Chris PeBenito 17de1b
## <summary>System initialization programs (init and init scripts).</summary>
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 6cc3f3
##	Create a file type used for init scripts.
Chris PeBenito 6cc3f3
## </summary>
Chris PeBenito 6cc3f3
## <desc>
Chris PeBenito 6cc3f3
##	

Chris PeBenito 13f000
##	Create a file type used for init scripts.  It can not be
Chris PeBenito 13f000
##	used in conjunction with init_script_domain(). These
Chris PeBenito 13f000
##	script files are typically stored in the /etc/init.d directory.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	Typically this is used to constrain what services an
Chris PeBenito 13f000
##	admin can start/stop.  For example, a policy writer may want
Chris PeBenito 13f000
##	to constrain a web administrator to only being able to
Chris PeBenito 13f000
##	restart the web server, not other services.  This special type
Chris PeBenito 13f000
##	will help address that goal.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	This also makes the type usable for files; thus an
Chris PeBenito 13f000
##	explicit call to files_type() is redundant.
Chris PeBenito 6cc3f3
##	

Chris PeBenito 6cc3f3
## </desc>
Chris PeBenito 6cc3f3
## <param name="script_file">
Chris PeBenito 6cc3f3
##	<summary>
Chris PeBenito 13f000
##	Type to be used for a script file.
Chris PeBenito 6cc3f3
##	</summary>
Chris PeBenito 6cc3f3
## </param>
Chris PeBenito 13f000
## <infoflow type="none"/>
Chris PeBenito 6cc3f3
#
Chris PeBenito 6cc3f3
interface(`init_script_file',`
Chris PeBenito 6cc3f3
	gen_require(`
Chris PeBenito 6cc3f3
		type initrc_t;
Chris PeBenito 6cc3f3
		attribute init_script_file_type, init_run_all_scripts_domain;
Chris PeBenito 6cc3f3
	')
Chris PeBenito 6cc3f3
Chris PeBenito 6cc3f3
	typeattribute $1 init_script_file_type;
Chris PeBenito 6cc3f3
Chris PeBenito 6cc3f3
	domain_entry_file(initrc_t, $1)
Chris PeBenito 6cc3f3
Chris PeBenito 6cc3f3
	domtrans_pattern(init_run_all_scripts_domain, $1, initrc_t)
Chris PeBenito 6cc3f3
')
Chris PeBenito 6cc3f3
Chris PeBenito 6cc3f3
########################################
Chris PeBenito 6cc3f3
## <summary>
Chris PeBenito 6cc3f3
##	Create a domain used for init scripts.
Chris PeBenito 6cc3f3
## </summary>
Chris PeBenito 6cc3f3
## <desc>
Chris PeBenito 6cc3f3
##	

Chris PeBenito 6cc3f3
##	Create a domain used for init scripts.
Chris PeBenito 6cc3f3
##	Can not be used in conjunction with
Chris PeBenito 6cc3f3
##	init_script_file().
Chris PeBenito 6cc3f3
##	

Chris PeBenito 6cc3f3
## </desc>
Chris PeBenito 6cc3f3
## <param name="domain">
Chris PeBenito 6cc3f3
##	<summary>
Chris PeBenito 6cc3f3
##	Type to be used as an init script domain.
Chris PeBenito 6cc3f3
##	</summary>
Chris PeBenito 6cc3f3
## </param>
Chris PeBenito 6cc3f3
## <param name="script_file">
Chris PeBenito 6cc3f3
##	<summary>
Chris PeBenito 6cc3f3
##	Type of the script file used as an entry point to this domain.
Chris PeBenito 6cc3f3
##	</summary>
Chris PeBenito 6cc3f3
## </param>
Chris PeBenito 6cc3f3
#
Chris PeBenito 6cc3f3
interface(`init_script_domain',`
Chris PeBenito 6cc3f3
	gen_require(`
Chris PeBenito 6cc3f3
		attribute init_script_domain_type, init_script_file_type;
Chris PeBenito 6cc3f3
		attribute init_run_all_scripts_domain;
Chris PeBenito 6cc3f3
	')
Chris PeBenito 6cc3f3
Chris PeBenito 6cc3f3
	typeattribute $1 init_script_domain_type;
Chris PeBenito 6cc3f3
	typeattribute $2 init_script_file_type;
Chris PeBenito 6cc3f3
Chris PeBenito 6cc3f3
	domain_type($1)
Chris PeBenito 6cc3f3
	domain_entry_file($1, $2)
Chris PeBenito 6cc3f3
Chris PeBenito 6cc3f3
	domtrans_pattern(init_run_all_scripts_domain, $2, $1)
Chris PeBenito 6cc3f3
')
Chris PeBenito 6cc3f3
Chris PeBenito 6cc3f3
########################################
Chris PeBenito 6cc3f3
## <summary>
Chris PeBenito 17de1b
##	Create a domain which can be started by init.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type to be used as a domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="entry_point">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_domain',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
		role system_r;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	domain_type($1)
Chris PeBenito 17de1b
	domain_entry_file($1,$2)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	role system_r types $1;
Chris PeBenito 17de1b
Dan Walsh 3eaa99
	tunable_policy(`init_systemd',`', `
Dan Walsh 3eaa99
		domtrans_pattern(init_t,$2,$1)
Dan Walsh 3eaa99
		allow init_t $1:unix_stream_socket create_stream_socket_perms;
Dan Walsh 3eaa99
		allow $1 init_t:unix_dgram_socket sendto;
Dan Walsh 3eaa99
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	ifdef(`hide_broken_symptoms',`
Chris PeBenito 17de1b
		# RHEL4 systems seem to have a stray
Chris PeBenito 17de1b
		# fds open from the initrd
Chris PeBenito 17de1b
		ifdef(`distro_rhel4',`
Chris PeBenito 17de1b
			kernel_dontaudit_use_fds($1)
Chris PeBenito 17de1b
		')
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito e070dd
##	Create a domain which can be started by init,
Chris PeBenito e070dd
##	with a range transition.
Chris PeBenito e070dd
## </summary>
Chris PeBenito e070dd
## <param name="domain">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type to be used as a domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="entry_point">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="range">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Range for the domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
#
Chris PeBenito e070dd
interface(`init_ranged_domain',`
Chris PeBenito e070dd
	gen_require(`
Chris PeBenito e070dd
		type init_t;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	init_domain($1,$2)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito e070dd
		range_transition init_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito e070dd
		range_transition init_t $2:process $3;
Chris PeBenito 2d0c9c
		mls_rangetrans_target($1)
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
')
Chris PeBenito e070dd
Chris PeBenito e070dd
########################################
Chris PeBenito e070dd
## <summary>
Chris PeBenito 17de1b
##	Create a domain for long running processes
Chris PeBenito 13f000
##	(daemons/services) which are started by init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 13f000
## <desc>
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	Create a domain for long running processes (daemons/services)
Chris PeBenito 13f000
##	which are started by init scripts. Short running processes
Chris PeBenito 13f000
##	should use the init_system_domain() interface instead.
Chris PeBenito 13f000
##	Typically all long running processes started by an init
Chris PeBenito 13f000
##	script (usually in /etc/init.d) will need to use this
Chris PeBenito 13f000
##	interface.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	The types will be made usable as a domain and file, making
Chris PeBenito 13f000
##	calls to domain_type() and files_type() redundant.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	If the process must also run in a specific MLS/MCS level,
Chris PeBenito 13f000
##	the init_ranged_daemon_domain() should be used instead.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
## </desc>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 13f000
##	Type to be used as a daemon domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="entry_point">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 13f000
## <infoflow type="read" weight="10"/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_daemon_domain',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute direct_run_init, direct_init, direct_init_entry;
Chris PeBenito 17de1b
		type initrc_t;
Dan Walsh 3eaa99
		type init_t;
Chris PeBenito 17de1b
		role system_r;
Chris PeBenito 693d4a
		attribute daemon;
Dan Walsh 3eaa99
		attribute initrc_transition_domain;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 693d4a
	typeattribute $1 daemon;
Chris PeBenito 693d4a
Chris PeBenito 17de1b
	domain_type($1)
Chris PeBenito 17de1b
	domain_entry_file($1,$2)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	role system_r types $1;
Chris PeBenito 17de1b
Chris PeBenito ab514d
	domtrans_pattern(initrc_t,$2,$1)
Dan Walsh 3eaa99
	allow initrc_t $1:process siginh;
Dan Walsh 3eaa99
	allow $1 initrc_transition_domain:fifo_file rw_inherited_fifo_file_perms;
Dan Walsh 3eaa99
	allow $1 initrc_transition_domain:fd use;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	tunable_policy(`init_upstart || init_systemd',`
Dan Walsh 3eaa99
		# Handle upstart direct transition to a executable
Dan Walsh 3eaa99
		domtrans_pattern(init_t,$2,$1)
Dan Walsh 3eaa99
		allow init_t $1:process siginh;
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	tunable_policy(`init_systemd',`
Dan Walsh 3eaa99
		allow init_t $1:unix_stream_socket create_stream_socket_perms;
Dan Walsh 3eaa99
		allow $1 init_t:unix_dgram_socket sendto;
Dan Walsh 3eaa99
	')
Chris PeBenito ab514d
Chris PeBenito a5f5eb
	# daemons started from init will
Chris PeBenito a5f5eb
	# inherit fds from init for the console
Chris PeBenito a5f5eb
	init_dontaudit_use_fds($1)
Chris PeBenito a5f5eb
	term_dontaudit_use_console($1)
Chris PeBenito a5f5eb
Chris PeBenito a5f5eb
	# init script ptys are the stdin/out/err 
Chris PeBenito a5f5eb
	# when using run_init
Chris PeBenito a5f5eb
	init_use_script_ptys($1)
Chris PeBenito a5f5eb
Chris PeBenito 17de1b
	ifdef(`direct_sysadm_daemon',`
Chris PeBenito c0868a
		domtrans_pattern(direct_run_init,$2,$1)
Chris PeBenito 17de1b
		allow direct_run_init $1:process { noatsecure siginh rlimitinh };
Chris PeBenito 17de1b
Chris PeBenito 17de1b
		typeattribute $1 direct_init;
Chris PeBenito 17de1b
		typeattribute $2 direct_init_entry;
Chris PeBenito 296273
Chris PeBenito 296273
		userdom_dontaudit_use_user_terminals($1)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	ifdef(`hide_broken_symptoms',`
Chris PeBenito 17de1b
		# RHEL4 systems seem to have a stray
Chris PeBenito 17de1b
		# fds open from the initrd
Chris PeBenito 17de1b
		ifdef(`distro_rhel4',`
Chris PeBenito 17de1b
			kernel_dontaudit_use_fds($1)
Chris PeBenito 17de1b
		')
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito 17de1b
		nscd_socket_use($1)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito e070dd
##	Create a domain for long running processes
Chris PeBenito 13f000
##	(daemons/services) which are started by init scripts,
Chris PeBenito 13f000
##	running at a specified MLS/MCS range.
Chris PeBenito e070dd
## </summary>
Chris PeBenito 13f000
## <desc>
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	Create a domain for long running processes (daemons/services)
Chris PeBenito 13f000
##	which are started by init scripts, running at a specified
Chris PeBenito 13f000
##	MLS/MCS range. Short running processes
Chris PeBenito 13f000
##	should use the init_ranged_system_domain() interface instead.
Chris PeBenito 13f000
##	Typically all long running processes started by an init
Chris PeBenito 13f000
##	script (usually in /etc/init.d) will need to use this
Chris PeBenito 13f000
##	interface if they need to run in a specific MLS/MCS range.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	The types will be made usable as a domain and file, making
Chris PeBenito 13f000
##	calls to domain_type() and files_type() redundant.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	If the policy build option TYPE is standard (MLS and MCS disabled),
Chris PeBenito 13f000
##	this interface has the same behavior as init_daemon_domain().
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
## </desc>
Chris PeBenito e070dd
## <param name="domain">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito 13f000
##	Type to be used as a daemon domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="entry_point">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="range">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito 13f000
##	MLS/MCS range for the domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito 13f000
## <infoflow type="read" weight="10"/>
Chris PeBenito e070dd
#
Chris PeBenito e070dd
interface(`init_ranged_daemon_domain',`
Chris PeBenito e070dd
	gen_require(`
Chris PeBenito e070dd
		type initrc_t;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Dan Walsh 3eaa99
#	init_daemon_domain($1,$2)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito e070dd
		range_transition initrc_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito e070dd
		range_transition initrc_t $2:process $3;
Chris PeBenito 2d0c9c
		mls_rangetrans_target($1)
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
')
Chris PeBenito e070dd
Chris PeBenito e070dd
########################################
Chris PeBenito e070dd
## <summary>
Chris PeBenito 17de1b
##	Create a domain for short running processes
Chris PeBenito 13f000
##	which are started by init scripts.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 13f000
## <desc>
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	Create a domain for long running processes (daemons/services)
Chris PeBenito 13f000
##	which are started by init scripts. These are generally applications that
Chris PeBenito 13f000
##	are used to initialize the system during boot.
Chris PeBenito 13f000
##	Long running processes
Chris PeBenito 13f000
##	should use the init_daemon_domain() interface instead.
Chris PeBenito 13f000
##	Typically all short running processes started by an init
Chris PeBenito 13f000
##	script (usually in /etc/init.d) will need to use this
Chris PeBenito 13f000
##	interface.  
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	The types will be made usable as a domain and file, making
Chris PeBenito 13f000
##	calls to domain_type() and files_type() redundant.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	If the process must also run in a specific MLS/MCS level,
Chris PeBenito 13f000
##	the init_ranged_system_domain() should be used instead.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
## </desc>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 13f000
##	Type to be used as a system domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="entry_point">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 13f000
## <infoflow type="read" weight="10"/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_system_domain',`
Chris PeBenito 17de1b
	gen_require(`
Dan Walsh 3eaa99
		type init_t;
Chris PeBenito 17de1b
		type initrc_t;
Chris PeBenito 17de1b
		role system_r;
Dan Walsh 3eaa99
		attribute initrc_transition_domain;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito d46cfe
	application_domain($1,$2)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	role system_r types $1;
Chris PeBenito 17de1b
Chris PeBenito c0868a
	domtrans_pattern(initrc_t,$2,$1)
Dan Walsh 3eaa99
	allow initrc_t $1:process siginh;
Dan Walsh 3eaa99
	allow $1 initrc_transition_domain:fifo_file rw_inherited_fifo_file_perms;
Dan Walsh 3eaa99
	allow $1 initrc_transition_domain:fd use;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	tunable_policy(`init_systemd',`
Dan Walsh 3eaa99
		# Handle upstart/systemd direct transition to a executable
Dan Walsh 3eaa99
		domtrans_pattern(init_t,$2,$1)
Dan Walsh 3eaa99
		allow init_t $1:process siginh;
Dan Walsh 3eaa99
		allow init_t $1:unix_stream_socket create_stream_socket_perms;
Dan Walsh 3eaa99
		allow $1 init_t:unix_dgram_socket sendto;
Dan Walsh 3eaa99
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	ifdef(`hide_broken_symptoms',`
Chris PeBenito 17de1b
		# RHEL4 systems seem to have a stray
Chris PeBenito 17de1b
		# fds open from the initrd
Chris PeBenito 17de1b
		ifdef(`distro_rhel4',`
Chris PeBenito 17de1b
			kernel_dontaudit_use_fds($1)
Chris PeBenito 17de1b
		')
Chris PeBenito 17de1b
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	userdom_dontaudit_search_user_home_dirs($1)
Dan Walsh 3eaa99
	userdom_dontaudit_rw_stream($1)
Dan Walsh 3eaa99
	userdom_dontaudit_write_user_tmp_files($1)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	tunable_policy(`allow_daemons_use_tty',`
Dan Walsh 3eaa99
	   term_use_all_ttys($1)
Dan Walsh 3eaa99
	   term_use_all_ptys($1)
Dan Walsh 3eaa99
	',`
Dan Walsh 3eaa99
	   term_dontaudit_use_all_ttys($1)
Dan Walsh 3eaa99
	   term_dontaudit_use_all_ptys($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	# these apps are often redirect output to random log files
Dan Walsh 3eaa99
	logging_inherit_append_all_logs($1)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		cron_rw_pipes($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		xserver_dontaudit_append_xdm_home_files($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		unconfined_dontaudit_rw_pipes($1)
Dan Walsh 3eaa99
		unconfined_dontaudit_rw_stream($1)
Dan Walsh 3eaa99
		userdom_dontaudit_read_user_tmp_files($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	init_rw_script_stream_sockets($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito e070dd
##	Create a domain for short running processes
Chris PeBenito 13f000
##	which are started by init scripts.
Chris PeBenito e070dd
## </summary>
Chris PeBenito 13f000
## <desc>
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	Create a domain for long running processes (daemons/services)
Chris PeBenito 13f000
##	which are started by init scripts.
Chris PeBenito 13f000
##	These are generally applications that
Chris PeBenito 13f000
##	are used to initialize the system during boot.
Chris PeBenito 13f000
##	Long running processes
Chris PeBenito 13f000
##	should use the init_ranged_system_domain() interface instead.
Chris PeBenito 13f000
##	Typically all short running processes started by an init
Chris PeBenito 13f000
##	script (usually in /etc/init.d) will need to use this
Chris PeBenito 13f000
##	interface if they need to run in a specific MLS/MCS range.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	The types will be made usable as a domain and file, making
Chris PeBenito 13f000
##	calls to domain_type() and files_type() redundant.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	If the policy build option TYPE is standard (MLS and MCS disabled),
Chris PeBenito 13f000
##	this interface has the same behavior as init_system_domain().
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
## </desc>
Chris PeBenito e070dd
## <param name="domain">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito 13f000
##	Type to be used as a system domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="entry_point">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Type of the program to be used as an entry point to this domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="range">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Range for the domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito 13f000
## <infoflow type="read" weight="10"/>
Chris PeBenito e070dd
#
Chris PeBenito e070dd
interface(`init_ranged_system_domain',`
Chris PeBenito e070dd
	gen_require(`
Chris PeBenito e070dd
		type initrc_t;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	init_system_domain($1,$2)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito 3ece11
		range_transition initrc_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito 3ece11
		range_transition initrc_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
')
Chris PeBenito e070dd
Chris PeBenito e070dd
########################################
Chris PeBenito e070dd
## <summary>
Chris PeBenito 17de1b
##	Execute init (/sbin/init) with a domain transition.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_domtrans',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t, init_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	domtrans_pattern($1, init_exec_t, init_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute the init program in the caller domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_exec',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 8021cb
	corecmd_search_bin($1)
Chris PeBenito 3f67f7
	can_exec($1, init_exec_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Get the process group of init.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_getpgid',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 init_t:process getpgid;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send init a null signal.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_signull',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 init_t:process signull;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send init a SIGCHLD signal.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`init_sigchld',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type init_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 init_t:process sigchld;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Inherit and use file descriptors from init.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 13f000
## <desc>
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	Allow the specified domain to inherit file
Chris PeBenito 13f000
##	descriptors from the init program (process ID 1).
Chris PeBenito 13f000
##	Typically the only file descriptors to be
Chris PeBenito 13f000
##	inherited from init are for the console.
Chris PeBenito 13f000
##	This does not allow the domain any access to
Chris PeBenito 13f000
##	the object to which the file descriptors references.
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	Related interfaces:
Chris PeBenito 13f000
##	

Chris PeBenito 13f000
##	
    Chris PeBenito 13f000
    ##		
  • init_dontaudit_use_fds()
  • Chris PeBenito 13f000
    ##		
  • term_dontaudit_use_console()
  • Chris PeBenito 13f000
    ##		
  • term_use_console()
  • Chris PeBenito 13f000
    ##	
    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	Example usage:
    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	init_use_fds(mydomain_t)
    Chris PeBenito 13f000
    ##	term_use_console(mydomain_t)
    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	Normally, processes that can inherit these file
    Chris PeBenito 13f000
    ##	descriptors (usually services) write messages to the
    Chris PeBenito 13f000
    ##	system log instead of writing to the console.
    Chris PeBenito 13f000
    ##	Therefore, in many cases, this access should
    Chris PeBenito 13f000
    ##	dontaudited instead.
    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	Example dontaudit usage:
    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ##	init_dontaudit_use_fds(mydomain_t)
    Chris PeBenito 13f000
    ##	term_dontaudit_use_console(mydomain_t)
    Chris PeBenito 13f000
    ##	

    Chris PeBenito 13f000
    ## </desc>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 13f000
    ## <infoflow type="read" weight="1"/>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_use_fds',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type init_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 init_t:fd use;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to inherit file
    Chris PeBenito 17de1b
    ##	descriptors from init.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_use_fds',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type init_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 init_t:fd use;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 33c7e6
    ##	Send UDP network traffic to init.  (Deprecated)
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_udp_send',`
    Chris PeBenito 33c7e6
    	refpolicywarn(`$0($*) has been deprecated.')
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Get the attributes of initctl.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_getattr_initctl',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initctl_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initctl_t:fifo_file getattr;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to get the
    Chris PeBenito 17de1b
    ##	attributes of initctl.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_getattr_initctl',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initctl_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 initctl_t:fifo_file getattr;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Write to initctl.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_write_initctl',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initctl_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dev_list_all_dev_nodes($1)
    Chris PeBenito 17de1b
    	allow $1 initctl_t:fifo_file write;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito bbcd3c
    ##	Use telinit (Read and write initctl).
    Chris PeBenito bbcd3c
    ## </summary>
    Chris PeBenito bbcd3c
    ## <param name="domain">
    Chris PeBenito bbcd3c
    ##	<summary>
    Chris PeBenito bbcd3c
    ##	Domain allowed access.
    Chris PeBenito bbcd3c
    ##	</summary>
    Chris PeBenito bbcd3c
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito bbcd3c
    #
    Chris PeBenito bbcd3c
    interface(`init_telinit',`
    Chris PeBenito bbcd3c
    	gen_require(`
    Chris PeBenito bbcd3c
    		type initctl_t;
    Chris PeBenito bbcd3c
    	')
    Chris PeBenito bbcd3c
    Dan Walsh 3eaa99
    	corecmd_exec_bin($1)
    Dan Walsh 3eaa99
    Chris PeBenito bbcd3c
    	dev_list_all_dev_nodes($1)
    Chris PeBenito c0868a
    	allow $1 initctl_t:fifo_file rw_fifo_file_perms;
    Chris PeBenito ca448b
    Chris PeBenito ca448b
    	init_exec($1)
    Chris PeBenito 4459a7
    Dan Walsh 3eaa99
    	tunable_policy(`init_upstart || init_systemd',`
    Chris PeBenito 4459a7
    		gen_require(`
    Chris PeBenito 4459a7
    			type init_t;
    Chris PeBenito 4459a7
    		')
    Chris PeBenito 4459a7
    Dan Walsh f5b49a
    		allow $1 init_t:process signal;
    Chris PeBenito 4459a7
    		# upstart uses a datagram socket instead of initctl pipe
    Chris PeBenito 4459a7
    		allow $1 self:unix_dgram_socket create_socket_perms;
    Chris PeBenito 4459a7
    		allow $1 init_t:unix_dgram_socket sendto;
    Dan Walsh 3eaa99
    		#576913
    Dan Walsh 3eaa99
    		allow $1 init_t:unix_stream_socket connectto;
    Chris PeBenito 4459a7
    	')
    Chris PeBenito bbcd3c
    ')
    Chris PeBenito bbcd3c
    Chris PeBenito bbcd3c
    ########################################
    Chris PeBenito bbcd3c
    ## <summary>
    Chris PeBenito 17de1b
    ##	Read and write initctl.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_rw_initctl',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initctl_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dev_list_all_dev_nodes($1)
    Chris PeBenito c0868a
    	allow $1 initctl_t:fifo_file rw_fifo_file_perms;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to read and
    Chris PeBenito 17de1b
    ##	write initctl.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_rw_initctl',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initctl_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 initctl_t:fifo_file { read write };
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Make init scripts an entry point for
    Chris PeBenito 17de1b
    ##	the specified domain.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    # cjp: added for gentoo integrated run_init
    Chris PeBenito 17de1b
    interface(`init_script_file_entry_type',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_exec_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 3f67f7
    	domain_entry_file($1, initrc_exec_t)
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 93ddc6
    ##	Execute init scripts with a specified domain transition.
    Chris PeBenito 93ddc6
    ## </summary>
    Chris PeBenito 93ddc6
    ## <param name="domain">
    Chris PeBenito 93ddc6
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain allowed to transition.
    Chris PeBenito 93ddc6
    ##	</summary>
    Chris PeBenito 93ddc6
    ## </param>
    Chris PeBenito 93ddc6
    #
    Chris PeBenito 93ddc6
    interface(`init_spec_domtrans_script',`
    Chris PeBenito 93ddc6
    	gen_require(`
    Dan Walsh 3eaa99
    		type initrc_t;
    Dan Walsh 3eaa99
    		attribute init_script_file_type;
    Chris PeBenito 93ddc6
    	')
    Chris PeBenito 93ddc6
    Chris PeBenito 93ddc6
    	files_list_etc($1)
    Dan Walsh 3eaa99
    	spec_domtrans_pattern($1, init_script_file_type, initrc_t)
    Chris PeBenito 93ddc6
    Chris PeBenito 93ddc6
    	ifdef(`enable_mcs',`
    Dan Walsh 3eaa99
    		range_transition $1 init_script_file_type:process s0;
    Chris PeBenito 93ddc6
    	')
    Chris PeBenito 93ddc6
    Chris PeBenito 93ddc6
    	ifdef(`enable_mls',`
    Dan Walsh 3eaa99
    		range_transition $1 init_script_file_type:process s0 - mls_systemhigh;
    Chris PeBenito 93ddc6
    	')
    Chris PeBenito 93ddc6
    ')
    Chris PeBenito 93ddc6
    Chris PeBenito 93ddc6
    ########################################
    Chris PeBenito 93ddc6
    ## <summary>
    Chris PeBenito 93ddc6
    ##	Execute init scripts with an automatic domain transition.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain allowed to transition.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_domtrans_script',`
    Chris PeBenito 17de1b
    	gen_require(`
    Dan Walsh 3eaa99
    		type initrc_t;
    Dan Walsh 3eaa99
    		attribute init_script_file_type;
    Dan Walsh 3eaa99
    		attribute initrc_transition_domain;
    Chris PeBenito 17de1b
    	')
    Dan Walsh 3eaa99
    	typeattribute $1 initrc_transition_domain;
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_list_etc($1)
    Dan Walsh 3eaa99
    	domtrans_pattern($1, init_script_file_type, initrc_t)
    Chris PeBenito e070dd
    Chris PeBenito e070dd
    	ifdef(`enable_mcs',`
    Dan Walsh 3eaa99
    		range_transition $1 init_script_file_type:process s0;
    Chris PeBenito e070dd
    	')
    Chris PeBenito e070dd
    Chris PeBenito e070dd
    	ifdef(`enable_mls',`
    Dan Walsh 3eaa99
    		range_transition $1 init_script_file_type:process s0 - mls_systemhigh;
    Chris PeBenito e070dd
    	')
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Dan Walsh 3eaa99
    ##	Execute a file in a bin directory
    Dan Walsh 3eaa99
    ##	in the initrc_t domain 
    Dan Walsh 3eaa99
    ## </summary>
    Dan Walsh 3eaa99
    ## <param name="domain">
    Dan Walsh 3eaa99
    ##	<summary>
    Dan Walsh 3eaa99
    ##	Domain allowed access.
    Dan Walsh 3eaa99
    ##	</summary>
    Dan Walsh 3eaa99
    ## </param>
    Dan Walsh 3eaa99
    #
    Dan Walsh 3eaa99
    interface(`init_bin_domtrans_spec',`
    Dan Walsh 3eaa99
    	gen_require(`
    Dan Walsh 3eaa99
    		type initrc_t;
    Dan Walsh 3eaa99
    	')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    	corecmd_bin_domtrans($1, initrc_t)
    Dan Walsh 3eaa99
    ')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    ########################################
    Dan Walsh 3eaa99
    ## <summary>
    Chris PeBenito 17de1b
    ##	Execute a init script in a specified domain.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <desc>
    Chris PeBenito ff8f0a
    ##	

    Chris PeBenito 17de1b
    ##	Execute a init script in a specified domain.
    Chris PeBenito ff8f0a
    ##	

    Chris PeBenito ff8f0a
    ##	

    Chris PeBenito ff8f0a
    ##	No interprocess communication (signals, pipes,
    Chris PeBenito ff8f0a
    ##	etc.) is provided by this interface since
    Chris PeBenito ff8f0a
    ##	the domains are not owned by this module.
    Chris PeBenito ff8f0a
    ##	

    Chris PeBenito 17de1b
    ## </desc>
    Chris PeBenito 17de1b
    ## <param name="source_domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain allowed to transition.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    ## <param name="target_domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain to transition to.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    # cjp: added for gentoo integrated run_init
    Chris PeBenito 17de1b
    interface(`init_script_file_domtrans',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_exec_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_list_etc($1)
    Chris PeBenito 3f67f7
    	domain_auto_trans($1, initrc_exec_t,$2)
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 64c5b9
    ##	Transition to the init script domain
    Chris PeBenito 64c5b9
    ##	on a specified labeled init script.
    Chris PeBenito 64c5b9
    ## </summary>
    Chris PeBenito 64c5b9
    ## <param name="domain">
    Chris PeBenito 64c5b9
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain allowed to transition.
    Chris PeBenito 64c5b9
    ##	</summary>
    Chris PeBenito 64c5b9
    ## </param>
    Chris PeBenito 64c5b9
    ## <param name="init_script_file">
    Chris PeBenito 64c5b9
    ##	<summary>
    Chris PeBenito 64c5b9
    ##	Labeled init script file.
    Chris PeBenito 64c5b9
    ##	</summary>
    Chris PeBenito 64c5b9
    ## </param>
    Chris PeBenito 64c5b9
    #
    Chris PeBenito 64c5b9
    interface(`init_labeled_script_domtrans',`
    Chris PeBenito 64c5b9
    	gen_require(`
    Chris PeBenito 64c5b9
    		type initrc_t;
    Dan Walsh 3eaa99
    		attribute initrc_transition_domain;
    Chris PeBenito 64c5b9
    	')
    Chris PeBenito 64c5b9
    Dan Walsh 3eaa99
    	typeattribute $1 initrc_transition_domain;
    Dan Walsh 818734
    	# service script searches all filesystems via mountpoint
    Dan Walsh 818734
    	fs_search_all($1)
    Chris PeBenito 64c5b9
    	domtrans_pattern($1, $2, initrc_t)
    Chris PeBenito 64c5b9
    	files_search_etc($1)
    Chris PeBenito 64c5b9
    ')
    Chris PeBenito 64c5b9
    Craig Grube e87791
    #########################################
    Craig Grube e87791
    ## <summary>
    Craig Grube e87791
    ##	Transition to the init script domain
    Craig Grube e87791
    ## 	for all labeled init script types
    Craig Grube e87791
    ## </summary>
    Craig Grube e87791
    ## <param name="domain">
    Craig Grube e87791
    ## 	<summary>
    Dominick Grift a0546c
    ##	Domain allowed to transition.
    Craig Grube e87791
    ##	</summary>
    Craig Grube e87791
    ## </param>
    Chris PeBenito e6d8fd
    #
    Craig Grube e87791
    interface(`init_all_labeled_script_domtrans',`
    Craig Grube e87791
    	gen_require(`
    Craig Grube e87791
    		attribute init_script_file_type;
    Craig Grube e87791
    	')
    Craig Grube e87791
    Craig Grube e87791
    	init_labeled_script_domtrans($1, init_script_file_type)
    Craig Grube e87791
    ')
    Craig Grube e87791
    Chris PeBenito 64c5b9
    ########################################
    Chris PeBenito 64c5b9
    ## <summary>
    Chris PeBenito 17de1b
    ##	Start and stop daemon programs directly.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <desc>
    Chris PeBenito 17de1b
    ##	

    Chris PeBenito 17de1b
    ##	Start and stop daemon programs directly
    Chris PeBenito 17de1b
    ##	in the traditional "/etc/init.d/daemon start"
    Chris PeBenito 17de1b
    ##	style, and do not require run_init.
    Chris PeBenito 17de1b
    ##	

    Chris PeBenito 17de1b
    ## </desc>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    ## <param name="role">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	The role to be performing this action.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_run_daemon',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		attribute direct_run_init, direct_init, direct_init_entry;
    Chris PeBenito 17de1b
    		role system_r;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	typeattribute $1 direct_run_init;
    Chris PeBenito 17de1b
    	role_transition $2 direct_init_entry system_r;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 36095d
    ########################################
    Chris PeBenito 36095d
    ## <summary>
    Chris PeBenito 36095d
    ##	Read the process state (/proc/pid) of init.
    Chris PeBenito 36095d
    ## </summary>
    Chris PeBenito 36095d
    ## <param name="domain">
    Chris PeBenito 36095d
    ##	<summary>
    Chris PeBenito 36095d
    ##	Domain allowed access.
    Chris PeBenito 36095d
    ##	</summary>
    Chris PeBenito 36095d
    ## </param>
    Chris PeBenito 36095d
    #
    Chris PeBenito 36095d
    interface(`init_read_state',`
    Chris PeBenito 36095d
    	gen_require(`
    Chris PeBenito 36095d
    		attribute init_t;
    Chris PeBenito 36095d
    	')
    Chris PeBenito 36095d
    Chris PeBenito 36095d
    	allow $1 init_t:dir search_dir_perms;
    Chris PeBenito 36095d
    	allow $1 init_t:file read_file_perms;
    Chris PeBenito 0b36a2
    	allow $1 init_t:lnk_file read_lnk_file_perms;
    Chris PeBenito 36095d
    ')
    Chris PeBenito 36095d
    Chris PeBenito 36095d
    ########################################
    Chris PeBenito 36095d
    ## <summary>
    Chris PeBenito 36095d
    ##	Ptrace init
    Chris PeBenito 36095d
    ## </summary>
    Chris PeBenito 36095d
    ## <param name="domain">
    Chris PeBenito 36095d
    ##	<summary>
    Chris PeBenito 36095d
    ##	Domain allowed access.
    Chris PeBenito 36095d
    ##	</summary>
    Chris PeBenito 36095d
    ## </param>
    Chris PeBenito 36095d
    ## <rolecap/>
    Chris PeBenito 36095d
    #
    Chris PeBenito 36095d
    interface(`init_ptrace',`
    Chris PeBenito 36095d
    	gen_require(`
    Chris PeBenito 36095d
    		attribute init_t;
    Chris PeBenito 36095d
    	')
    Chris PeBenito 36095d
    Chris PeBenito 36095d
    	allow $1 init_t:process ptrace;
    Chris PeBenito 36095d
    ')
    Chris PeBenito 36095d
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Write an init script unnamed pipe.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_write_script_pipes',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:fifo_file write;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Get the attribute of init script entrypoint files.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_getattr_script_files',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_exec_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_list_etc($1)
    Chris PeBenito 17de1b
    	allow $1 initrc_exec_t:file getattr;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 6cc3f3
    ##	Read init scripts.
    Chris PeBenito 6cc3f3
    ## </summary>
    Chris PeBenito 6cc3f3
    ## <param name="domain">
    Chris PeBenito 6cc3f3
    ##	<summary>
    Chris PeBenito 6cc3f3
    ##	Domain allowed access.
    Chris PeBenito 6cc3f3
    ##	</summary>
    Chris PeBenito 6cc3f3
    ## </param>
    Chris PeBenito 6cc3f3
    #
    Chris PeBenito 6cc3f3
    interface(`init_read_script_files',`
    Chris PeBenito 6cc3f3
    	gen_require(`
    Chris PeBenito 6cc3f3
    		type initrc_exec_t;
    Chris PeBenito 6cc3f3
    	')
    Chris PeBenito 6cc3f3
    Chris PeBenito 6cc3f3
    	files_search_etc($1)
    Chris PeBenito 6cc3f3
    	allow $1 initrc_exec_t:file read_file_perms;
    Chris PeBenito 6cc3f3
    ')
    Chris PeBenito 6cc3f3
    Chris PeBenito 6cc3f3
    ########################################
    Chris PeBenito 6cc3f3
    ## <summary>
    Chris PeBenito 17de1b
    ##	Execute init scripts in the caller domain.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_exec_script_files',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_exec_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_list_etc($1)
    Chris PeBenito 3f67f7
    	can_exec($1, initrc_exec_t)
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 6cc3f3
    ##	Get the attribute of all init script entrypoint files.
    Chris PeBenito 6cc3f3
    ## </summary>
    Chris PeBenito 6cc3f3
    ## <param name="domain">
    Chris PeBenito 6cc3f3
    ##	<summary>
    Chris PeBenito 6cc3f3
    ##	Domain allowed access.
    Chris PeBenito 6cc3f3
    ##	</summary>
    Chris PeBenito 6cc3f3
    ## </param>
    Chris PeBenito 6cc3f3
    #
    Chris PeBenito 6cc3f3
    interface(`init_getattr_all_script_files',`
    Chris PeBenito 6cc3f3
    	gen_require(`
    Chris PeBenito 6cc3f3
    		attribute init_script_file_type;
    Chris PeBenito 6cc3f3
    	')
    Chris PeBenito 6cc3f3
    Chris PeBenito 6cc3f3
    	files_list_etc($1)
    Chris PeBenito 6cc3f3
    	allow $1 init_script_file_type:file getattr;
    Chris PeBenito 6cc3f3
    ')
    Chris PeBenito 6cc3f3
    Chris PeBenito 6cc3f3
    ########################################
    Chris PeBenito 6cc3f3
    ## <summary>
    Chris PeBenito 6cc3f3
    ##	Read all init script files.
    Chris PeBenito 6cc3f3
    ## </summary>
    Chris PeBenito 6cc3f3
    ## <param name="domain">
    Chris PeBenito 6cc3f3
    ##	<summary>
    Chris PeBenito 6cc3f3
    ##	Domain allowed access.
    Chris PeBenito 6cc3f3
    ##	</summary>
    Chris PeBenito 6cc3f3
    ## </param>
    Chris PeBenito 6cc3f3
    #
    Chris PeBenito 6cc3f3
    interface(`init_read_all_script_files',`
    Chris PeBenito 6cc3f3
    	gen_require(`
    Chris PeBenito 6cc3f3
    		attribute init_script_file_type;
    Chris PeBenito 6cc3f3
    	')
    Chris PeBenito 6cc3f3
    Chris PeBenito 6cc3f3
    	files_search_etc($1)
    Chris PeBenito 6cc3f3
    	allow $1 init_script_file_type:file read_file_perms;
    Chris PeBenito 6cc3f3
    ')
    Chris PeBenito 6cc3f3
    Chris PeBenito ddd786
    #######################################
    Chris PeBenito ddd786
    ## <summary>
    Chris PeBenito ddd786
    ##	Dontaudit read all init script files.
    Chris PeBenito ddd786
    ## </summary>
    Chris PeBenito ddd786
    ## <param name="domain">
    Chris PeBenito ddd786
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain to not audit.
    Chris PeBenito ddd786
    ##	</summary>
    Chris PeBenito ddd786
    ## </param>
    Chris PeBenito ddd786
    #
    Chris PeBenito ddd786
    interface(`init_dontaudit_read_all_script_files',`
    Chris PeBenito ddd786
    	gen_require(`
    Chris PeBenito ddd786
    		attribute init_script_file_type;
    Chris PeBenito ddd786
    	')
    Chris PeBenito ddd786
    Chris PeBenito ddd786
    	dontaudit $1 init_script_file_type:file read_file_perms;
    Chris PeBenito ddd786
    ')
    Chris PeBenito ddd786
    Chris PeBenito 6cc3f3
    ########################################
    Chris PeBenito 6cc3f3
    ## <summary>
    Chris PeBenito 6cc3f3
    ##	Execute all init scripts in the caller domain.
    Chris PeBenito 6cc3f3
    ## </summary>
    Chris PeBenito 6cc3f3
    ## <param name="domain">
    Chris PeBenito 6cc3f3
    ##	<summary>
    Chris PeBenito 6cc3f3
    ##	Domain allowed access.
    Chris PeBenito 6cc3f3
    ##	</summary>
    Chris PeBenito 6cc3f3
    ## </param>
    Chris PeBenito 6cc3f3
    #
    Chris PeBenito 6cc3f3
    interface(`init_exec_all_script_files',`
    Chris PeBenito 6cc3f3
    	gen_require(`
    Chris PeBenito 6cc3f3
    		attribute init_script_file_type;
    Chris PeBenito 6cc3f3
    	')
    Chris PeBenito 6cc3f3
    Chris PeBenito 6cc3f3
    	files_list_etc($1)
    Chris PeBenito 6cc3f3
    	can_exec($1, init_script_file_type)
    Chris PeBenito 6cc3f3
    ')
    Chris PeBenito 6cc3f3
    Chris PeBenito 6cc3f3
    ########################################
    Chris PeBenito 6cc3f3
    ## <summary>
    Chris PeBenito 17de1b
    ##	Read the process state (/proc/pid) of the init scripts.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_read_script_state',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito c0868a
    	kernel_search_proc($1)
    Chris PeBenito 3f67f7
    	read_files_pattern($1, initrc_t, initrc_t)
    Chris PeBenito 3f67f7
    	read_lnk_files_pattern($1, initrc_t, initrc_t)
    Chris PeBenito 3f67f7
    	list_dirs_pattern($1, initrc_t, initrc_t)
    Chris PeBenito c0868a
    Chris PeBenito c0868a
    	# should move this to separate interface
    Chris PeBenito 17de1b
    	allow $1 initrc_t:process getattr;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Inherit and use init script file descriptors.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_use_script_fds',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:fd use;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to inherit
    Chris PeBenito 17de1b
    ##	init script file descriptors.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_use_script_fds',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 initrc_t:fd use;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Get the process group ID of init scripts.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_getpgid_script',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:process getpgid;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Send SIGCHLD signals to init scripts.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_sigchld_script',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:process sigchld;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Send generic signals to init scripts.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_signal_script',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:process signal;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Send null signals to init scripts.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_signull_script',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:process signull;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Read and write init script unnamed pipes.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_rw_script_pipes',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:fifo_file { read write };
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 33c7e6
    ##	Send UDP network traffic to init scripts.  (Deprecated)
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_udp_send_script',`
    Chris PeBenito 33c7e6
    	refpolicywarn(`$0($*) has been deprecated.')
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Allow the specified domain to connect to
    Chris PeBenito 17de1b
    ##	init scripts with a unix socket.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_stream_connect_script',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:unix_stream_socket connectto;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Allow the specified domain to read/write to
    Chris PeBenito 17de1b
    ##	init scripts with a unix domain stream sockets.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_rw_script_stream_sockets',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito ddd786
    	allow $1 initrc_t:unix_stream_socket rw_socket_perms;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Dont audit the specified domain connecting to
    Chris PeBenito 17de1b
    ##	init scripts with a unix domain stream socket.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_stream_connect_script',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 initrc_t:unix_stream_socket connectto;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 350b6a
    ########################################
    Chris PeBenito 350b6a
    ## <summary>
    Chris PeBenito 350b6a
    ##	Send messages to init scripts over dbus.
    Chris PeBenito 350b6a
    ## </summary>
    Chris PeBenito 350b6a
    ## <param name="domain">
    Chris PeBenito 350b6a
    ##	<summary>
    Chris PeBenito 350b6a
    ##	Domain allowed access.
    Chris PeBenito 350b6a
    ##	</summary>
    Chris PeBenito 350b6a
    ## </param>
    Chris PeBenito 350b6a
    #
    Chris PeBenito 350b6a
    interface(`init_dbus_send_script',`
    Chris PeBenito 350b6a
    	gen_require(`
    Chris PeBenito 350b6a
    		type initrc_t;
    Chris PeBenito 350b6a
    		class dbus send_msg;
    Chris PeBenito 350b6a
    	')
    Chris PeBenito 350b6a
    Chris PeBenito 350b6a
    	allow $1 initrc_t:dbus send_msg;
    Chris PeBenito 350b6a
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Send and receive messages from
    Dan Walsh 3eaa99
    ##	init over dbus.
    Dan Walsh 3eaa99
    ## </summary>
    Dan Walsh 3eaa99
    ## <param name="domain">
    Dan Walsh 3eaa99
    ##	<summary>
    Dan Walsh 3eaa99
    ##	Domain allowed access.
    Dan Walsh 3eaa99
    ##	</summary>
    Dan Walsh 3eaa99
    ## </param>
    Dan Walsh 3eaa99
    #
    Dan Walsh 3eaa99
    interface(`init_dbus_chat',`
    Dan Walsh 3eaa99
    	gen_require(`
    Dan Walsh 3eaa99
    		type init_t;
    Dan Walsh 3eaa99
    		class dbus send_msg;
    Dan Walsh 3eaa99
    	')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    	allow $1 init_t:dbus send_msg;
    Dan Walsh 3eaa99
    	allow init_t $1:dbus send_msg;
    Dan Walsh 3eaa99
    ')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    ########################################
    Dan Walsh 3eaa99
    ## <summary>
    Dan Walsh 3eaa99
    ##	Send and receive messages from
    Chris PeBenito 17de1b
    ##	init scripts over dbus.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dbus_chat_script',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_t;
    Chris PeBenito 17de1b
    		class dbus send_msg;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_t:dbus send_msg;
    Chris PeBenito 17de1b
    	allow initrc_t $1:dbus send_msg;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Read and write the init script pty.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <desc>
    Chris PeBenito 17de1b
    ##	

    Chris PeBenito 17de1b
    ##	Read and write the init script pty.  This
    Chris PeBenito 17de1b
    ##	pty is generally opened by the open_init_pty
    Chris PeBenito 17de1b
    ##	portion of the run_init program so that the
    Chris PeBenito 17de1b
    ##	daemon does not require direct access to
    Chris PeBenito 17de1b
    ##	the administrator terminal.
    Chris PeBenito 17de1b
    ##	

    Chris PeBenito 17de1b
    ## </desc>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_use_script_ptys',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_devpts_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	term_list_ptys($1)
    Chris PeBenito 17de1b
    	allow $1 initrc_devpts_t:chr_file { rw_term_perms lock append };
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to read and
    Chris PeBenito 17de1b
    ##	write the init script pty.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_use_script_ptys',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_devpts_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 initrc_devpts_t:chr_file { rw_term_perms lock append };
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito ed38ca
    ##	Get the attributes of init script
    Chris PeBenito ed38ca
    ##	status files.
    Chris PeBenito ed38ca
    ## </summary>
    Chris PeBenito ed38ca
    ## <param name="domain">
    Chris PeBenito ed38ca
    ##	<summary>
    Chris PeBenito ed38ca
    ##	Domain allowed access.
    Chris PeBenito ed38ca
    ##	</summary>
    Chris PeBenito ed38ca
    ## </param>
    Chris PeBenito ed38ca
    #
    Chris PeBenito ed38ca
    interface(`init_getattr_script_status_files',`
    Chris PeBenito ed38ca
    	gen_require(`
    Chris PeBenito ed38ca
    		type initrc_state_t;
    Chris PeBenito ed38ca
    	')
    Chris PeBenito ed38ca
    Chris PeBenito 3f67f7
    	getattr_files_pattern($1, initrc_state_t, initrc_state_t)
    Chris PeBenito ed38ca
    ')
    Chris PeBenito ed38ca
    Chris PeBenito ed38ca
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Dan Walsh 3034a8
    ##	Manage init script
    Dan Walsh 3034a8
    ##	status files.
    Dan Walsh 3034a8
    ## </summary>
    Dan Walsh 3034a8
    ## <param name="domain">
    Dan Walsh 3034a8
    ##	<summary>
    Dan Walsh 3034a8
    ##	Domain allowed access.
    Dan Walsh 3034a8
    ##	</summary>
    Dan Walsh 3034a8
    ## </param>
    Dan Walsh 3034a8
    #
    Dan Walsh 3034a8
    interface(`init_manage_script_status_files',`
    Dan Walsh 3034a8
    	gen_require(`
    Dan Walsh 3034a8
    		type initrc_state_t;
    Dan Walsh 3034a8
    	')
    Dan Walsh 3034a8
    Dan Walsh 3034a8
    	manage_files_pattern($1, initrc_state_t, initrc_state_t)
    Dan Walsh 3034a8
    ')
    Dan Walsh 3034a8
    Dan Walsh 3034a8
    ########################################
    Dan Walsh 3034a8
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to read init script
    Chris PeBenito 17de1b
    ##	status files.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_read_script_status_files',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_state_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 initrc_state_t:dir search_dir_perms;
    Chris PeBenito 17de1b
    	dontaudit $1 initrc_state_t:file read_file_perms;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito ddd786
    ##	Read init script temporary data.
    Chris PeBenito ddd786
    ## </summary>
    Chris PeBenito ddd786
    ## <param name="domain">
    Chris PeBenito ddd786
    ##	<summary>
    Chris PeBenito ddd786
    ##	Domain allowed access.
    Chris PeBenito ddd786
    ##	</summary>
    Chris PeBenito ddd786
    ## </param>
    Chris PeBenito ddd786
    #
    Chris PeBenito ddd786
    interface(`init_read_script_tmp_files',`
    Chris PeBenito ddd786
    	gen_require(`
    Chris PeBenito ddd786
    		type initrc_tmp_t;
    Chris PeBenito ddd786
    	')
    Chris PeBenito ddd786
    Chris PeBenito ddd786
    	files_search_tmp($1)
    Chris PeBenito ddd786
    	read_files_pattern($1, initrc_tmp_t, initrc_tmp_t)
    Chris PeBenito ddd786
    ')
    Chris PeBenito ddd786
    Chris PeBenito ddd786
    ########################################
    Chris PeBenito ddd786
    ## <summary>
    Chris PeBenito 17de1b
    ##	Read and write init script temporary data.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_rw_script_tmp_files',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_tmp_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_search_tmp($1)
    Chris PeBenito 3f67f7
    	rw_files_pattern($1, initrc_tmp_t, initrc_tmp_t)
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Create files in a init script
    Chris PeBenito 17de1b
    ##	temporary data directory.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    ## <param name="file_type">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	The type of the object to be created
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    ## <param name="object_class">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	The object class.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_script_tmp_filetrans',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_tmp_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_search_tmp($1)
    Chris PeBenito 3f67f7
    	filetrans_pattern($1, initrc_tmp_t, $2, $3)
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Get the attributes of init script process id files.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_getattr_utmp',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_var_run_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	allow $1 initrc_var_run_t:file getattr;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Read utmp.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_read_utmp',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_var_run_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_list_pids($1)
    Chris PeBenito c0868a
    	allow $1 initrc_var_run_t:file read_file_perms;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to write utmp.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_write_utmp',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_var_run_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 initrc_var_run_t:file { write lock };
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Write to utmp.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_write_utmp',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_var_run_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_list_pids($1)
    Chris PeBenito 82d277
    	allow $1 initrc_var_run_t:file { getattr open write };
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to lock 
    Chris PeBenito 17de1b
    ##	init script pid files.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_lock_utmp',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_var_run_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	dontaudit $1 initrc_var_run_t:file lock;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Read and write utmp.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Chris PeBenito 17de1b
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_rw_utmp',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_var_run_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_list_pids($1)
    Chris PeBenito 17de1b
    	allow $1 initrc_var_run_t:file rw_file_perms;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito 17de1b
    ##	Do not audit attempts to read and write utmp.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain to not audit.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_dontaudit_rw_utmp',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_var_run_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Dan Walsh 3eaa99
    	dontaudit $1 initrc_var_run_t:file rw_file_perms;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    ########################################
    Chris PeBenito 17de1b
    ## <summary>
    Chris PeBenito ff8f0a
    ##	Create, read, write, and delete utmp.
    Chris PeBenito 17de1b
    ## </summary>
    Chris PeBenito 17de1b
    ## <param name="domain">
    Chris PeBenito 17de1b
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain allowed access.
    Chris PeBenito 17de1b
    ##	</summary>
    Chris PeBenito 17de1b
    ## </param>
    Chris PeBenito 17de1b
    #
    Chris PeBenito 17de1b
    interface(`init_manage_utmp',`
    Chris PeBenito 17de1b
    	gen_require(`
    Chris PeBenito 17de1b
    		type initrc_var_run_t;
    Chris PeBenito 17de1b
    	')
    Chris PeBenito 17de1b
    Chris PeBenito 17de1b
    	files_search_pids($1)
    Chris PeBenito c0868a
    	allow $1 initrc_var_run_t:file manage_file_perms;
    Chris PeBenito 17de1b
    ')
    Chris PeBenito dc1920
    Chris PeBenito dc1920
    ########################################
    Chris PeBenito dc1920
    ## <summary>
    Chris PeBenito 296273
    ##	Create files in /var/run with the
    Chris PeBenito 296273
    ##	utmp file type.
    Chris PeBenito 296273
    ## </summary>
    Chris PeBenito 296273
    ## <param name="domain">
    Chris PeBenito 296273
    ##	<summary>
    Dominick Grift a0546c
    ##	Domain allowed access.
    Chris PeBenito 296273
    ##	</summary>
    Chris PeBenito 296273
    ## </param>
    Chris PeBenito 296273
    #
    Chris PeBenito 296273
    interface(`init_pid_filetrans_utmp',`
    Chris PeBenito 296273
    	gen_require(`
    Chris PeBenito 296273
    		type initrc_var_run_t;
    Chris PeBenito 296273
    	')
    Chris PeBenito 296273
    Chris PeBenito 296273
    	files_pid_filetrans($1, initrc_var_run_t, file)
    Chris PeBenito 296273
    ')
    Chris PeBenito 296273
    Chris PeBenito 296273
    ########################################
    Chris PeBenito 296273
    ## <summary>
    Chris PeBenito dc1920
    ##	Allow the specified domain to connect to daemon with a tcp socket
    Chris PeBenito dc1920
    ## </summary>
    Chris PeBenito dc1920
    ## <param name="domain">
    Chris PeBenito dc1920
    ##	<summary>
    Chris PeBenito dc1920
    ##	Domain allowed access.
    Chris PeBenito dc1920
    ##	</summary>
    Chris PeBenito dc1920
    ## </param>
    Chris PeBenito dc1920
    #
    Chris PeBenito dc1920
    interface(`init_tcp_recvfrom_all_daemons',`
    Chris PeBenito dc1920
    	gen_require(`
    Chris PeBenito dc1920
    		attribute daemon;
    Chris PeBenito dc1920
    	')
    Chris PeBenito dc1920
    Chris PeBenito dc1920
    	corenet_tcp_recvfrom_labeled($1, daemon)
    Chris PeBenito dc1920
    ')
    Chris PeBenito dc1920
    Chris PeBenito dc1920
    ########################################
    Chris PeBenito dc1920
    ## <summary>
    Chris PeBenito dc1920
    ##	Allow the specified domain to connect to daemon with a udp socket
    Chris PeBenito dc1920
    ## </summary>
    Chris PeBenito dc1920
    ## <param name="domain">
    Chris PeBenito dc1920
    ##	<summary>
    Chris PeBenito dc1920
    ##	Domain allowed access.
    Chris PeBenito dc1920
    ##	</summary>
    Chris PeBenito dc1920
    ## </param>
    Chris PeBenito dc1920
    #
    Chris PeBenito dc1920
    interface(`init_udp_recvfrom_all_daemons',`
    Chris PeBenito dc1920
    	gen_require(`
    Chris PeBenito dc1920
    		attribute daemon;
    Chris PeBenito dc1920
    	')
    Chris PeBenito dc1920
    	corenet_udp_recvfrom_labeled($1, daemon)
    Chris PeBenito dc1920
    ')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    ########################################
    Dan Walsh 3eaa99
    ## <summary>
    Dan Walsh 3eaa99
    ##	Transition to system_r when execute an init script
    Dan Walsh 3eaa99
    ## </summary>
    Dan Walsh 3eaa99
    ## <desc>
    Dan Walsh 3eaa99
    ##      

    Dan Walsh 3eaa99
    ##	Execute a init script in a specified role
    Dan Walsh 3eaa99
    ##      

    Dan Walsh 3eaa99
    ##      

    Dan Walsh 3eaa99
    ##      No interprocess communication (signals, pipes,
    Dan Walsh 3eaa99
    ##      etc.) is provided by this interface since
    Dan Walsh 3eaa99
    ##      the domains are not owned by this module.
    Dan Walsh 3eaa99
    ##      

    Dan Walsh 3eaa99
    ## </desc>
    Dan Walsh 3eaa99
    ## <param name="source_role">
    Dan Walsh 3eaa99
    ##	<summary>
    Dan Walsh 3eaa99
    ##	Role to transition from.
    Dan Walsh 3eaa99
    ##	</summary>
    Dan Walsh 3eaa99
    ## </param>
    Dan Walsh 3eaa99
    #
    Dan Walsh 3eaa99
    interface(`init_script_role_transition',`
    Dan Walsh 3eaa99
    	gen_require(`
    Dan Walsh 3eaa99
    		attribute init_script_file_type;
    Dan Walsh 3eaa99
    	')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    	role_transition $1 init_script_file_type system_r;
    Dan Walsh 3eaa99
    ')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    ########################################
    Dan Walsh 3eaa99
    ## <summary>
    Dan Walsh 3eaa99
    ##	dontaudit read and write an leaked init scrip file descriptors
    Dan Walsh 3eaa99
    ## </summary>
    Dan Walsh 3eaa99
    ## <param name="domain">
    Dan Walsh 3eaa99
    ##	<summary>
    Dan Walsh 3eaa99
    ##	Domain allowed access.
    Dan Walsh 3eaa99
    ##	</summary>
    Dan Walsh 3eaa99
    ## </param>
    Dan Walsh 3eaa99
    #
    Dan Walsh 3eaa99
    interface(`init_dontaudit_script_leaks',`
    Dan Walsh 3eaa99
    	gen_require(`
    Dan Walsh 3eaa99
    		type initrc_t;
    Dan Walsh 3eaa99
    	')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    	dontaudit $1 initrc_t:tcp_socket { read write };
    Dan Walsh 3eaa99
    	dontaudit $1 initrc_t:udp_socket { read write };
    Dan Walsh 3eaa99
    	dontaudit $1 initrc_t:unix_dgram_socket { read write };
    Dan Walsh 3eaa99
    	dontaudit $1 initrc_t:unix_stream_socket { read write };
    Dan Walsh 3eaa99
    	dontaudit $1 initrc_t:shm rw_shm_perms;
    Dan Walsh 3eaa99
    	init_dontaudit_use_script_ptys($1)
    Dan Walsh 3eaa99
    	init_dontaudit_use_script_fds($1)
    Dan Walsh 3eaa99
    ')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    ########################################
    Dan Walsh 3eaa99
    ## <summary>
    Dan Walsh 3eaa99
    ##	Allow the specified domain to connect to
    Dan Walsh 3eaa99
    ##	the init process with a unix socket.
    Dan Walsh 3eaa99
    ## </summary>
    Dan Walsh 3eaa99
    ## <param name="domain">
    Dan Walsh 3eaa99
    ##	<summary>
    Dan Walsh 3eaa99
    ##	Domain allowed access.
    Dan Walsh 3eaa99
    ##	</summary>
    Dan Walsh 3eaa99
    ## </param>
    Dan Walsh 3eaa99
    #
    Dan Walsh 3eaa99
    interface(`init_stream_connect',`
    Dan Walsh 3eaa99
    	gen_require(`
    Dan Walsh 3eaa99
    		type init_t;
    Dan Walsh 3eaa99
    	')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    	allow $1 init_t:unix_stream_socket connectto;
    Dan Walsh 3eaa99
    ')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    ########################################
    Dan Walsh 3eaa99
    ## <summary>
    Dan Walsh 3eaa99
    ##	Allow the specified domain to read/write to
    Dan Walsh 3eaa99
    ##	init with a unix domain stream sockets.
    Dan Walsh 3eaa99
    ## </summary>
    Dan Walsh 3eaa99
    ## <param name="domain">
    Dan Walsh 3eaa99
    ##	<summary>
    Dan Walsh 3eaa99
    ##	Domain allowed access.
    Dan Walsh 3eaa99
    ##	</summary>
    Dan Walsh 3eaa99
    ## </param>
    Dan Walsh 3eaa99
    #
    Dan Walsh 3eaa99
    interface(`init_rw_stream_sockets',`
    Dan Walsh 3eaa99
    	gen_require(`
    Dan Walsh 3eaa99
    		type init_t;
    Dan Walsh 3eaa99
    	')
    Dan Walsh 3eaa99
    Dan Walsh 3eaa99
    	allow $1 init_t:unix_stream_socket rw_stream_socket_perms;
    Dan Walsh 3eaa99
    ')