Chris PeBenito 3000a3
## <summary>
Chris PeBenito 414e41
## Core policy for shells, and generic programs
Chris PeBenito 414e41
## in /bin, /sbin, /usr/bin, and /usr/sbin.
Chris PeBenito 3000a3
## </summary>
Chris PeBenito e5d452
## <required val="true">
Chris PeBenito e5d452
##	Contains the base bin and sbin directory types
Chris PeBenito e5d452
##	which need to be searched for the kernel to
Chris PeBenito e5d452
##	run init.
Chris PeBenito e5d452
## </required>
Chris PeBenito e181fe
Chris PeBenito f7ebea
########################################
Chris PeBenito 80436b
## <summary>
Chris PeBenito 80436b
##	Make the shell an entrypoint for the specified domain.
Chris PeBenito 80436b
## </summary>
Chris PeBenito 80436b
## <param name="domain">
Chris PeBenito 80436b
##	The domain for which the shell is an entrypoint.
Chris PeBenito 80436b
## </param>
Chris PeBenito 199895
interface(`corecmd_shell_entry_type',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type shell_exec_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	domain_entry_file($1,shell_exec_t)
Chris PeBenito 07efe9
')
Chris PeBenito 07efe9
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito c9428d
# corecmd_search_bin(domain)
Chris PeBenito 075c4f
#
Chris PeBenito 199895
interface(`corecmd_search_bin',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type bin_t;
Chris PeBenito 139520
		class dir search;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 bin_t:dir search;
Chris PeBenito 075c4f
')
Chris PeBenito 075c4f
Chris PeBenito 075c4f
########################################
Chris PeBenito 075c4f
#
Chris PeBenito c9428d
# corecmd_list_bin(domain)
Chris PeBenito 075c4f
#
Chris PeBenito 199895
interface(`corecmd_list_bin',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type bin_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	allow $1 bin_t:dir r_dir_perms;
Chris PeBenito 075c4f
')
Chris PeBenito 075c4f
Chris PeBenito 58c3da
########################################
Chris PeBenito 80436b
## <summary>
Chris PeBenito 80436b
##	Get the attributes of files in bin directories.
Chris PeBenito 80436b
## </summary>
Chris PeBenito 80436b
## <param name="domain">
Chris PeBenito 80436b
##	The type of the process performing this action.
Chris PeBenito 80436b
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito 80436b
interface(`corecmd_getattr_bin_file',`
Chris PeBenito 80436b
	gen_require(`
Chris PeBenito 80436b
		type bin_t;
Chris PeBenito 80436b
		class file getattr;
Chris PeBenito 80436b
	')
Chris PeBenito 80436b
Chris PeBenito 80436b
	allow $1 bin_t:file getattr;
Chris PeBenito 80436b
')
Chris PeBenito 80436b
Chris PeBenito 58c3da
########################################
Chris PeBenito 80436b
## <summary>
Chris PeBenito ae9e27
##	Read files in bin directories.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito ae9e27
interface(`corecmd_read_bin_file',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type bin_t;
Chris PeBenito ae9e27
		class dir search;
Chris PeBenito ae9e27
		class file r_file_perms;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 bin_t:dir search;
Chris PeBenito ae9e27
	allow $1 bin_t:file r_file_perms;
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito 80436b
##	Read symbolic links in bin directories.
Chris PeBenito 80436b
## </summary>
Chris PeBenito 80436b
## <param name="domain">
Chris PeBenito 80436b
##	The type of the process performing this action.
Chris PeBenito 80436b
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito 80436b
interface(`corecmd_read_bin_symlink',`
Chris PeBenito 80436b
	gen_require(`
Chris PeBenito 80436b
		type bin_t;
Chris PeBenito 80436b
		class dir search;
Chris PeBenito ae9e27
		class lnk_file r_file_perms;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 bin_t:dir search;
Chris PeBenito ae9e27
	allow $1 bin_t:lnk_file r_file_perms;
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Read pipes in bin directories.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito ae9e27
interface(`corecmd_read_bin_pipe',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type bin_t;
Chris PeBenito ae9e27
		class dir search;
Chris PeBenito ae9e27
		class fifo_file r_file_perms;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 bin_t:dir search;
Chris PeBenito ae9e27
	allow $1 bin_t:fifo_file r_file_perms;
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Read named sockets in bin directories.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito ae9e27
interface(`corecmd_read_bin_socket',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type bin_t;
Chris PeBenito ae9e27
		class dir search;
Chris PeBenito ae9e27
		class sock_file r_file_perms;
Chris PeBenito 80436b
	')
Chris PeBenito 80436b
Chris PeBenito 80436b
	allow $1 bin_t:dir search;
Chris PeBenito ae9e27
	allow $1 bin_t:sock_file r_file_perms;
Chris PeBenito 80436b
')
Chris PeBenito 80436b
Chris PeBenito 075c4f
########################################
Chris PeBenito 075c4f
#
Chris PeBenito c9428d
# corecmd_exec_bin(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`corecmd_exec_bin',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type bin_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
		class lnk_file r_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	allow $1 bin_t:dir r_dir_perms;
Chris PeBenito dd8229
	allow $1 bin_t:lnk_file r_file_perms;
Chris PeBenito dd8229
	can_exec($1,bin_t)
Chris PeBenito dd8229
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito df00b2
## <summary>
Chris PeBenito df00b2
##	Execute a file in a bin directory
Chris PeBenito df00b2
##	in the specified domain.
Chris PeBenito df00b2
## </summary>
Chris PeBenito df00b2
## <desc>
Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	Execute a file in a bin directory
Chris PeBenito df00b2
##	in the specified domain.  This allows
Chris PeBenito df00b2
##	the specified domain to execute any file
Chris PeBenito df00b2
##	on these filesystems in the specified
Chris PeBenito df00b2
##	domain.  This is not suggested.
Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	No interprocess communication (signals, pipes,
Chris PeBenito df00b2
##	etc.) is provided by this interface since
Chris PeBenito df00b2
##	the domains are not owned by this module.
Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	This interface was added to handle
Chris PeBenito df00b2
##	the ssh-agent policy.
Chris PeBenito df00b2
##	

Chris PeBenito df00b2
## </desc>
Chris PeBenito df00b2
## <param name="domain">
Chris PeBenito df00b2
##	The type of the process performing this action.
Chris PeBenito df00b2
## </param>
Chris PeBenito df00b2
## <param name="target_domain">
Chris PeBenito df00b2
##	The type of the new process.
Chris PeBenito df00b2
## </param>
Chris PeBenito df00b2
#
Chris PeBenito df00b2
interface(`corecmd_bin_domtrans',`
Chris PeBenito df00b2
	gen_require(`
Chris PeBenito df00b2
		type bin_t;
Chris PeBenito df00b2
		class dir search;
Chris PeBenito df00b2
		class lnk_file { getattr read };
Chris PeBenito df00b2
	')
Chris PeBenito df00b2
Chris PeBenito df00b2
	allow $1 bin_t:dir search;
Chris PeBenito df00b2
	allow $1 bin_t:lnk_file { getattr read };
Chris PeBenito df00b2
Chris PeBenito df00b2
	domain_auto_trans($1,bin_t,$2)
Chris PeBenito df00b2
')
Chris PeBenito df00b2
Chris PeBenito df00b2
########################################
Chris PeBenito b4cd15
#
Chris PeBenito c9428d
# corecmd_search_sbin(domain)
Chris PeBenito 075c4f
#
Chris PeBenito 199895
interface(`corecmd_search_sbin',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type sbin_t;
Chris PeBenito 139520
		class dir search;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 sbin_t:dir search;
Chris PeBenito 075c4f
')
Chris PeBenito 075c4f
Chris PeBenito 075c4f
########################################
Chris PeBenito 075c4f
#
Chris PeBenito c9428d
# corecmd_list_sbin(domain)
Chris PeBenito 075c4f
#
Chris PeBenito 199895
interface(`corecmd_list_sbin',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type sbin_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 sbin_t:dir r_dir_perms;
Chris PeBenito 075c4f
')
Chris PeBenito 075c4f
Chris PeBenito 075c4f
########################################
Chris PeBenito 075c4f
#
Chris PeBenito 80436b
# corecmd_getattr_sbin_file(domain)
Chris PeBenito 80436b
#
Chris PeBenito 80436b
interface(`corecmd_getattr_sbin_file',`
Chris PeBenito 80436b
	gen_require(`
Chris PeBenito 80436b
		type sbin_t;
Chris PeBenito 80436b
		class file getattr;
Chris PeBenito 80436b
	')
Chris PeBenito 80436b
Chris PeBenito 80436b
	allow $1 sbin_t:file getattr;
Chris PeBenito 80436b
')
Chris PeBenito 80436b
Chris PeBenito 80436b
########################################
Chris PeBenito 80436b
#
Chris PeBenito c9428d
# corecmd_dontaudit_getattr_sbin_file(domain)
Chris PeBenito f5c42b
#
Chris PeBenito 199895
interface(`corecmd_dontaudit_getattr_sbin_file',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type sbin_t;
Chris PeBenito 139520
		class file getattr;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 80436b
	dontaudit $1 sbin_t:file getattr;
Chris PeBenito f5c42b
')
Chris PeBenito f5c42b
Chris PeBenito f5c42b
########################################
Chris PeBenito 58c3da
## <summary>
Chris PeBenito ae9e27
##	Read files in sbin directories.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito ae9e27
interface(`corecmd_read_sbin_file',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type sbin_t;
Chris PeBenito ae9e27
		class dir search;
Chris PeBenito ae9e27
		class file r_file_perms;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 sbin_t:dir search;
Chris PeBenito ae9e27
	allow $1 sbin_t:file r_file_perms;
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito 58c3da
##	Read symbolic links in sbin directories.
Chris PeBenito 58c3da
## </summary>
Chris PeBenito 58c3da
## <param name="domain">
Chris PeBenito 58c3da
##	The type of the process performing this action.
Chris PeBenito 58c3da
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito 58c3da
interface(`corecmd_read_sbin_symlink',`
Chris PeBenito 58c3da
	gen_require(`
Chris PeBenito 58c3da
		type sbin_t;
Chris PeBenito 58c3da
		class dir search;
Chris PeBenito ae9e27
		class lnk_file r_file_perms;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 sbin_t:dir search;
Chris PeBenito ae9e27
	allow $1 sbin_t:lnk_file r_file_perms;
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Read named pipes in sbin directories.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito ae9e27
interface(`corecmd_read_sbin_pipe',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type sbin_t;
Chris PeBenito ae9e27
		class dir search;
Chris PeBenito ae9e27
		class fifo_file r_file_perms;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 sbin_t:dir search;
Chris PeBenito ae9e27
	allow $1 sbin_t:fifo_file r_file_perms;
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Read named sockets in sbin directories.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito ae9e27
interface(`corecmd_read_sbin_socket',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type sbin_t;
Chris PeBenito ae9e27
		class dir search;
Chris PeBenito ae9e27
		class sock_file r_file_perms;
Chris PeBenito 58c3da
	')
Chris PeBenito 58c3da
Chris PeBenito 58c3da
	allow $1 sbin_t:dir search;
Chris PeBenito ae9e27
	allow $1 sbin_t:sock_file r_file_perms;
Chris PeBenito 58c3da
')
Chris PeBenito 58c3da
Chris PeBenito 58c3da
########################################
Chris PeBenito f5c42b
#
Chris PeBenito c9428d
# corecmd_exec_sbin(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`corecmd_exec_sbin',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type sbin_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
		class lnk_file r_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	allow $1 sbin_t:dir r_dir_perms;
Chris PeBenito dd8229
	allow $1 sbin_t:lnk_file r_file_perms;
Chris PeBenito dd8229
	can_exec($1,sbin_t)
Chris PeBenito dd8229
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 451c1e
## <summary>
Chris PeBenito 451c1e
##	Execute a file in a sbin directory
Chris PeBenito 451c1e
##	in the specified domain.
Chris PeBenito 451c1e
## </summary>
Chris PeBenito 451c1e
## <desc>
Chris PeBenito 451c1e
##	

Chris PeBenito 451c1e
##	Execute a file in a sbin directory
Chris PeBenito 451c1e
##	in the specified domain.  This allows
Chris PeBenito 451c1e
##	the specified domain to execute any file
Chris PeBenito 451c1e
##	on these filesystems in the specified
Chris PeBenito 451c1e
##	domain.  This is not suggested.
Chris PeBenito 451c1e
##	

Chris PeBenito 451c1e
##	

Chris PeBenito 451c1e
##	No interprocess communication (signals, pipes,
Chris PeBenito 451c1e
##	etc.) is provided by this interface since
Chris PeBenito 451c1e
##	the domains are not owned by this module.
Chris PeBenito 451c1e
##	

Chris PeBenito 451c1e
##	

Chris PeBenito 451c1e
##	This interface was added to handle
Chris PeBenito 451c1e
##	the ssh-agent policy.
Chris PeBenito 451c1e
##	

Chris PeBenito 451c1e
## </desc>
Chris PeBenito 451c1e
## <param name="domain">
Chris PeBenito 451c1e
##	The type of the process performing this action.
Chris PeBenito 451c1e
## </param>
Chris PeBenito 451c1e
## <param name="target_domain">
Chris PeBenito 451c1e
##	The type of the new process.
Chris PeBenito 451c1e
## </param>
Chris PeBenito 451c1e
#
Chris PeBenito 451c1e
interface(`corecmd_sbin_domtrans',`
Chris PeBenito 451c1e
	gen_require(`
Chris PeBenito 451c1e
		type sbin_t;
Chris PeBenito 451c1e
		class dir search;
Chris PeBenito 451c1e
		class lnk_file { getattr read };
Chris PeBenito 451c1e
	')
Chris PeBenito 451c1e
Chris PeBenito 451c1e
	allow $1 sbin_t:dir search;
Chris PeBenito 451c1e
	allow $1 sbin_t:lnk_file { getattr read };
Chris PeBenito 451c1e
Chris PeBenito 451c1e
	domain_auto_trans($1,sbin_t,$2)
Chris PeBenito 451c1e
')
Chris PeBenito 451c1e
Chris PeBenito 451c1e
########################################
Chris PeBenito b4cd15
#
Chris PeBenito c9428d
# corecmd_exec_shell(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`corecmd_exec_shell',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type bin_t, shell_exec_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
		class lnk_file r_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 bin_t:dir r_dir_perms;
Chris PeBenito dd8229
	allow $1 bin_t:lnk_file r_file_perms;
Chris PeBenito dd8229
	can_exec($1,shell_exec_t)
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito f5c42b
#
Chris PeBenito c9428d
# corecmd_exec_ls(domain)
Chris PeBenito f5c42b
#
Chris PeBenito 199895
interface(`corecmd_exec_ls',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type bin_t, ls_exec_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
		class lnk_file r_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 bin_t:dir r_dir_perms;
Chris PeBenito dd8229
	allow $1 bin_t:lnk_file r_file_perms;
Chris PeBenito dd8229
	can_exec($1,ls_exec_t)
Chris PeBenito f5c42b
')
Chris PeBenito f5c42b
Chris PeBenito f5c42b
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito f7ebea
##	Execute a shell in the target domain.  This
Chris PeBenito f7ebea
##	is an explicit transition, requiring the
Chris PeBenito f7ebea
##	caller to use setexeccon().
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <desc>
Chris PeBenito df00b2
##	

Chris PeBenito 414e41
##	Execute a shell in the target domain.  This
Chris PeBenito 414e41
##	is an explicit transition, requiring the
Chris PeBenito 414e41
##	caller to use setexeccon().
Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	No interprocess communication (signals, pipes,
Chris PeBenito df00b2
##	etc.) is provided by this interface since
Chris PeBenito df00b2
##	the domains are not owned by this module.
Chris PeBenito df00b2
##	

Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="target_domain">
Chris PeBenito 414e41
##	The type of the shell process.
Chris PeBenito 414e41
## </param>
Chris PeBenito 075c4f
#
Chris PeBenito 199895
interface(`corecmd_shell_spec_domtrans',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type bin_t, shell_exec_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
		class lnk_file r_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	allow $1 bin_t:dir r_dir_perms;
Chris PeBenito dd8229
	allow $1 bin_t:lnk_file r_file_perms;
Chris PeBenito 0fd9dc
Chris PeBenito 0fd9dc
	domain_trans($1,shell_exec_t,$2)
Chris PeBenito 075c4f
')
Chris PeBenito 075c4f
Chris PeBenito 4bf4ed
########################################
Chris PeBenito df00b2
## <summary>
Chris PeBenito df00b2
##	Execute a shell in the specified domain.
Chris PeBenito df00b2
## </summary>
Chris PeBenito 414e41
## <desc>
Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	Execute a shell in the specified domain.
Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	

Chris PeBenito df00b2
##	No interprocess communication (signals, pipes,
Chris PeBenito df00b2
##	etc.) is provided by this interface since
Chris PeBenito df00b2
##	the domains are not owned by this module.
Chris PeBenito df00b2
##	

Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="target_domain">
Chris PeBenito 414e41
##	The type of the shell process.
Chris PeBenito 414e41
## </param>
Chris PeBenito 4bf4ed
#
Chris PeBenito df00b2
interface(`corecmd_shell_domtrans',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type shell_exec_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	corecmd_shell_spec_domtrans($1,$2)
Chris PeBenito 0c73cd
	type_transition $1 shell_exec_t:process $2;
Chris PeBenito 4bf4ed
')
Chris PeBenito 4bf4ed
Chris PeBenito 075c4f
########################################
Chris PeBenito 075c4f
#
Chris PeBenito df00b2
# corecmd_exec_chroot(domain)
Chris PeBenito b4cd15
#
Chris PeBenito df00b2
interface(`corecmd_exec_chroot',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type chroot_exec_t;
Chris PeBenito 139520
		class capability sys_chroot;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	can_exec($1,chroot_exec_t)
Chris PeBenito 0c73cd
	allow $1 self:capability sys_chroot;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15