diff --git a/policy/modules/admin/amanda.if b/policy/modules/admin/amanda.if index 2cb11ea8..d1d035eb 100644 --- a/policy/modules/admin/amanda.if +++ b/policy/modules/admin/amanda.if @@ -1,9 +1,8 @@ -## Advanced Maryland Automatic Network Disk Archiver. +## Automated backup program. ######################################## ## -## Execute a domain transition to -## run Amanda Recover. +## Execute amrecover in the amanda_recover domain. ## ## ## @@ -17,15 +16,12 @@ interface(`amanda_domtrans_recover',` ') domtrans_pattern($1, amanda_recover_exec_t, amanda_recover_t) - corecmd_search_bin($1) ') ######################################## ## -## Execute a domain transition to -## run Amanda Recover and allow the -## specified role the Amanda Recover -## domain. +## Execute amrecover in the amanda_recover domain, and +## allow the specified role the amanda_recover domain. ## ## ## @@ -50,7 +46,7 @@ interface(`amanda_run_recover',` ######################################## ## -## Search Amanda lib directories. +## Search amanda library directories. ## ## ## @@ -65,13 +61,11 @@ interface(`amanda_search_lib',` allow $1 amanda_usr_lib_t:dir search_dir_perms; files_search_usr($1) - libs_search_lib($1) ') ######################################## ## -## Do not audit attempts to read -## dumpdates files. +## Do not audit attempts to read /etc/dumpdates. ## ## ## @@ -84,12 +78,12 @@ interface(`amanda_dontaudit_read_dumpdates',` type amanda_dumpdates_t; ') - dontaudit $1 amanda_dumpdates_t:file read_file_perms; + dontaudit $1 amanda_dumpdates_t:file { getattr read }; ') ######################################## ## -## Read and write dumpdates files. +## Allow read/writing /etc/dumpdates. ## ## ## @@ -103,12 +97,11 @@ interface(`amanda_rw_dumpdates_files',` ') allow $1 amanda_dumpdates_t:file rw_file_perms; - files_search_etc($1) ') ######################################## ## -## Search Amanda lib directories. +## Search amanda library directories. ## ## ## @@ -123,12 +116,11 @@ interface(`amanda_manage_lib',` allow $1 amanda_usr_lib_t:dir manage_dir_perms; files_search_usr($1) - libs_search_lib($1) ') ######################################## ## -## Read and write Amanda logs. +## Allow read/writing amanda logs ## ## ## @@ -142,12 +134,11 @@ interface(`amanda_append_log_files',` ') allow $1 amanda_log_t:file { read_file_perms append_file_perms }; - logging_search_logs($1) ') ####################################### ## -## Search Amanda lib directories. +## Search amanda var library directories. ## ## ## @@ -160,6 +151,7 @@ interface(`amanda_search_var_lib',` type amanda_var_lib_t; ') - allow $1 amanda_var_lib_t:dir search_dir_perms; files_search_var_lib($1) + allow $1 amanda_var_lib_t:dir search_dir_perms; + ')