6bb4d401ee
Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible.
359 lines
6.9 KiB
Plaintext
359 lines
6.9 KiB
Plaintext
## <summary>Common UNIX printing system</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Setup cups to transtion to the cups backend domain
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_backend',`
|
|
gen_require(`
|
|
type cupsd_t;
|
|
')
|
|
|
|
domain_type($1)
|
|
domain_entry_file($1, $2)
|
|
role system_r types $1;
|
|
|
|
domtrans_pattern(cupsd_t, $2, $1)
|
|
allow cupsd_t $1:process signal;
|
|
allow $1 cupsd_t:unix_stream_socket connected_stream_socket_perms;
|
|
|
|
cups_read_config($1)
|
|
cups_append_log($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute cups in the cups domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_domtrans',`
|
|
gen_require(`
|
|
type cupsd_t, cupsd_exec_t;
|
|
')
|
|
|
|
domtrans_pattern($1, cupsd_exec_t, cupsd_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to cupsd over an unix domain stream socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_stream_connect',`
|
|
gen_require(`
|
|
type cupsd_t, cupsd_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
stream_connect_pattern($1, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to cups over TCP. (Deprecated)
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_tcp_connect',`
|
|
refpolicywarn(`$0($*) has been deprecated.')
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send and receive messages from
|
|
## cups over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_dbus_chat',`
|
|
gen_require(`
|
|
type cupsd_t;
|
|
class dbus send_msg;
|
|
')
|
|
|
|
allow $1 cupsd_t:dbus send_msg;
|
|
allow cupsd_t $1:dbus send_msg;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read cups PID files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_read_pid_files',`
|
|
gen_require(`
|
|
type cupsd_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
allow $1 cupsd_var_run_t:file read_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute cups_config in the cups_config domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_domtrans_config',`
|
|
gen_require(`
|
|
type cupsd_config_t, cupsd_config_exec_t;
|
|
')
|
|
|
|
domtrans_pattern($1, cupsd_config_exec_t, cupsd_config_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send generic signals to the cups
|
|
## configuration daemon.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_signal_config',`
|
|
gen_require(`
|
|
type cupsd_config_t;
|
|
')
|
|
|
|
allow $1 cupsd_config_t:process signal;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send and receive messages from
|
|
## cupsd_config over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_dbus_chat_config',`
|
|
gen_require(`
|
|
type cupsd_config_t;
|
|
class dbus send_msg;
|
|
')
|
|
|
|
allow $1 cupsd_config_t:dbus send_msg;
|
|
allow cupsd_config_t $1:dbus send_msg;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read cups configuration files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`cups_read_config',`
|
|
gen_require(`
|
|
type cupsd_etc_t, cupsd_rw_etc_t;
|
|
type hplip_etc_t;
|
|
')
|
|
|
|
files_search_etc($1)
|
|
read_files_pattern($1, cupsd_etc_t, cupsd_etc_t)
|
|
read_files_pattern($1, hplip_etc_t, hplip_etc_t)
|
|
read_files_pattern($1, cupsd_etc_t, cupsd_rw_etc_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read cups-writable configuration files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`cups_read_rw_config',`
|
|
gen_require(`
|
|
type cupsd_etc_t, cupsd_rw_etc_t;
|
|
')
|
|
|
|
files_search_etc($1)
|
|
read_files_pattern($1, cupsd_etc_t, cupsd_rw_etc_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read cups log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`cups_read_log',`
|
|
gen_require(`
|
|
type cupsd_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
allow $1 cupsd_log_t:file read_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Append cups log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_append_log',`
|
|
gen_require(`
|
|
type cupsd_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
append_files_pattern($1, cupsd_log_t, cupsd_log_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Write cups log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_write_log',`
|
|
gen_require(`
|
|
type cupsd_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
allow $1 cupsd_log_t:file write_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to ptal over an unix domain stream socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`cups_stream_connect_ptal',`
|
|
gen_require(`
|
|
type ptal_t, ptal_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
stream_connect_pattern($1, ptal_var_run_t, ptal_var_run_t, ptal_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## All of the rules required to administrate
|
|
## an cups environment
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## The role to be allowed to manage the cups domain.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`cups_admin',`
|
|
gen_require(`
|
|
type cupsd_t, cupsd_tmp_t, cupsd_lpd_tmp_t;
|
|
type cupsd_etc_t, cupsd_log_t, hplip_etc_t;
|
|
type cupsd_config_var_run_t, cupsd_lpd_var_run_t, cupsd_initrc_exec_t;
|
|
type cupsd_var_run_t, ptal_etc_t, hplip_var_run_t;
|
|
type ptal_var_run_t;
|
|
')
|
|
|
|
allow $1 cupsd_t:process { ptrace signal_perms };
|
|
ps_process_pattern($1, cupsd_t)
|
|
|
|
init_labeled_script_domtrans($1, cupsd_initrc_exec_t)
|
|
domain_system_change_exemption($1)
|
|
role_transition $2 cupsd_initrc_exec_t system_r;
|
|
allow $2 system_r;
|
|
|
|
admin_pattern($1, cupsd_etc_t)
|
|
files_list_etc($1)
|
|
|
|
admin_pattern($1, cupsd_config_var_run_t)
|
|
|
|
admin_pattern($1, cupsd_log_t)
|
|
logging_list_logs($1)
|
|
|
|
admin_pattern($1, cupsd_lpd_tmp_t)
|
|
|
|
admin_pattern($1, cupsd_lpd_var_run_t)
|
|
|
|
admin_pattern($1, cupsd_tmp_t)
|
|
files_list_tmp($1)
|
|
|
|
admin_pattern($1, cupsd_var_run_t)
|
|
files_list_pids($1)
|
|
|
|
admin_pattern($1, hplip_etc_t)
|
|
|
|
admin_pattern($1, hplip_var_run_t)
|
|
|
|
admin_pattern($1, ptal_etc_t)
|
|
|
|
admin_pattern($1, ptal_var_run_t)
|
|
')
|