gentoo-overlay/sec-policy/selinux-lego/files/lego.if

194 lines
3.4 KiB
Plaintext
Raw Normal View History

2019-05-08 14:53:59 +03:00
## <summary>policy for lego</summary>
########################################
## <summary>
## Execute lego_exec_t in the lego domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`lego_domtrans',`
gen_require(`
type lego_t, lego_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, lego_exec_t, lego_t)
')
######################################
## <summary>
## Execute lego in the caller domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`lego_exec',`
gen_require(`
type lego_exec_t;
')
corecmd_search_bin($1)
can_exec($1, lego_exec_t)
')
########################################
## <summary>
## Search lego conf directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`lego_search_data',`
gen_require(`
type lego_data_t;
')
allow $1 lego_data_t:dir search_dir_perms;
files_search_etc($1)
')
########################################
## <summary>
## Read lego conf files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`lego_read_data_files',`
gen_require(`
type lego_data_t;
')
allow $1 lego_data_t:dir list_dir_perms;
read_files_pattern($1, lego_data_t, lego_data_t)
files_search_etc($1)
files_search_var_lib($1)
')
########################################
## <summary>
## Manage lego conf files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`lego_manage_data_files',`
gen_require(`
type lego_data_t;
')
manage_files_pattern($1, lego_data_t, lego_data_t)
files_search_etc($1)
files_search_var_lib($1)
')
########################################
## <summary>
## Execute lego in the lego domain, and
## allow the specified role the lego domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to be allowed the lego domain.
## </summary>
## </param>
#
interface(`lego_run',`
gen_require(`
type lego_t;
attribute_role lego_roles;
')
lego_domtrans($1)
roleattribute $2 lego_roles;
')
########################################
## <summary>
## Role access for lego
## </summary>
## <param name="role">
## <summary>
## Role allowed access
## </summary>
## </param>
## <param name="domain">
## <summary>
## User domain for the role
## </summary>
## </param>
#
interface(`lego_role',`
gen_require(`
type lego_t;
attribute_role lego_roles;
')
roleattribute $1 lego_roles;
lego_domtrans($2)
ps_process_pattern($2, lego_t)
allow $2 lego_t:process { signull signal sigkill };
')
########################################
## <summary>
## All of the rules required to administrate
## an lego environment
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`lego_admin',`
gen_require(`
type lego_t;
')
allow $1 lego_t:process { signal_perms };
ps_process_pattern($1, lego_t)
tunable_policy(`deny_ptrace',`',`
allow $1 lego_t:process ptrace;
')
files_search_etc($1)
admin_pattern($1, lego_data_t)
optional_policy(`
systemd_passwd_agent_exec($1)
systemd_read_fifo_file_passwd_run($1)
')
')