1031ee6f6a
My previous version had a minor bug in admin_role where it was using cobblerd_var_log_t, and cobblerd_var_lib_t instead of cobbler_var_log_t, and cobbler_var_lib_t. Whilst i was at it, i decided the implement a cobbler_etc_t for cobbler content in /etc. This because you cannot admin a cobbler environment witouth having access to cobbler config files and i dont want to give cobbler_admin access to manage etc_t. As a consequence if this i also removed the files_read_etc_files(cobblerd_t), as i think that cobbler only needed it to read its own files in /etc. However this is not confirmed, and it may need read access to etc_t afteral. Also i would like to underscore my reason for using public_content_rw_t. One of the reasons is that i do not want to give cobbler access to manage httpd_sys_content_rw_t. In general i do not want to depend on apache module at all. Signed-off-by: Dominick Grift <domg472@gmail.com> Signed-off-by: Chris PeBenito <pebenito@gentoo.org>
144 lines
2.8 KiB
Plaintext
144 lines
2.8 KiB
Plaintext
## <summary>Fast incremental file transfer for synchronization</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Make rsync an entry point for
|
|
## the specified domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## The domain for which init scripts are an entrypoint.
|
|
## </summary>
|
|
## </param>
|
|
# cjp: added for portage
|
|
interface(`rsync_entry_type',`
|
|
gen_require(`
|
|
type rsync_exec_t;
|
|
')
|
|
|
|
domain_entry_file($1, rsync_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute a rsync in a specified domain.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## Execute a rsync in a specified domain.
|
|
## </p>
|
|
## <p>
|
|
## No interprocess communication (signals, pipes,
|
|
## etc.) is provided by this interface since
|
|
## the domains are not owned by this module.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="source_domain">
|
|
## <summary>
|
|
## Domain to transition from.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="target_domain">
|
|
## <summary>
|
|
## Domain to transition to.
|
|
## </summary>
|
|
## </param>
|
|
# cjp: added for portage
|
|
interface(`rsync_entry_spec_domtrans',`
|
|
gen_require(`
|
|
type rsync_exec_t;
|
|
')
|
|
|
|
domain_trans($1, rsync_exec_t, $2)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute a rsync in a specified domain.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## Execute a rsync in a specified domain.
|
|
## </p>
|
|
## <p>
|
|
## No interprocess communication (signals, pipes,
|
|
## etc.) is provided by this interface since
|
|
## the domains are not owned by this module.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="source_domain">
|
|
## <summary>
|
|
## Domain to transition from.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="target_domain">
|
|
## <summary>
|
|
## Domain to transition to.
|
|
## </summary>
|
|
## </param>
|
|
# cjp: added for portage
|
|
interface(`rsync_entry_domtrans',`
|
|
gen_require(`
|
|
type rsync_exec_t;
|
|
')
|
|
|
|
domain_auto_trans($1, rsync_exec_t, $2)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute rsync in the caller domain domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`rsync_exec',`
|
|
gen_require(`
|
|
type rsync_exec_t;
|
|
')
|
|
|
|
can_exec($1, rsync_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read rsync config files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`rsync_read_config',`
|
|
gen_require(`
|
|
type rsync_etc_t;
|
|
')
|
|
|
|
read_files_pattern($1, rsync_etc_t, rsync_etc_t)
|
|
files_search_etc($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Write to rsync config files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`rsync_write_config',`
|
|
gen_require(`
|
|
type rsync_etc_t;
|
|
')
|
|
|
|
write_files_pattern($1, rsync_etc_t, rsync_etc_t)
|
|
files_search_etc($1)
|
|
')
|