8f0b7460ea
Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Syntax error. Squash me with 959aa527a5394d23b994ecf75347d2445106d0c4 Replace type and attributes statements by comma delimiters where possible. Syntax error. Squach me with 779a708452142d6e4ac2ba2a158f724782a03291 Replace type and attributes statements by comma delimiters where possible. Syntax error. Squash me with 89180ea115794aadddaa9b356ab1dfcdc9ff102
269 lines
5.0 KiB
Plaintext
269 lines
5.0 KiB
Plaintext
## <summary>policy for daemon for playing music</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute a domain transition to run mpd.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_domtrans',`
|
|
gen_require(`
|
|
type mpd_t, mpd_exec_t;
|
|
')
|
|
|
|
domtrans_pattern($1, mpd_exec_t, mpd_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute mpd server in the mpd domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_initrc_domtrans',`
|
|
gen_require(`
|
|
type mpd_initrc_exec_t;
|
|
')
|
|
|
|
init_labeled_script_domtrans($1, mpd_initrc_exec_t)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Read mpd data files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_read_data_files',`
|
|
gen_require(`
|
|
type mpd_data_t;
|
|
')
|
|
|
|
mpd_search_lib($1)
|
|
read_files_pattern($1, mpd_data_t, mpd_data_t)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Read mpd tmpfs files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_read_tmpfs_files',`
|
|
gen_require(`
|
|
type mpd_tmpfs_t;
|
|
')
|
|
|
|
fs_search_tmpfs($1)
|
|
read_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
|
|
')
|
|
|
|
###################################
|
|
## <summary>
|
|
## Manage mpd tmpfs files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_manage_tmpfs_files',`
|
|
gen_require(`
|
|
type mpd_tmpfs_t;
|
|
')
|
|
|
|
fs_search_tmpfs($1)
|
|
manage_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
|
|
manage_lnk_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
|
|
')
|
|
|
|
######################################
|
|
## <summary>
|
|
## Manage mpd data files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_manage_data_files',`
|
|
gen_require(`
|
|
type mpd_data_t;
|
|
')
|
|
|
|
mpd_search_lib($1)
|
|
manage_files_pattern($1, mpd_data_t, mpd_data_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Search mpd lib directories.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_search_lib',`
|
|
gen_require(`
|
|
type mpd_var_lib_t;
|
|
')
|
|
|
|
allow $1 mpd_var_lib_t:dir search_dir_perms;
|
|
files_search_var_lib($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read mpd lib files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_read_lib_files',`
|
|
gen_require(`
|
|
type mpd_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
read_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create, read, write, and delete
|
|
## mpd lib files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_manage_lib_files',`
|
|
gen_require(`
|
|
type mpd_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
manage_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Create an object in the root directory, with a private
|
|
## type using a type transition.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="private type">
|
|
## <summary>
|
|
## The type of the object to be created.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="object">
|
|
## <summary>
|
|
## The object class of the object being created.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_var_lib_filetrans',`
|
|
gen_require(`
|
|
type mpd_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
filetrans_pattern($1, mpd_var_lib_t, $2, $3)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Manage mpd lib dirs files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`mpd_manage_lib_dirs',`
|
|
gen_require(`
|
|
type mpd_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
manage_dirs_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## All of the rules required to administrate
|
|
## an mpd environment
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`mpd_admin',`
|
|
gen_require(`
|
|
type mpd_t, mpd_initrc_exec_t, mpd_etc_t;
|
|
type mpd_data_t, mpd_log_t, mpd_var_lib_t;
|
|
type mpd_tmpfs_t;
|
|
')
|
|
|
|
allow $1 mpd_t:process { ptrace signal_perms };
|
|
ps_process_pattern($1, mpd_t)
|
|
|
|
mpd_initrc_domtrans($1)
|
|
domain_system_change_exemption($1)
|
|
role_transition $2 mpd_initrc_exec_t system_r;
|
|
allow $2 system_r;
|
|
|
|
admin_pattern($1, mpd_etc_t)
|
|
files_search_etc($1)
|
|
|
|
files_search_var_lib($1)
|
|
admin_pattern($1, mpd_var_lib_t)
|
|
|
|
mpd_search_lib($1)
|
|
admin_pattern($1, mpd_data_t)
|
|
|
|
admin_pattern($1, mpd_log_t)
|
|
|
|
fs_search_tmpfs($1)
|
|
admin_pattern($1, mpd_tmpfs_t)
|
|
')
|