Implement oident admin.

policy/modules/services/oident.if

@@ -66,3 +66,37 @@ interface(`oident_relabel_user_content',`
 	allow $1 oidentd_home_t:file relabel_file_perms;
 	userdom_search_user_home_dirs($1)
 ')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an oident environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`oident_admin',`
+	gen_require(`
+		type oidentd_t, oidentd_initrc_exec_t, oidentd_config_t;
+	')
+
+	allow $1 oidentd_t:process { ptrace signal_perms };
+	ps_process_pattern($1, oidentd_t)
+
+	init_labeled_script_domtrans($1, oidentd_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 oidentd_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	files_search_etc($1)
+	admin_pattern($1, oidentd_config_t)
+')