diff --git a/policy/modules/services/oident.if b/policy/modules/services/oident.if index a3a9a76..8d47116 100644 --- a/policy/modules/services/oident.if +++ b/policy/modules/services/oident.if @@ -66,3 +66,37 @@ interface(`oident_relabel_user_content',` allow $1 oidentd_home_t:file relabel_file_perms; userdom_search_user_home_dirs($1) ') + +######################################## +## +## All of the rules required to administrate +## an oident environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`oident_admin',` + gen_require(` + type oidentd_t, oidentd_initrc_exec_t, oidentd_config_t; + ') + + allow $1 oidentd_t:process { ptrace signal_perms }; + ps_process_pattern($1, oidentd_t) + + init_labeled_script_domtrans($1, oidentd_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 oidentd_initrc_exec_t system_r; + allow $2 system_r; + + files_search_etc($1) + admin_pattern($1, oidentd_config_t) +')