Chris PeBenito 162a57
## <summary>Policy for SELinux policy and userland applications.</summary>
Chris PeBenito e181fe
Chris PeBenito 85bd7f
#######################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute checkpolicy in the checkpolicy domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_domtrans_checkpol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type checkpolicy_t, checkpolicy_exec_t;
Chris PeBenito 139520
		class process sigchld;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
		class fifo_file rw_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_usr($1)
Chris PeBenito 139520
	corecmd_search_bin($1)
Chris PeBenito 139520
	domain_auto_trans($1,checkpolicy_exec_t,checkpolicy_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 checkpolicy_t:fd use;
Chris PeBenito 0c73cd
	allow checkpolicy_t $1:fd use;
Chris PeBenito 0c73cd
	allow checkpolicy_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow checkpolicy_t $1:process sigchld;
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute checkpolicy in the checkpolicy domain, and
Chris PeBenito 414e41
##	allow the specified role the checkpolicy domain,
Chris PeBenito 414e41
##	and use the caller's terminal.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to be allowed the checkpolicy domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the checkpolicy domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`seutil_run_checkpol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type checkpolicy_t;
Chris PeBenito 139520
		class chr_file rw_term_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 5e0da6
	seutil_domtrans_checkpol($1)
Chris PeBenito 0c73cd
	role $2 types checkpolicy_t;
Chris PeBenito 139520
	allow checkpolicy_t $3:chr_file rw_term_perms;
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito 85bd7f
#######################################
Chris PeBenito 85bd7f
#
Chris PeBenito 5e0da6
# seutil_exec_checkpol(domain)
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_exec_checkpol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type checkpolicy_exec_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_usr($1)
Chris PeBenito 139520
	corecmd_search_bin($1)
Chris PeBenito cc41a9
	can_exec($1,checkpolicy_exec_t)
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito 85bd7f
#######################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute load_policy in the load_policy domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_domtrans_loadpol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type load_policy_t, load_policy_exec_t;
Chris PeBenito 139520
		class process sigchld;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
		class fifo_file rw_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	corecmd_search_sbin($1)
Chris PeBenito 139520
	domain_auto_trans($1,load_policy_exec_t,load_policy_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 load_policy_t:fd use;
Chris PeBenito 0c73cd
	allow load_policy_t $1:fd use;
Chris PeBenito 0c73cd
	allow load_policy_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow load_policy_t $1:process sigchld;
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute load_policy in the load_policy domain, and
Chris PeBenito 414e41
##	allow the specified role the load_policy domain,
Chris PeBenito 414e41
##	and use the caller's terminal.
Chris PeBenito 414e41
##	Has a SIGCHLD signal backchannel.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to be allowed the load_policy domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the load_policy domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`seutil_run_loadpol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type load_policy_t;
Chris PeBenito 139520
		class chr_file rw_term_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 5e0da6
	seutil_domtrans_loadpol($1)
Chris PeBenito 0c73cd
	role $2 types load_policy_t;
Chris PeBenito 139520
	allow load_policy_t $3:chr_file rw_term_perms;
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito 85bd7f
#######################################
Chris PeBenito 85bd7f
#
Chris PeBenito 5e0da6
# seutil_exec_loadpol(domain)
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_exec_loadpol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type load_policy_exec_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	corecmd_search_sbin($1)
Chris PeBenito cc41a9
	can_exec($1,load_policy_exec_t)
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito 85bd7f
#######################################
Chris PeBenito 85bd7f
#
Chris PeBenito 5e0da6
# seutil_read_loadpol(domain)
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_read_loadpol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type load_policy_exec_t;
Chris PeBenito 71fe0f
		class file r_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	corecmd_search_sbin($1)
Chris PeBenito cc41a9
	allow $1 load_policy_exec_t:file r_file_perms;
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito 85bd7f
#######################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute newrole in the load_policy domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_domtrans_newrole',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type newrole_t, newrole_exec_t;
Chris PeBenito 139520
		class process sigchld;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
		class fifo_file rw_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_usr($1)
Chris PeBenito 139520
	corecmd_search_bin($1)
Chris PeBenito 139520
	domain_auto_trans($1,newrole_exec_t,newrole_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 newrole_t:fd use;
Chris PeBenito 0c73cd
	allow newrole_t $1:fd use;
Chris PeBenito 0c73cd
	allow newrole_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow newrole_t $1:process sigchld;
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute newrole in the newrole domain, and
Chris PeBenito 414e41
##	allow the specified role the newrole domain,
Chris PeBenito 414e41
##	and use the caller's terminal.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to be allowed the newrole domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the newrole domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`seutil_run_newrole',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type newrole_t;
Chris PeBenito 139520
		class chr_file rw_term_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 5e0da6
	seutil_domtrans_newrole($1)
Chris PeBenito 0c73cd
	role $2 types newrole_t;
Chris PeBenito 139520
	allow newrole_t $3:chr_file rw_term_perms;
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito 85bd7f
#######################################
Chris PeBenito 85bd7f
#
Chris PeBenito 5e0da6
# seutil_exec_newrole(domain)
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_exec_newrole',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type newrole_t, newrole_exec_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_usr($1)
Chris PeBenito 139520
	corecmd_search_bin($1)
Chris PeBenito cc41a9
	can_exec($1,newrole_exec_t)
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit the caller attempts to send
Chris PeBenito 414e41
##	a signal to newrole.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 8fd367
interface(`seutil_dontaudit_signal_newrole',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type newrole_t;
Chris PeBenito 139520
		class process signal;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 newrole_t:process signal;
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito 85bd7f
#######################################
Chris PeBenito 85bd7f
#
Chris PeBenito 8fd367
# seutil_sigchld_newrole(domain)
Chris PeBenito 85bd7f
#
Chris PeBenito 8fd367
interface(`seutil_sigchld_newrole',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type newrole_t;
Chris PeBenito 139520
		class process sigchld;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 newrole_t:process sigchld;
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito 85bd7f
#######################################
Chris PeBenito 85bd7f
#
Chris PeBenito 5e0da6
# seutil_use_newrole_fd(domain)
Chris PeBenito ab64c3
#
Chris PeBenito 199895
interface(`seutil_use_newrole_fd',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type newrole_t;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 newrole_t:fd use;
Chris PeBenito ab64c3
')
Chris PeBenito ab64c3
Chris PeBenito ab64c3
#######################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute restorecon in the restorecon domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_domtrans_restorecon',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type restorecon_t, restorecon_exec_t;
Chris PeBenito 139520
		class process sigchld;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
		class fifo_file rw_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	corecmd_search_sbin($1)
Chris PeBenito 139520
	domain_auto_trans($1,restorecon_exec_t,restorecon_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 restorecon_t:fd use;
Chris PeBenito 0c73cd
	allow restorecon_t $1:fd use;
Chris PeBenito 0c73cd
	allow restorecon_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow restorecon_t $1:process sigchld;
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute restorecon in the restorecon domain, and
Chris PeBenito 414e41
##	allow the specified role the restorecon domain,
Chris PeBenito 414e41
##	and use the caller's terminal.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to be allowed the restorecon domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the restorecon domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`seutil_run_restorecon',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type restorecon_t;
Chris PeBenito 139520
		class chr_file rw_term_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 5e0da6
	seutil_domtrans_restorecon($1)
Chris PeBenito 0c73cd
	role $2 types restorecon_t;
Chris PeBenito 139520
	allow restorecon_t $3:chr_file rw_term_perms;
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito 85bd7f
#######################################
Chris PeBenito 85bd7f
#
Chris PeBenito 5e0da6
# seutil_exec_restorecon(domain)
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_exec_restorecon',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type restorecon_t, restorecon_exec_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	corecmd_search_sbin($1)
Chris PeBenito 139520
	can_exec($1,restorecon_exec_t)
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito 8623d5
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute run_init in the run_init domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 8623d5
#
Chris PeBenito 199895
interface(`seutil_domtrans_runinit',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type run_init_t, run_init_exec_t;
Chris PeBenito 139520
		class process sigchld;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
		class fifo_file rw_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_usr($1)
Chris PeBenito 139520
	corecmd_search_sbin($1)
Chris PeBenito 139520
	domain_auto_trans($1,run_init_exec_t,run_init_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 run_init_t:fd use;
Chris PeBenito 0c73cd
	allow run_init_t $1:fd use;
Chris PeBenito 0c73cd
	allow run_init_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow run_init_t $1:process sigchld;
Chris PeBenito 8623d5
')
Chris PeBenito 8623d5
Chris PeBenito 8623d5
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute run_init in the run_init domain, and
Chris PeBenito 414e41
##	allow the specified role the run_init domain,
Chris PeBenito 414e41
##	and use the caller's terminal.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to be allowed the run_init domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the run_init domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`seutil_run_runinit',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type run_init_t;
Chris PeBenito 139520
		class chr_file rw_term_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 5e0da6
	seutil_domtrans_runinit($1)
Chris PeBenito 0c73cd
	role $2 types run_init_t;
Chris PeBenito 139520
	allow run_init_t $3:chr_file rw_term_perms;
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito daa0e0
########################################
Chris PeBenito 8623d5
#
Chris PeBenito 5e0da6
# seutil_use_runinit_fd(domain)
Chris PeBenito 8623d5
#
Chris PeBenito 199895
interface(`seutil_use_runinit_fd',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type run_init_t;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 run_init_t:fd use;
Chris PeBenito 8623d5
')
Chris PeBenito 8623d5
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute setfiles in the setfiles domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_domtrans_setfiles',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type setfiles_t, setfiles_exec_t;
Chris PeBenito 139520
		class process sigchld;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
		class fifo_file rw_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_usr($1)
Chris PeBenito 139520
	corecmd_search_sbin($1)
Chris PeBenito 139520
	domain_auto_trans($1,setfiles_exec_t,setfiles_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 setfiles_t:fd use;
Chris PeBenito 0c73cd
	allow setfiles_t $1:fd use;
Chris PeBenito 0c73cd
	allow setfiles_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow setfiles_t $1:process sigchld;
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute setfiles in the setfiles domain, and
Chris PeBenito 414e41
##	allow the specified role the setfiles domain,
Chris PeBenito 414e41
##	and use the caller's terminal.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to be allowed the setfiles domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the setfiles domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`seutil_run_setfiles',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type setfiles_t;
Chris PeBenito 139520
		class chr_file rw_term_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 5e0da6
	seutil_domtrans_setfiles($1)
Chris PeBenito 0c73cd
	role $2 types setfiles_t;
Chris PeBenito 139520
	allow setfiles_t $3:chr_file rw_term_perms;
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito 85bd7f
#######################################
Chris PeBenito 85bd7f
#
Chris PeBenito 5e0da6
# seutil_exec_setfiles(domain)
Chris PeBenito 85bd7f
#
Chris PeBenito 199895
interface(`seutil_exec_setfiles',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type setfiles_exec_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_usr($1)
Chris PeBenito 139520
	corecmd_search_sbin($1)
Chris PeBenito cc41a9
	can_exec($1,setfiles_exec_t)
Chris PeBenito 85bd7f
')
Chris PeBenito 85bd7f
Chris PeBenito b4cd15
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Do not audit attempts to search the SELinux
Chris PeBenito ae9e27
##	configuration directory (/etc/selinux).
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito ae9e27
##	Domain to not audit.
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito ae9e27
interface(`seutil_dontaudit_search_config',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type selinux_config_t;
Chris PeBenito ae9e27
		class dir search;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	dontaudit $1 selinux_config_t:dir search;
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito a08248
## <summary>
Chris PeBenito a08248
##	Do not audit attempts to read the SELinux
Chris PeBenito a08248
##	userland configuration (/etc/selinux).
Chris PeBenito a08248
## </summary>
Chris PeBenito a08248
## <param name="domain">
Chris PeBenito a08248
##	Domain to not audit.
Chris PeBenito a08248
## </param>
Chris PeBenito a08248
#
Chris PeBenito a08248
interface(`seutil_dontaudit_read_config',`
Chris PeBenito a08248
	gen_require(`
Chris PeBenito a08248
		type selinux_config_t;
Chris PeBenito a08248
	')
Chris PeBenito a08248
Chris PeBenito a08248
	dontaudit $1 selinux_config_t:dir search;
Chris PeBenito a08248
	dontaudit $1 selinux_config_t:file { getattr read };
Chris PeBenito a08248
')
Chris PeBenito a08248
Chris PeBenito a08248
########################################
Chris PeBenito b4cd15
#
Chris PeBenito 5e0da6
# seutil_read_config(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`seutil_read_config',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type selinux_config_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_etc($1)
Chris PeBenito cc41a9
	allow $1 selinux_config_t:dir r_dir_perms;
Chris PeBenito cc41a9
	allow $1 selinux_config_t:file r_file_perms;
Chris PeBenito 30705b
	allow $1 selinux_config_t:lnk_file { getattr read };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito ebdc3b
## <summary>
Chris PeBenito ebdc3b
##	Search the policy directory with default_context files.
Chris PeBenito ebdc3b
## </summary>
Chris PeBenito ebdc3b
## <param name="domain">
Chris PeBenito ebdc3b
##	The type of the process performing this action.
Chris PeBenito ebdc3b
## </param>
Chris PeBenito ebdc3b
#
Chris PeBenito ebdc3b
interface(`seutil_search_default_contexts',`
Chris PeBenito ebdc3b
	gen_require(`
Chris PeBenito ebdc3b
		type selinux_config_t, default_context_t;
Chris PeBenito ebdc3b
		class dir search;
Chris PeBenito ebdc3b
	')
Chris PeBenito ebdc3b
Chris PeBenito ebdc3b
	files_search_etc($1)
Chris PeBenito ebdc3b
	allow $1 { selinux_config_t default_context_t }:dir search;
Chris PeBenito ebdc3b
')
Chris PeBenito ebdc3b
Chris PeBenito ebdc3b
Chris PeBenito ebdc3b
########################################
Chris PeBenito b4cd15
#
Chris PeBenito 5e0da6
# seutil_read_default_contexts(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`seutil_read_default_contexts',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type selinux_config_t, default_context_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_etc($1)
Chris PeBenito 0c73cd
	allow $1 selinux_config_t:dir search;
Chris PeBenito cc41a9
	allow $1 default_context_t:dir r_dir_perms;
Chris PeBenito cc41a9
	allow $1 default_context_t:file r_file_perms;
Chris PeBenito 30705b
	allow $1 default_context_t:lnk_file { getattr read };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito 5e0da6
# seutil_read_file_contexts(domain)
Chris PeBenito ee5772
#
Chris PeBenito 199895
interface(`seutil_read_file_contexts',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type selinux_config_t, file_context_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_etc($1)
Chris PeBenito 0c73cd
	allow $1 selinux_config_t:dir search;
Chris PeBenito cc41a9
	allow $1 file_context_t:dir r_dir_perms;
Chris PeBenito cc41a9
	allow $1 file_context_t:file r_file_perms;
Chris PeBenito a525f2
	allow $1 file_context_t:lnk_file { getattr read };
Chris PeBenito ee5772
')
Chris PeBenito ee5772
Chris PeBenito ee5772
########################################
Chris PeBenito ee5772
#
Chris PeBenito 5e0da6
# seutil_read_binary_pol(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`seutil_read_binary_pol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type selinux_config_t, policy_config_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
		class file r_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_etc($1)
Chris PeBenito 139520
	allow $1 selinux_config_t:dir search;
Chris PeBenito cc41a9
	allow $1 policy_config_t:dir r_dir_perms;
Chris PeBenito cc41a9
	allow $1 policy_config_t:file r_file_perms;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito 139520
# seutil_create_binary_pol(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`seutil_create_binary_pol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 15fefa
#		attribute can_write_binary_policy;
Chris PeBenito 139520
		type selinux_config_t, policy_config_t;
Chris PeBenito 139520
		class dir ra_dir_perms;
Chris PeBenito 139520
		class file { getattr create write };
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_etc($1)
Chris PeBenito 139520
	allow $1 selinux_config_t:dir search;
Chris PeBenito 139520
	allow $1 policy_config_t:dir ra_dir_perms;
Chris PeBenito 139520
	allow $1 policy_config_t:file { getattr create write };
Chris PeBenito 15fefa
#	typeattribute $1 can_write_binary_policy;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito ef3734
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Allow the caller to relabel a file to the binary policy type.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito efd8ed
#
Chris PeBenito 199895
interface(`seutil_relabelto_binary_pol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		attribute can_relabelto_binary_policy;
Chris PeBenito 139520
		type policy_config_t;
Chris PeBenito 139520
		class file relabelto;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 policy_config_t:file relabelto;
Chris PeBenito 0c73cd
	typeattribute $1 can_relabelto_binary_policy;
Chris PeBenito efd8ed
')
Chris PeBenito efd8ed
Chris PeBenito efd8ed
########################################
Chris PeBenito ef3734
#
Chris PeBenito 5e0da6
# seutil_manage_binary_pol(domain)
Chris PeBenito ef3734
#
Chris PeBenito 199895
interface(`seutil_manage_binary_pol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		attribute can_write_binary_policy;
Chris PeBenito 139520
		type selinux_config_t, policy_config_t;
Chris PeBenito 139520
		class dir rw_dir_perms;
Chris PeBenito 139520
		class file create_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 139520
Chris PeBenito 139520
	files_search_etc($1)
Chris PeBenito 0c73cd
	allow $1 selinux_config_t:dir search;
Chris PeBenito 139520
	allow $1 policy_config_t:dir rw_dir_perms;
Chris PeBenito cc41a9
	allow $1 policy_config_t:file create_file_perms;
Chris PeBenito 0c73cd
	typeattribute $1 can_write_binary_policy;
Chris PeBenito ef3734
')
Chris PeBenito ef3734
Chris PeBenito ef3734
########################################
Chris PeBenito ef3734
#
Chris PeBenito 5e0da6
# seutil_read_src_pol(domain)
Chris PeBenito ef3734
#
Chris PeBenito 199895
interface(`seutil_read_src_pol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type selinux_config_t, policy_src_t;
Chris PeBenito 139520
		class dir r_dir_perms;
Chris PeBenito 139520
		class file r_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_etc($1)
Chris PeBenito 0c73cd
	allow $1 selinux_config_t:dir search;
Chris PeBenito cc41a9
	allow $1 policy_src_t:dir r_dir_perms;
Chris PeBenito cc41a9
	allow $1 policy_src_t:file r_file_perms;
Chris PeBenito ef3734
')
Chris PeBenito ef3734
Chris PeBenito ef3734
########################################
Chris PeBenito ef3734
#
Chris PeBenito 5e0da6
# seutil_manage_src_pol(domain)
Chris PeBenito ef3734
#
Chris PeBenito 199895
interface(`seutil_manage_src_pol',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type selinux_config_t, policy_src_t;
Chris PeBenito 139520
		class dir create_dir_perms;
Chris PeBenito 139520
		class file create_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_search_etc($1)
Chris PeBenito 0c73cd
	allow $1 selinux_config_t:dir search;
Chris PeBenito cc41a9
	allow $1 policy_src_t:dir create_dir_perms;
Chris PeBenito cc41a9
	allow $1 policy_src_t:file create_file_perms;
Chris PeBenito ef3734
')
Chris PeBenito ef3734