Chris PeBenito 11633b
## <summary>TCP/IP encryption</summary>
Chris PeBenito 11633b
Chris PeBenito 11633b
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 11633b
##	Execute ipsec in the ipsec domain.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 11633b
## <param name="domain">
Chris PeBenito 11633b
##	The type of the process performing this action.
Chris PeBenito 11633b
## </param>
Chris PeBenito 11633b
#
Chris PeBenito 11633b
interface(`ipsec_domtrans',`
Chris PeBenito 11633b
	gen_require(`
Chris PeBenito 11633b
		type ipsec_t, ipsec_exec_t;
Chris PeBenito 11633b
	')
Chris PeBenito 11633b
Chris PeBenito 11633b
	domain_auto_trans($1,ipsec_exec_t,ipsec_t)
Chris PeBenito 11633b
Chris PeBenito 11633b
	allow $1 ipsec_t:fd use;
Chris PeBenito 11633b
	allow ipsec_t $1:fd use;
Chris PeBenito 11633b
	allow ipsec_t $1:fifo_file rw_file_perms;
Chris PeBenito 11633b
	allow ipsec_t $1:process sigchld;
Chris PeBenito 11633b
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito 81343a
##	Connect to IPSEC using a unix domain stream socket.
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito a5f339
##	The type of the process performing this action.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito 81343a
interface(`ipsec_stream_connect',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito 81343a
		type ipsec_t, ipsec_var_run_t;
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito 81343a
	files_search_pids($1)
Chris PeBenito 81343a
	allow $1 ipsec_var_run_t:dir search;
Chris PeBenito 81343a
	allow $1 ipsec_var_run_t:sock_file write;
Chris PeBenito a5f339
	allow $1 ipsec_t:unix_stream_socket connectto;
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito a5f339
##	Get the attributes of an IPSEC key socket.
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito a5f339
##	The type of the process performing this action.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`ipsec_getattr_key_socket',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito a5f339
		type ipsec_t;
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito a5f339
	allow $1 ipsec_t:key_socket getattr;
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito a5f339
##	Execute the IPSEC management program in the caller domain.
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito a5f339
##	The type of the process performing this action.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`ipsec_exec_mgmt',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito a5f339
		type ipsec_exec_t;
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito a5f339
	can_exec($1,ipsec_exec_t)
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito a5f339
##	Read the IPSEC configuration
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito a5f339
##	The type of the process performing this action.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`ipsec_read_config',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito a5f339
		type ipsec_conf_file_t;
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito a5f339
	files_search_etc($1)
Chris PeBenito a5f339
	allow $1 ipsec_conf_file_t:file r_file_perms;
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito a5f339
##	Create, read, write, and delete the IPSEC pid files.
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito a5f339
##	The type of the process performing this action.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`ipsec_manage_pid',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito a5f339
		type ipsec_var_run_t;
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito a5f339
	files_search_pids($1)
Chris PeBenito a5f339
	allow $1 ipsec_var_run_t:dir rw_dir_perms;
Chris PeBenito a5f339
	allow $1 ipsec_var_run_t:file create_file_perms;
Chris PeBenito a5f339
')