selinux-policy/policy/modules/services/certmaster.if

145 lines
3.0 KiB
Plaintext
Raw Normal View History

2009-05-06 14:26:20 +00:00
## <summary>Certmaster SSL certificate distribution service</summary>
########################################
## <summary>
## Execute a domain transition to run certmaster.
## </summary>
## <param name="domain">
## <summary>
2009-05-06 14:26:20 +00:00
## Domain allowed to transition.
## </summary>
2009-05-06 14:26:20 +00:00
## </param>
#
interface(`certmaster_domtrans',`
gen_require(`
type certmaster_t, certmaster_exec_t;
')
domtrans_pattern($1, certmaster_exec_t, certmaster_t)
')
2010-08-30 14:27:12 +00:00
####################################
## <summary>
## Execute certmaster in the caller domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`certmaster_exec',`
gen_require(`
type certmaster_exec_t;
')
can_exec($1, certmaster_exec_t)
corecmd_search_bin($1)
')
2009-05-06 14:26:20 +00:00
#######################################
## <summary>
2009-06-26 14:40:13 +00:00
## read certmaster logs.
2009-05-06 14:26:20 +00:00
## </summary>
## <param name="domain">
2009-06-26 14:40:13 +00:00
## <summary>
## Domain allowed access.
## </summary>
2009-05-06 14:26:20 +00:00
## </param>
#
interface(`certmaster_read_log',`
2009-06-26 14:40:13 +00:00
gen_require(`
type certmaster_var_log_t;
')
2009-05-06 14:26:20 +00:00
2009-06-26 14:40:13 +00:00
read_files_pattern($1, certmaster_var_log_t, certmaster_var_log_t)
2009-05-06 14:26:20 +00:00
logging_search_logs($1)
')
#######################################
## <summary>
2009-06-26 14:40:13 +00:00
## Append to certmaster logs.
2009-05-06 14:26:20 +00:00
## </summary>
## <param name="domain">
2009-06-26 14:40:13 +00:00
## <summary>
## Domain allowed access.
## </summary>
2009-05-06 14:26:20 +00:00
## </param>
#
interface(`certmaster_append_log',`
2009-06-26 14:40:13 +00:00
gen_require(`
type certmaster_var_log_t;
')
2009-05-06 14:26:20 +00:00
2009-06-26 14:40:13 +00:00
append_files_pattern($1, certmaster_var_log_t, certmaster_var_log_t)
2009-05-06 14:26:20 +00:00
logging_search_logs($1)
')
#######################################
## <summary>
2009-06-26 14:40:13 +00:00
## Create, read, write, and delete
## certmaster logs.
2009-05-06 14:26:20 +00:00
## </summary>
## <param name="domain">
2009-06-26 14:40:13 +00:00
## <summary>
## Domain allowed access.
## </summary>
2009-05-06 14:26:20 +00:00
## </param>
#
interface(`certmaster_manage_log',`
2009-06-26 14:40:13 +00:00
gen_require(`
type certmaster_var_log_t;
')
2009-05-06 14:26:20 +00:00
2009-06-26 14:40:13 +00:00
manage_files_pattern($1, certmaster_var_log_t, certmaster_var_log_t)
manage_lnk_files_pattern($1, certmaster_var_log_t, certmaster_var_log_t)
2009-05-06 14:26:20 +00:00
logging_search_logs($1)
')
########################################
## <summary>
2010-08-30 14:27:12 +00:00
## All of the rules required to administrate
2009-05-06 14:26:20 +00:00
## an snort environment
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
2009-05-06 14:26:20 +00:00
## </summary>
## </param>
## <rolecap/>
#
interface(`certmaster_admin',`
gen_require(`
type certmaster_t, certmaster_var_run_t, certmaster_var_lib_t;
Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible.
2010-09-17 07:49:15 +00:00
type certmaster_etc_rw_t, certmaster_var_log_t, certmaster_initrc_exec_t;
2009-05-06 14:26:20 +00:00
')
allow $1 certmaster_t:process { ptrace signal_perms };
ps_process_pattern($1, certmaster_t)
init_labeled_script_domtrans($1, certmaster_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 certmaster_initrc_exec_t system_r;
allow $2 system_r;
files_list_etc($1)
miscfiles_manage_generic_cert_dirs($1)
miscfiles_manage_generic_cert_files($1)
2009-05-06 14:26:20 +00:00
admin_pattern($1, certmaster_etc_rw_t)
files_list_pids($1)
admin_pattern($1, certmaster_var_run_t)
logging_list_logs($1)
admin_pattern($1, certmaster_var_log_t)
2009-05-06 14:44:57 +00:00
2009-05-06 14:26:20 +00:00
files_list_var_lib($1)
admin_pattern($1, certmaster_var_lib_t)
')