|
Dominick Grift |
b0b07ad |
## <summary>Collection of tools for managing UNIX services.</summary>
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## An ipc channel between the
|
|
Dominick Grift |
b0b07ad |
## supervised domain and svc_start_t.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_ipc_domain',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type svc_start_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow $1 svc_start_t:process sigchld;
|
|
|
1ec3d1a |
allow $1 svc_start_t:fd use;
|
|
Dominick Grift |
b0b07ad |
allow $1 svc_start_t:fifo_file rw_fifo_file_perms;
|
|
|
1ec3d1a |
allow svc_start_t $1:process signal;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Create a domain which can be
|
|
Dominick Grift |
b0b07ad |
## started by daemontools.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Type to be used as a domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
## <param name="entrypoint">
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Type of the program to be used as an entry point to this domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_service_domain',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type svc_run_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
domain_auto_trans(svc_run_t, $2, $1)
|
|
|
1ec3d1a |
daemontools_ipc_domain($1)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow svc_run_t $1:process signal;
|
|
|
1ec3d1a |
allow $1 svc_run_t:fd use;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Execute svc start in the svc
|
|
Dominick Grift |
b0b07ad |
## start domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed to transition.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_domtrans_start',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type svc_start_t, svc_start_exec_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
b0b07ad |
corecmd_search_bin($1)
|
|
|
1ec3d1a |
domtrans_pattern($1, svc_start_exec_t, svc_start_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
######################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Execute svc start in the svc
|
|
Dominick Grift |
b0b07ad |
## start domain, and allow the
|
|
Dominick Grift |
b0b07ad |
## specified role the svc start domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
Dominick Grift |
b0b07ad |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Domain allowed to transition.
|
|
Dominick Grift |
b0b07ad |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
## <param name="role">
|
|
Dominick Grift |
b0b07ad |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Role allowed access.
|
|
Dominick Grift |
b0b07ad |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
## <rolecap/>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemonstools_run_start',`
|
|
Dominick Grift |
b0b07ad |
gen_require(`
|
|
Dominick Grift |
b0b07ad |
attribute_role svc_start_roles;
|
|
Dominick Grift |
b0b07ad |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
b0b07ad |
daemontools_domtrans_start($1)
|
|
Dominick Grift |
b0b07ad |
roleattribute $2 svc_start_roles;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Execute avc run in the svc run domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed to transition.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_domtrans_run',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type svc_run_t, svc_run_exec_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
b0b07ad |
corecmd_search_bin($1)
|
|
|
1ec3d1a |
domtrans_pattern($1, svc_run_exec_t, svc_run_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
######################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Send child terminated signals
|
|
Dominick Grift |
b0b07ad |
## to svc run.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
Dominick Grift |
b0b07ad |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Domain allowed access.
|
|
Dominick Grift |
b0b07ad |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_sigchld_run',`
|
|
Dominick Grift |
b0b07ad |
gen_require(`
|
|
|
1ec3d1a |
type svc_run_t;
|
|
Dominick Grift |
b0b07ad |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
b0b07ad |
allow $1 svc_run_t:process sigchld;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Execute avc multilog in the svc
|
|
Dominick Grift |
b0b07ad |
## multilog domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed to transition.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_domtrans_multilog',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type svc_multilog_t, svc_multilog_exec_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
b0b07ad |
corecmd_search_bin($1)
|
|
|
1ec3d1a |
domtrans_pattern($1, svc_multilog_exec_t, svc_multilog_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
######################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Search svc svc directories.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
Dominick Grift |
b0b07ad |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Domain allowed access.
|
|
Dominick Grift |
b0b07ad |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_search_svc_dir',`
|
|
Dominick Grift |
b0b07ad |
gen_require(`
|
|
|
1ec3d1a |
type svc_svc_t;
|
|
Dominick Grift |
b0b07ad |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
b0b07ad |
files_search_var($1)
|
|
Dominick Grift |
b0b07ad |
allow $1 svc_svc_t:dir search_dir_perms;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Read svc avc files.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
## <rolecap/>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_read_svc',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type svc_svc_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
b0b07ad |
files_search_var($1)
|
|
|
1ec3d1a |
allow $1 svc_svc_t:dir list_dir_perms;
|
|
|
1ec3d1a |
allow $1 svc_svc_t:file read_file_perms;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
Dominick Grift |
b0b07ad |
## Create, read, write and delete
|
|
Dominick Grift |
b0b07ad |
## svc svc content.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
## <rolecap/>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`daemontools_manage_svc',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type svc_svc_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
b0b07ad |
files_search_var($1)
|
|
|
1ec3d1a |
allow $1 svc_svc_t:dir manage_dir_perms;
|
|
|
1ec3d1a |
allow $1 svc_svc_t:fifo_file manage_fifo_file_perms;
|
|
|
1ec3d1a |
allow $1 svc_svc_t:file manage_file_perms;
|
|
Dominick Grift |
b0b07ad |
allow $1 svc_svc_t:lnk_file manage_lnk_file_perms;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|