|
Dominick Grift |
08d60ce |
## <summary>Hardware detection and configuration tools.</summary>
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Execute kudzu in the kudzu domain.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed to transition.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`kudzu_domtrans',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type kudzu_t, kudzu_exec_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
08d60ce |
corecmd_search_bin($1)
|
|
Chris PeBenito |
9401ae1 |
domtrans_pattern($1, kudzu_exec_t, kudzu_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Execute kudzu in the kudzu domain, and
|
|
Chris PeBenito |
9401ae1 |
## allow the specified role the kudzu domain.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed to transition.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
## <param name="role">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Role allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
## <rolecap/>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`kudzu_run',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Dominick Grift |
08d60ce |
attribute_role kudzu_roles;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
kudzu_domtrans($1)
|
|
Dominick Grift |
08d60ce |
roleattribute $2 kudzu_roles;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Dominick Grift |
08d60ce |
## Get attributes of kudzu executable files.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`kudzu_getattr_exec_files',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type kudzu_exec_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
08d60ce |
allow $1 kudzu_exec_t:file getattr_file_perms;
|
|
Dominick Grift |
08d60ce |
')
|
|
Dominick Grift |
08d60ce |
|
|
Dominick Grift |
08d60ce |
########################################
|
|
Dominick Grift |
08d60ce |
## <summary>
|
|
Dominick Grift |
08d60ce |
## All of the rules required to
|
|
Dominick Grift |
08d60ce |
## administrate an kudzu environment.
|
|
Dominick Grift |
08d60ce |
## </summary>
|
|
Dominick Grift |
08d60ce |
## <param name="domain">
|
|
Dominick Grift |
08d60ce |
## <summary>
|
|
Dominick Grift |
08d60ce |
## Domain allowed access.
|
|
Dominick Grift |
08d60ce |
## </summary>
|
|
Dominick Grift |
08d60ce |
## </param>
|
|
Dominick Grift |
08d60ce |
## <param name="role">
|
|
Dominick Grift |
08d60ce |
## <summary>
|
|
Dominick Grift |
08d60ce |
## Role allowed access.
|
|
Dominick Grift |
08d60ce |
## </summary>
|
|
Dominick Grift |
08d60ce |
## </param>
|
|
Dominick Grift |
08d60ce |
## <rolecap/>
|
|
Dominick Grift |
08d60ce |
#
|
|
Dominick Grift |
08d60ce |
interface(`kudzu_admin',`
|
|
Dominick Grift |
08d60ce |
gen_require(`
|
|
Dominick Grift |
08d60ce |
type kudzu_t, kudzu_initrc_exec_t, kudzu_var_run_t;
|
|
Dominick Grift |
08d60ce |
type kudzu_tmp_t;
|
|
Dominick Grift |
08d60ce |
')
|
|
Dominick Grift |
08d60ce |
|
|
|
521831c |
allow $1 kudzu_t:process { signal_perms };
|
|
Dominick Grift |
08d60ce |
ps_process_pattern($1, kudzu_t)
|
|
Dominick Grift |
08d60ce |
|
|
|
521831c |
tunable_policy(`deny_ptrace',`',`
|
|
|
521831c |
allow $1 kudzu_t:process ptrace;
|
|
|
521831c |
')
|
|
|
521831c |
|
|
Dominick Grift |
08d60ce |
init_labeled_script_domtrans($1, kudzu_initrc_exec_t)
|
|
Dominick Grift |
08d60ce |
domain_system_change_exemption($1)
|
|
Dominick Grift |
08d60ce |
role_transition $2 kudzu_initrc_exec_t system_r;
|
|
Dominick Grift |
08d60ce |
allow $2 system_r;
|
|
Dominick Grift |
08d60ce |
|
|
Dominick Grift |
08d60ce |
files_search_tmp($1)
|
|
Dominick Grift |
08d60ce |
admin_pattern($1, kudzu_tmp_t)
|
|
Dominick Grift |
08d60ce |
|
|
Dominick Grift |
08d60ce |
files_search_pids($1)
|
|
Dominick Grift |
08d60ce |
admin_pattern($1, kudzu_var_run_t)
|
|
Dominick Grift |
08d60ce |
|
|
Dominick Grift |
08d60ce |
kudzu_run($1, $2)
|
|
Chris PeBenito |
9401ae1 |
')
|