diff options
| author |   Jason Zaman <jason@perfinion.com> | 2015-07-11 13:15:46 +0400 |
|---|---|---|
| committer | Jason Zaman <jason@perfinion.com> | 2015-07-31 00:41:28 +0800 |
| commit | d12c961da29084ced47ff21373925c02fc73e022 (patch) | |
| tree | a683f12486e72edc0037fc030babc7932ba4683c /policy/modules/system/setrans.if | |
| parent | Introduce ipsec_admin interface (diff) | |
| download | hardened-refpolicy-d12c961da29084ced47ff21373925c02fc73e022.tar.gz hardened-refpolicy-d12c961da29084ced47ff21373925c02fc73e022.tar.bz2 hardened-refpolicy-d12c961da29084ced47ff21373925c02fc73e022.zip | |
Introduce setrans_admin interface
Diffstat (limited to 'policy/modules/system/setrans.if')
| -rw-r--r-- | policy/modules/system/setrans.if | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/policy/modules/system/setrans.if b/policy/modules/system/setrans.if index efa9c27f6..2a8ecaadc 100644 --- a/policy/modules/system/setrans.if +++ b/policy/modules/system/setrans.if @@ -40,3 +40,34 @@ interface(`setrans_translate_context',` stream_connect_pattern($1, setrans_var_run_t, setrans_var_run_t, setrans_t) files_list_pids($1) ') + +###################################### +## <summary> +## All of the rules required to +## administrate an setrans environment. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="role"> +## <summary> +## Role allowed access. +## </summary> +## </param> +# +interface(`setrans_admin',` + gen_require(` + type setrans_t, setrans_initrc_exec_t; + type setrans_var_run_t; + ') + + allow $1 setrans_t:process { ptrace signal_perms }; + ps_process_pattern($1, setrans_t) + + init_startstop_service($1, $2, setrans_t, setrans_initrc_exec_t) + + files_search_pids($1) + admin_pattern($1, setrans_var_run_t) +') |