Chris PeBenito 493d6c
## <summary>Name service cache daemon</summary>
Chris PeBenito 493d6c
Chris PeBenito 493d6c
########################################
Chris PeBenito 493d6c
## <summary>
Chris PeBenito 8cfa5a
##	Send generic signals to NSCD.
Chris PeBenito 8cfa5a
## </summary>
Chris PeBenito 8cfa5a
## <param name="domain">
Chris PeBenito 8cfa5a
##	<summary>
Chris PeBenito 8cfa5a
##	Domain allowed access.
Chris PeBenito 8cfa5a
##	</summary>
Chris PeBenito 8cfa5a
## </param>
Chris PeBenito 8cfa5a
#
Chris PeBenito 8cfa5a
interface(`nscd_signal',`
Chris PeBenito 8cfa5a
	gen_require(`
Chris PeBenito 8cfa5a
		type nscd_t;
Chris PeBenito 8cfa5a
	')
Chris PeBenito 8cfa5a
Chris PeBenito 8cfa5a
	allow $1 nscd_t:process signal;
Chris PeBenito 8cfa5a
')
Chris PeBenito 8cfa5a
Chris PeBenito 8cfa5a
########################################
Chris PeBenito 8cfa5a
## <summary>
Chris PeBenito 493d6c
##	Execute NSCD in the nscd domain.
Chris PeBenito 493d6c
## </summary>
Chris PeBenito 493d6c
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 493d6c
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 493d6c
## </param>
Chris PeBenito 493d6c
#
Chris PeBenito 493d6c
interface(`nscd_domtrans',`
Chris PeBenito 493d6c
	gen_require(`
Chris PeBenito 493d6c
		type nscd_t, nscd_exec_t;
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	corecmd_search_sbin($1)
Chris PeBenito 493d6c
	domain_auto_trans($1,nscd_exec_t,nscd_t)
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	allow $1 nscd_t:fd use;
Chris PeBenito 493d6c
	allow nscd_t $1:fd use;
Chris PeBenito 493d6c
	allow nscd_t $1:fifo_file rw_file_perms;
Chris PeBenito 493d6c
	allow nscd_t $1:process sigchld;
Chris PeBenito 493d6c
')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
########################################
Chris PeBenito 493d6c
## <summary>
Chris PeBenito 493d6c
##	Use NSCD services by connecting using
Chris PeBenito 493d6c
##	a unix stream socket.
Chris PeBenito 493d6c
## </summary>
Chris PeBenito 493d6c
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 493d6c
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 493d6c
## </param>
Chris PeBenito 493d6c
#
Chris PeBenito 1815ba
interface(`nscd_socket_use',`
Chris PeBenito 493d6c
	gen_require(`
Chris PeBenito 493d6c
		type nscd_t, nscd_var_run_t;
Chris PeBenito 25c674
		class nscd { getpwd getgrp gethost shmempwd shmemgrp shmemhost };
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito 6e6156
	allow $1 self:unix_stream_socket create_socket_perms;
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	allow $1 nscd_t:unix_stream_socket connectto;
Chris PeBenito 493d6c
	allow $1 nscd_t:nscd { getpwd getgrp gethost };
Chris PeBenito 493d6c
	dontaudit $1 nscd_t:fd use;
Chris PeBenito 493d6c
	dontaudit $1 nscd_t:nscd { shmempwd shmemgrp shmemhost };
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	files_search_pids($1)
Chris PeBenito a3cf80
	allow $1 nscd_var_run_t:dir r_dir_perms;
Chris PeBenito 493d6c
	allow $1 nscd_var_run_t:sock_file rw_file_perms;
Chris PeBenito 493d6c
	dontaudit $1 nscd_var_run_t:file { getattr read };
Chris PeBenito 493d6c
')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
########################################
Chris PeBenito 493d6c
## <summary>
Chris PeBenito 493d6c
##	Use NSCD services by mapping the database from
Chris PeBenito 493d6c
##	an inherited NSCD file descriptor.
Chris PeBenito 493d6c
## </summary>
Chris PeBenito 493d6c
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 493d6c
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 493d6c
## </param>
Chris PeBenito 493d6c
#
Chris PeBenito 1815ba
interface(`nscd_shm_use',`
Chris PeBenito 493d6c
	gen_require(`
Chris PeBenito 493d6c
		type nscd_t, nscd_var_run_t;
Chris PeBenito 25c674
		class nscd { getpwd getgrp gethost shmempwd shmemgrp shmemhost };
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	allow $1 nscd_var_run_t:dir r_dir_perms;
Chris PeBenito 493d6c
	allow $1 nscd_t:nscd { shmempwd shmemgrp shmemhost };
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	# Receive fd from nscd and map the backing file with read access.
Chris PeBenito 493d6c
	allow $1 nscd_t:fd use;
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	# cjp: these were originally inherited from the
Chris PeBenito 493d6c
	# nscd_socket_domain macro.  need to investigate
Chris PeBenito 493d6c
	# if they are all actually required
Chris PeBenito 493d6c
	allow $1 self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito 493d6c
	allow $1 nscd_t:unix_stream_socket connectto;
Chris PeBenito 493d6c
	allow $1 nscd_var_run_t:sock_file rw_file_perms;
Chris PeBenito 493d6c
	files_search_pids($1)
Chris PeBenito 493d6c
	allow $1 nscd_t:nscd { getpwd getgrp gethost };
Chris PeBenito 493d6c
	dontaudit $1 nscd_var_run_t:file { getattr read };
Chris PeBenito 493d6c
')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
########################################
Chris PeBenito 493d6c
## <summary>
Chris PeBenito 689f6d
##	Read NSCD pid file.
Chris PeBenito 689f6d
## </summary>
Chris PeBenito 689f6d
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 689f6d
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 689f6d
## </param>
Chris PeBenito 689f6d
#
Chris PeBenito 689f6d
interface(`nscd_read_pid',`
Chris PeBenito 689f6d
	gen_require(`
Chris PeBenito 689f6d
		type nscd_var_run_t;
Chris PeBenito 689f6d
	')
Chris PeBenito 689f6d
Chris PeBenito 689f6d
	files_search_pids($1)
Chris PeBenito 689f6d
	allow $1 nscd_var_run_t:dir search;
Chris PeBenito 689f6d
	allow $1 nscd_var_run_t:file { getattr read };
Chris PeBenito 689f6d
')
Chris PeBenito 689f6d
Chris PeBenito 689f6d
########################################
Chris PeBenito 689f6d
## <summary>
Chris PeBenito 493d6c
##	Unconfined access to NSCD services.
Chris PeBenito 493d6c
## </summary>
Chris PeBenito 493d6c
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 493d6c
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 493d6c
## </param>
Chris PeBenito 493d6c
#
Chris PeBenito 493d6c
interface(`nscd_unconfined',`
Chris PeBenito 493d6c
	gen_require(`
Chris PeBenito 493d6c
		type nscd_t;
Chris PeBenito 41c480
		class nscd all_nscd_perms;
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	allow $1 nscd_t:nscd *;
Chris PeBenito 493d6c
')