Chris PeBenito ed78ea
Chris PeBenito a52492
policy_module(tmpreaper,1.1.1)
Chris PeBenito ed78ea
Chris PeBenito ed78ea
########################################
Chris PeBenito ed78ea
#
Chris PeBenito ed78ea
# Declarations
Chris PeBenito ed78ea
#
Chris PeBenito ed78ea
Chris PeBenito ed78ea
type tmpreaper_t;
Chris PeBenito ed78ea
role system_r types tmpreaper_t;
Chris PeBenito ed78ea
domain_type(tmpreaper_t)
Chris PeBenito ed78ea
Chris PeBenito ed78ea
type tmpreaper_exec_t;
Chris PeBenito ed78ea
domain_entry_file(tmpreaper_t,tmpreaper_exec_t)
Chris PeBenito ed78ea
Chris PeBenito ed78ea
########################################
Chris PeBenito ed78ea
#
Chris PeBenito ed78ea
# Local Policy
Chris PeBenito ed78ea
#
Chris PeBenito ed78ea
Chris PeBenito ed78ea
allow tmpreaper_t self:process { fork sigchld };
Chris PeBenito ed78ea
allow tmpreaper_t self:capability { dac_override dac_read_search fowner };
Chris PeBenito ed78ea
Chris PeBenito ed78ea
dev_read_urand(tmpreaper_t)
Chris PeBenito ed78ea
Chris PeBenito ed78ea
fs_getattr_xattr_fs(tmpreaper_t)
Chris PeBenito ed78ea
Chris PeBenito ed78ea
files_read_etc_files(tmpreaper_t)
Chris PeBenito ed78ea
files_read_var_lib_files(tmpreaper_t)
Chris PeBenito ed78ea
files_purge_tmp(tmpreaper_t)
Chris PeBenito ed78ea
# why does it need setattr?
Chris PeBenito ed78ea
files_setattr_all_tmp_dirs(tmpreaper_t)
Chris PeBenito ed78ea
Chris PeBenito bf080a
mls_file_read_up(tmpreaper_t)
Chris PeBenito bf080a
mls_file_write_down(tmpreaper_t)
Chris PeBenito bf080a
Chris PeBenito ed78ea
libs_use_ld_so(tmpreaper_t)
Chris PeBenito ed78ea
libs_use_shared_libs(tmpreaper_t)
Chris PeBenito ed78ea
Chris PeBenito ed78ea
logging_send_syslog_msg(tmpreaper_t)
Chris PeBenito ed78ea
Chris PeBenito ed78ea
miscfiles_read_localization(tmpreaper_t)
Chris PeBenito cf6a7d
miscfiles_delete_man_pages(tmpreaper_t)
Chris PeBenito ed78ea
Chris PeBenito ed78ea
cron_system_entry(tmpreaper_t,tmpreaper_exec_t)
Chris PeBenito ed78ea
Chris PeBenito a52492
optional_policy(`lpd',`
Chris PeBenito a52492
	lpd_manage_spool(tmpreaper_t)
Chris PeBenito a52492
')
Chris PeBenito a52492
Chris PeBenito ed78ea
ifdef(`TODO',`
Chris PeBenito ed78ea
allow tmpreaper_t { home_type file_t }:notdevfile_class_set { getattr unlink };
Chris PeBenito ed78ea
')