2010-03-15 17:13:34 +00:00
|
|
|
## <summary>Likewise Active Directory support for UNIX.</summary>
|
|
|
|
|
## <desc>
|
2010-03-17 13:28:18 +00:00
|
|
|
## <p>
|
|
|
|
|
## Likewise Open is a free, open source application that joins Linux, Unix,
|
|
|
|
|
## and Mac machines to Microsoft Active Directory to securely authenticate
|
|
|
|
|
## users with their domain credentials.
|
|
|
|
|
## </p>
|
2010-03-15 17:13:34 +00:00
|
|
|
## </desc>
|
|
|
|
|
|
|
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## The template to define a likewise domain.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <desc>
|
|
|
|
|
## <p>
|
|
|
|
|
## This template creates a domain to be used for
|
|
|
|
|
## a new likewise daemon.
|
|
|
|
|
## </p>
|
|
|
|
|
## </desc>
|
|
|
|
|
## <param name="userdomain_prefix">
|
|
|
|
|
## <summary>
|
|
|
|
|
## The type of daemon to be used.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
template(`likewise_domain_template',`
|
|
|
|
|
|
|
|
|
|
gen_require(`
|
|
|
|
|
attribute likewise_domains;
|
|
|
|
|
type likewise_var_lib_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# Declarations
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
type $1_t;
|
|
|
|
|
type $1_exec_t;
|
|
|
|
|
init_daemon_domain($1_t, $1_exec_t)
|
|
|
|
|
domain_use_interactive_fds($1_t)
|
|
|
|
|
|
|
|
|
|
typeattribute $1_t likewise_domains;
|
|
|
|
|
|
|
|
|
|
type $1_var_run_t;
|
|
|
|
|
files_pid_file($1_var_run_t)
|
|
|
|
|
|
|
|
|
|
type $1_var_socket_t;
|
|
|
|
|
files_type($1_var_socket_t)
|
|
|
|
|
|
|
|
|
|
type $1_var_lib_t;
|
|
|
|
|
files_type($1_var_lib_t)
|
|
|
|
|
|
|
|
|
|
####################################
|
|
|
|
|
#
|
|
|
|
|
# Local Policy
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
allow $1_t self:process { signal_perms getsched setsched };
|
|
|
|
|
allow $1_t self:fifo_file rw_fifo_file_perms;
|
|
|
|
|
allow $1_t self:unix_dgram_socket create_socket_perms;
|
|
|
|
|
allow $1_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
|
allow $1_t self:tcp_socket create_stream_socket_perms;
|
|
|
|
|
allow $1_t self:udp_socket create_socket_perms;
|
|
|
|
|
|
|
|
|
|
allow $1_t likewise_var_lib_t:dir setattr;
|
|
|
|
|
|
|
|
|
|
manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
|
|
|
|
|
files_pid_filetrans($1_t, $1_var_run_t, file)
|
|
|
|
|
|
|
|
|
|
manage_files_pattern($1_t, likewise_var_lib_t, $1_var_lib_t)
|
|
|
|
|
filetrans_pattern($1_t, likewise_var_lib_t, $1_var_lib_t, file)
|
|
|
|
|
|
|
|
|
|
manage_sock_files_pattern($1_t, likewise_var_lib_t, $1_var_socket_t)
|
|
|
|
|
filetrans_pattern($1_t, likewise_var_lib_t, $1_var_socket_t, sock_file)
|
|
|
|
|
|
|
|
|
|
dev_read_rand($1_t)
|
|
|
|
|
dev_read_urand($1_t)
|
|
|
|
|
|
|
|
|
|
files_read_etc_files($1_t)
|
|
|
|
|
files_search_var_lib($1_t)
|
|
|
|
|
|
|
|
|
|
logging_send_syslog_msg($1_t)
|
|
|
|
|
|
|
|
|
|
miscfiles_read_localization($1_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Connect to lsassd.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`likewise_stream_connect_lsassd',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type likewise_var_lib_t, lsassd_var_socket_t, lsassd_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
files_search_pids($1)
|
|
|
|
|
stream_connect_pattern($1, likewise_var_lib_t, lsassd_var_socket_t, lsassd_t)
|
|
|
|
|
')
|
