## nslcd - local LDAP name service daemon. ######################################## ## ## Execute a domain transition to run nslcd. ## ## ## ## Domain allowed to transition. ## ## # interface(`nslcd_domtrans',` gen_require(` type nslcd_t, nslcd_exec_t; ') domtrans_pattern($1, nslcd_exec_t, nslcd_t) ') ######################################## ## ## Execute nslcd server in the nslcd domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`nslcd_initrc_domtrans',` gen_require(` type nslcd_initrc_exec_t; ') init_labeled_script_domtrans($1, nslcd_initrc_exec_t) ') ######################################## ## ## Read nslcd PID files. ## ## ## ## Domain allowed access. ## ## # interface(`nslcd_read_pid_files',` gen_require(` type nslcd_var_run_t; ') files_search_pids($1) allow $1 nslcd_var_run_t:file read_file_perms; ') ######################################## ## ## Connect to nslcd over an unix stream socket. ## ## ## ## Domain allowed access. ## ## # interface(`nslcd_stream_connect',` gen_require(` type nslcd_t, nslcd_var_run_t; ') stream_connect_pattern($1, nslcd_var_run_t, nslcd_var_run_t, nslcd_t) files_search_pids($1) ') ######################################## ## ## All of the rules required to administrate ## an nslcd environment ## ## ## ## Domain allowed access. ## ## ## ## ## Role allowed access. ## ## ## # interface(`nslcd_admin',` gen_require(` type nslcd_t, nslcd_initrc_exec_t, nslcd_var_run_t; type nslcd_conf_t; ') ps_process_pattern($1, nslcd_t) allow $1 nslcd_t:process { ptrace signal_perms }; # Allow nslcd_t to restart the apache service nslcd_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 nslcd_initrc_exec_t system_r; allow $2 system_r; files_search_etc($1) admin_pattern($1, nslcd_conf_t) files_search_pids($1) admin_pattern($1, nslcd_var_run_t, nslcd_var_run_t) ')