modutils: adjust interfaces after recent binaries merge

1 files changed, 89 insertions, 58 deletions

diff --git a/policy/modules/system/modutils.if b/policy/modules/system/modutils.if
index 880730c9..9f487e1c 100644
--- a/policy/modules/system/modutils.if
+++ b/policy/modules/system/modutils.if
@@ -123,7 +123,9 @@ interface(`modutils_manage_module_config',`
 
 ########################################
 ## <summary>
-##	Unconditionally execute insmod in the insmod domain.
+##	Execute any modutil,
+##	like insmod, kmod, depmod or updates-modules,
+##	in the kmod domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -131,34 +133,95 @@ interface(`modutils_manage_module_config',`
 ##	</summary>
 ## </param>
 #
-# cjp: this is added for pppd, due to nested
-# conditionals not working.
-interface(`modutils_domtrans_insmod_uncond',`
+interface(`modutils_domtrans',`
 	gen_require(`
-		type insmod_t, insmod_exec_t;
+		type kmod_t, kmod_exec_t;
 	')
 
 	corecmd_search_bin($1)
-	domtrans_pattern($1, insmod_exec_t, insmod_t)
+	domtrans_pattern($1, kmod_exec_t, kmod_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute insmod in the insmod domain.
+##	Execute any modutil,
+##	like insmod, kmod, depmod or updates-modules,
+##	in the kmod domain, and allow the specified role
+##	the kmod domain, and use the caller's terminal.
+##	Has a sigchld backchannel.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed to transition.
 ##	</summary>
 ## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
 #
-interface(`modutils_domtrans_insmod',`
+interface(`modutils_run',`
 	gen_require(`
-		type insmod_t, insmod_exec_t;
+		attribute_role kmod_roles;
+	')
+
+	modutils_domtrans_insmod($1)
+	roleattribute $2 kmod_roles;
+')
+
+########################################
+## <summary>
+##	Execute any modutil,
+##	like insmod, kmod, depmod or updates-modules,
+##	in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`modutils_exec',`
+	gen_require(`
+		type kmod_exec_t;
 	')
 
 	corecmd_search_bin($1)
-	domtrans_pattern($1, insmod_exec_t, insmod_t)
+	can_exec($1, kmod_exec_t)
+')
+
+########################################
+## <summary>
+##	Unconditionally execute insmod in the insmod domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+# cjp: this is added for pppd, due to nested
+# conditionals not working.
+interface(`modutils_domtrans_insmod_uncond',`
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_domtrans() instead.')
+	modutils_domtrans($1)
+')
+
+########################################
+## <summary>
+##	Execute insmod in the insmod domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`modutils_domtrans_insmod',`
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_domtrans() instead.')
+	modutils_domtrans($1)
 ')
 
 ########################################
@@ -181,12 +244,8 @@ interface(`modutils_domtrans_insmod',`
 ## <rolecap/>
 #
 interface(`modutils_run_insmod',`
-	gen_require(`
-		type insmod_t;
-	')
-
-	modutils_domtrans_insmod($1)
-	role $2 types insmod_t;
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_run() instead.')
+	modutils_run($1, $2)
 ')
 
 ########################################
@@ -200,12 +259,8 @@ interface(`modutils_run_insmod',`
 ## </param>
 #
 interface(`modutils_exec_insmod',`
-	gen_require(`
-		type insmod_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	can_exec($1, insmod_exec_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_exec() instead.')
+	modutils_exec($1)
 ')
 
 ########################################
@@ -219,12 +274,8 @@ interface(`modutils_exec_insmod',`
 ## </param>
 #
 interface(`modutils_domtrans_depmod',`
-	gen_require(`
-		type depmod_t, depmod_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, depmod_exec_t, depmod_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_domtrans() instead.')
+	modutils_domtrans($1)
 ')
 
 ########################################
@@ -244,12 +295,8 @@ interface(`modutils_domtrans_depmod',`
 ## <rolecap/>
 #
 interface(`modutils_run_depmod',`
-	gen_require(`
-		type depmod_t, insmod_t;
-	')
-
-	modutils_domtrans_depmod($1)
-	role $2 types depmod_t;
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_run() instead.')
+	modutils_run($1, $2)
 ')
 
 ########################################
@@ -263,12 +310,8 @@ interface(`modutils_run_depmod',`
 ## </param>
 #
 interface(`modutils_exec_depmod',`
-	gen_require(`
-		type depmod_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	can_exec($1, depmod_exec_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_exec() instead.')
+	modutils_exec($1)
 ')
 
 ########################################
@@ -282,12 +325,8 @@ interface(`modutils_exec_depmod',`
 ## </param>
 #
 interface(`modutils_domtrans_update_mods',`
-	gen_require(`
-		type update_modules_t, update_modules_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, update_modules_exec_t, update_modules_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_domtrans() instead.')
+	modutils_domtrans($1)
 ')
 
 ########################################
@@ -307,12 +346,8 @@ interface(`modutils_domtrans_update_mods',`
 ## <rolecap/>
 #
 interface(`modutils_run_update_mods',`
-	gen_require(`
-		attribute_role update_modules_roles;
-	')
-
-	modutils_domtrans_update_mods($1)
-	roleattribute $2 update_modules_roles;
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_run() instead.')
+	modutils_run($1, $2)
 ')
 
 ########################################
@@ -326,12 +361,8 @@ interface(`modutils_run_update_mods',`
 ## </param>
 #
 interface(`modutils_exec_update_mods',`
-	gen_require(`
-		type update_modules_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	can_exec($1, update_modules_exec_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_exec() instead.')
+	modutils_exec($1)
 ')
 
 ########################################