
########################################
Chris PeBenito 93ddc6
## <summary>
Chris PeBenito 93ddc6
##	Execute init scripts with an automatic domain transition.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_domtrans_script',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t, initrc_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_etc($1)
Chris PeBenito c0868a
	domtrans_pattern($1,initrc_exec_t,initrc_t)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito e070dd
		range_transition $1 initrc_exec_t:process s0;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito e070dd
		range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
Chris PeBenito e070dd
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute a init script in a specified domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##      

Chris PeBenito 17de1b
##	Execute a init script in a specified domain.
Chris PeBenito 17de1b
##      

Chris PeBenito 17de1b
##      

Chris PeBenito 17de1b
##      No interprocess communication (signals, pipes,
Chris PeBenito 17de1b
##      etc.) is provided by this interface since
Chris PeBenito 17de1b
##      the domains are not owned by this module.
Chris PeBenito 17de1b
##      

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="source_domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to transition from.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="target_domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to transition to.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
# cjp: added for gentoo integrated run_init
Chris PeBenito 17de1b
interface(`init_script_file_domtrans',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_etc($1)
Chris PeBenito 17de1b
	domain_auto_trans($1,initrc_exec_t,$2)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Start and stop daemon programs directly.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	Start and stop daemon programs directly
Chris PeBenito 17de1b
##	in the traditional "/etc/init.d/daemon start"
Chris PeBenito 17de1b
##	style, and do not require run_init.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="role">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The role to be performing this action.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="terminal">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The type of the terminal of the user.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_run_daemon',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute direct_run_init, direct_init, direct_init_entry;
Chris PeBenito 17de1b
		role system_r;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	typeattribute $1 direct_run_init;
Chris PeBenito 17de1b
	role_transition $2 direct_init_entry system_r;
Chris PeBenito 17de1b
	dontaudit direct_init $3:chr_file rw_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Write an init script unnamed pipe.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_write_script_pipes',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:fifo_file write;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Get the attribute of init script entrypoint files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_getattr_script_files',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_etc($1)
Chris PeBenito 17de1b
	allow $1 initrc_exec_t:file getattr;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute init scripts in the caller domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_exec_script_files',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_etc($1)
Chris PeBenito 17de1b
	can_exec($1,initrc_exec_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read the process state (/proc/pid) of the init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_read_script_state',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito c0868a
	kernel_search_proc($1)
Chris PeBenito c0868a
	read_files_pattern($1,initrc_t,initrc_t)
Chris PeBenito c0868a
	read_lnk_files_pattern($1,initrc_t,initrc_t)
Chris PeBenito c0868a
	list_dirs_pattern($1,initrc_t,initrc_t)
Chris PeBenito c0868a
Chris PeBenito c0868a
	# should move this to separate interface
Chris PeBenito 17de1b
	allow $1 initrc_t:process getattr;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Inherit and use init script file descriptors.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_use_script_fds',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:fd use;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to inherit
Chris PeBenito 17de1b
##	init script file descriptors.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_use_script_fds',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initrc_t:fd use;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Get the process group ID of init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_getpgid_script',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:process getpgid;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send SIGCHLD signals to init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_sigchld_script',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:process sigchld;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send generic signals to init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_signal_script',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:process signal;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send null signals to init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_signull_script',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:process signull;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read and write init script unnamed pipes.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_rw_script_pipes',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:fifo_file { read write };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 33c7e6
##	Send UDP network traffic to init scripts.  (Deprecated)
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_udp_send_script',`
Chris PeBenito 33c7e6
	refpolicywarn(`$0($*) has been deprecated.')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Allow the specified domain to connect to
Chris PeBenito 17de1b
##	init scripts with a unix socket.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_stream_connect_script',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:unix_stream_socket connectto;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Allow the specified domain to read/write to
Chris PeBenito 17de1b
##	init scripts with a unix domain stream sockets.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_rw_script_stream_sockets',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:unix_stream_socket { read write };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Dont audit the specified domain connecting to
Chris PeBenito 17de1b
##	init scripts with a unix domain stream socket.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##      Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_stream_connect_script',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initrc_t:unix_stream_socket connectto;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send and receive messages from
Chris PeBenito 17de1b
##	init scripts over dbus.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dbus_chat_script',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
		class dbus send_msg;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_t:dbus send_msg;
Chris PeBenito 17de1b
	allow initrc_t $1:dbus send_msg;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read and write the init script pty.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	Read and write the init script pty.  This
Chris PeBenito 17de1b
##	pty is generally opened by the open_init_pty
Chris PeBenito 17de1b
##	portion of the run_init program so that the
Chris PeBenito 17de1b
##	daemon does not require direct access to
Chris PeBenito 17de1b
##	the administrator terminal.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_use_script_ptys',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_devpts_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	term_list_ptys($1)
Chris PeBenito 17de1b
	allow $1 initrc_devpts_t:chr_file { rw_term_perms lock append };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to read and
Chris PeBenito 17de1b
##	write the init script pty.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_use_script_ptys',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_devpts_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initrc_devpts_t:chr_file { rw_term_perms lock append };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_read_script_files',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_etc($1)
Chris PeBenito c0868a
	allow $1 initrc_exec_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito ed38ca
## <summary>
Chris PeBenito ed38ca
##	Get the attributes of init script
Chris PeBenito ed38ca
##	status files.
Chris PeBenito ed38ca
## </summary>
Chris PeBenito ed38ca
## <param name="domain">
Chris PeBenito ed38ca
##	<summary>
Chris PeBenito ed38ca
##	Domain allowed access.
Chris PeBenito ed38ca
##	</summary>
Chris PeBenito ed38ca
## </param>
Chris PeBenito ed38ca
#
Chris PeBenito ed38ca
interface(`init_getattr_script_status_files',`
Chris PeBenito ed38ca
	gen_require(`
Chris PeBenito ed38ca
		type initrc_state_t;
Chris PeBenito ed38ca
	')
Chris PeBenito ed38ca
Chris PeBenito c0868a
	getattr_files_pattern($1,initrc_state_t,initrc_state_t)
Chris PeBenito ed38ca
')
Chris PeBenito ed38ca
Chris PeBenito ed38ca
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to read init script
Chris PeBenito 17de1b
##	status files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_read_script_status_files',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_state_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initrc_state_t:dir search_dir_perms;
Chris PeBenito 17de1b
	dontaudit $1 initrc_state_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read and write init script temporary data.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_rw_script_tmp_files',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_tmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_tmp($1)
Chris PeBenito 17de1b
	allow $1 initrc_tmp_t:file rw_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Create files in a init script
Chris PeBenito 17de1b
##	temporary data directory.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="file_type">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The type of the object to be created
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="object_class">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The object class.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_script_tmp_filetrans',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_tmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_tmp($1)
Chris PeBenito c0868a
	filetrans_pattern($1,initrc_tmp_t,$2,$3)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Get the attributes of init script process id files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_getattr_utmp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 initrc_var_run_t:file getattr;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read utmp.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_read_utmp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_pids($1)
Chris PeBenito c0868a
	allow $1 initrc_var_run_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to write utmp.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_write_utmp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initrc_var_run_t:file { write lock };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Write to utmp.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_write_utmp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_pids($1)
Chris PeBenito 17de1b
	allow $1 initrc_var_run_t:file { getattr write };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to lock 
Chris PeBenito 17de1b
##	init script pid files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_lock_utmp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initrc_var_run_t:file lock;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read and write utmp.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_rw_utmp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_pids($1)
Chris PeBenito 17de1b
	allow $1 initrc_var_run_t:file rw_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to read and write utmp.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_dontaudit_rw_utmp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 initrc_var_run_t:file { getattr read write append };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##      Create, read, write, and delete utmp.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##      Domain access allowed.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_manage_utmp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type initrc_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito c0868a
	allow $1 initrc_var_run_t:file manage_file_perms;
Chris PeBenito 17de1b
')