diff --git a/policy/modules/admin/amanda.if b/policy/modules/admin/amanda.if index d1d035e..2cb11ea 100644 --- a/policy/modules/admin/amanda.if +++ b/policy/modules/admin/amanda.if @@ -1,8 +1,9 @@ -## Automated backup program. +## Advanced Maryland Automatic Network Disk Archiver. ######################################## ## -## Execute amrecover in the amanda_recover domain. +## Execute a domain transition to +## run Amanda Recover. ## ## ## @@ -16,12 +17,15 @@ interface(`amanda_domtrans_recover',` ') domtrans_pattern($1, amanda_recover_exec_t, amanda_recover_t) + corecmd_search_bin($1) ') ######################################## ## -## Execute amrecover in the amanda_recover domain, and -## allow the specified role the amanda_recover domain. +## Execute a domain transition to +## run Amanda Recover and allow the +## specified role the Amanda Recover +## domain. ## ## ## @@ -46,7 +50,7 @@ interface(`amanda_run_recover',` ######################################## ## -## Search amanda library directories. +## Search Amanda lib directories. ## ## ## @@ -61,11 +65,13 @@ interface(`amanda_search_lib',` allow $1 amanda_usr_lib_t:dir search_dir_perms; files_search_usr($1) + libs_search_lib($1) ') ######################################## ## -## Do not audit attempts to read /etc/dumpdates. +## Do not audit attempts to read +## dumpdates files. ## ## ## @@ -78,12 +84,12 @@ interface(`amanda_dontaudit_read_dumpdates',` type amanda_dumpdates_t; ') - dontaudit $1 amanda_dumpdates_t:file { getattr read }; + dontaudit $1 amanda_dumpdates_t:file read_file_perms; ') ######################################## ## -## Allow read/writing /etc/dumpdates. +## Read and write dumpdates files. ## ## ## @@ -97,11 +103,12 @@ interface(`amanda_rw_dumpdates_files',` ') allow $1 amanda_dumpdates_t:file rw_file_perms; + files_search_etc($1) ') ######################################## ## -## Search amanda library directories. +## Search Amanda lib directories. ## ## ## @@ -116,11 +123,12 @@ interface(`amanda_manage_lib',` allow $1 amanda_usr_lib_t:dir manage_dir_perms; files_search_usr($1) + libs_search_lib($1) ') ######################################## ## -## Allow read/writing amanda logs +## Read and write Amanda logs. ## ## ## @@ -134,11 +142,12 @@ interface(`amanda_append_log_files',` ') allow $1 amanda_log_t:file { read_file_perms append_file_perms }; + logging_search_logs($1) ') ####################################### ## -## Search amanda var library directories. +## Search Amanda lib directories. ## ## ## @@ -151,7 +160,6 @@ interface(`amanda_search_var_lib',` type amanda_var_lib_t; ') - files_search_var_lib($1) allow $1 amanda_var_lib_t:dir search_dir_perms; - + files_search_var_lib($1) ')