|
Dominick Grift |
b7e6403 |
## <summary>Policy for NIS (YP) servers and clients.</summary>
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Use the ypbind service to access NIS services
|
|
Chris PeBenito |
9401ae1 |
## unconditionally.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <desc>
|
|
Chris PeBenito |
9401ae1 |
##
|
|
Chris PeBenito |
9401ae1 |
## Use the ypbind service to access NIS services
|
|
Chris PeBenito |
9401ae1 |
## unconditionally.
|
|
Chris PeBenito |
9401ae1 |
##
|
|
Chris PeBenito |
9401ae1 |
##
|
|
Chris PeBenito |
9401ae1 |
## This interface was added because of apache and
|
|
Chris PeBenito |
9401ae1 |
## spamassassin, to fix a nested conditionals problem.
|
|
Chris PeBenito |
9401ae1 |
## When that support is added, this should be removed,
|
|
Chris PeBenito |
9401ae1 |
## and the regular interface should be used.
|
|
Chris PeBenito |
9401ae1 |
##
|
|
Chris PeBenito |
9401ae1 |
## </desc>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_use_ypbind_uncond',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type var_yp_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow $1 self:capability net_bind_service;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow $1 self:tcp_socket create_stream_socket_perms;
|
|
Chris PeBenito |
9401ae1 |
allow $1 self:udp_socket create_socket_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow $1 var_yp_t:dir list_dir_perms;
|
|
Chris PeBenito |
9401ae1 |
allow $1 var_yp_t:file read_file_perms;
|
|
Dominick Grift |
b7e6403 |
allow $1 var_yp_t:lnk_file read_lnk_file_perms;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
corenet_all_recvfrom_unlabeled($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_all_recvfrom_netlabel($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_sendrecv_generic_if($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_udp_sendrecv_generic_if($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_sendrecv_generic_node($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_udp_sendrecv_generic_node($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_sendrecv_all_ports($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_udp_sendrecv_all_ports($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_bind_generic_node($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_udp_bind_generic_node($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_bind_generic_port($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_udp_bind_generic_port($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_dontaudit_tcp_bind_all_reserved_ports($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_dontaudit_udp_bind_all_reserved_ports($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_dontaudit_tcp_bind_all_ports($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_dontaudit_udp_bind_all_ports($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_connect_portmap_port($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_connect_reserved_port($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_connect_generic_port($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_dontaudit_tcp_connect_all_ports($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_sendrecv_portmap_client_packets($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_sendrecv_generic_client_packets($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_sendrecv_generic_server_packets($1)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
sysnet_read_config($1)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Use the ypbind service to access NIS services.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <desc>
|
|
Chris PeBenito |
9401ae1 |
##
|
|
Chris PeBenito |
9401ae1 |
## Allow the specified domain to use the ypbind service
|
|
Chris PeBenito |
9401ae1 |
## to access Network Information Service (NIS) services.
|
|
Chris PeBenito |
9401ae1 |
## Information that can be retreived from NIS includes
|
|
Chris PeBenito |
9401ae1 |
## usernames, passwords, home directories, and groups.
|
|
Chris PeBenito |
9401ae1 |
## If the network is configured to have a single sign-on
|
|
Chris PeBenito |
9401ae1 |
## using NIS, it is likely that any program that does
|
|
Chris PeBenito |
9401ae1 |
## authentication will need this access.
|
|
Chris PeBenito |
9401ae1 |
##
|
|
Chris PeBenito |
9401ae1 |
## </desc>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
## <infoflow type="both" weight="10"/>
|
|
Chris PeBenito |
9401ae1 |
## <rolecap/>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_use_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
tunable_policy(`allow_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
nis_use_ypbind_uncond($1)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Dominick Grift |
b7e6403 |
## Use nis to authenticate passwords.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
## <rolecap/>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_authenticate',`
|
|
Chris PeBenito |
9401ae1 |
tunable_policy(`allow_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
nis_use_ypbind_uncond($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_tcp_bind_all_rpc_ports($1)
|
|
Chris PeBenito |
9401ae1 |
corenet_udp_bind_all_rpc_ports($1)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Execute ypbind in the ypbind domain.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed to transition.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_domtrans_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type ypbind_t, ypbind_exec_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
corecmd_search_bin($1)
|
|
Chris PeBenito |
9401ae1 |
domtrans_pattern($1, ypbind_exec_t, ypbind_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Execute ypbind in the ypbind domain, and
|
|
Chris PeBenito |
9401ae1 |
## allow the specified role the ypbind domain.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed to transition.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
## <param name="role">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Role allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
## <rolecap/>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_run_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Dominick Grift |
b7e6403 |
attribute_role ypbind_roles;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
nis_domtrans_ypbind($1)
|
|
Dominick Grift |
b7e6403 |
roleattribute $2 ypbind_roles;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Send generic signals to ypbind.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_signal_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type ypbind_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow $1 ypbind_t:process signal;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Dominick Grift |
b7e6403 |
## List nis data directories.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_list_var_yp',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type var_yp_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_search_var($1)
|
|
Chris PeBenito |
9401ae1 |
allow $1 var_yp_t:dir list_dir_perms;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Send UDP network traffic to NIS clients. (Deprecated)
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_udp_send_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
refpolicywarn(`$0($*) has been deprecated.')
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Connect to ypbind over TCP. (Deprecated)
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_tcp_connect_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
refpolicywarn(`$0($*) has been deprecated.')
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Read ypbind pid files.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_read_ypbind_pid',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type ypbind_var_run_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_search_pids($1)
|
|
Chris PeBenito |
9401ae1 |
allow $1 ypbind_var_run_t:file read_file_perms;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Delete ypbind pid files.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_delete_ypbind_pid',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Dominick Grift |
b7e6403 |
type ypbind_var_run_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
b7e6403 |
allow $1 ypbind_var_run_t:file delete_file_perms;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Read ypserv configuration files.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_read_ypserv_config',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type ypserv_conf_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_search_etc($1)
|
|
Chris PeBenito |
9401ae1 |
allow $1 ypserv_conf_t:file read_file_perms;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Execute ypxfr in the ypxfr domain.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed to transition.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_domtrans_ypxfr',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type ypxfr_t, ypxfr_exec_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
corecmd_search_bin($1)
|
|
Chris PeBenito |
9401ae1 |
domtrans_pattern($1, ypxfr_exec_t, ypxfr_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Execute nis server in the nis domain.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed to transition.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_initrc_domtrans',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type nis_initrc_exec_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
init_labeled_script_domtrans($1, nis_initrc_exec_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Execute nis server in the nis domain.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed to transition.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_initrc_domtrans_ypbind',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type ypbind_initrc_exec_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
init_labeled_script_domtrans($1, ypbind_initrc_exec_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Dominick Grift |
b7e6403 |
## All of the rules required to
|
|
Dominick Grift |
b7e6403 |
## administrate an nis environment.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## <param name="domain">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Domain allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
## <param name="role">
|
|
Chris PeBenito |
9401ae1 |
## <summary>
|
|
Chris PeBenito |
9401ae1 |
## Role allowed access.
|
|
Chris PeBenito |
9401ae1 |
## </summary>
|
|
Chris PeBenito |
9401ae1 |
## </param>
|
|
Chris PeBenito |
9401ae1 |
## <rolecap/>
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
interface(`nis_admin',`
|
|
Chris PeBenito |
9401ae1 |
gen_require(`
|
|
Chris PeBenito |
9401ae1 |
type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t;
|
|
Chris PeBenito |
9401ae1 |
type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t;
|
|
Chris PeBenito |
9401ae1 |
type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t;
|
|
Dominick Grift |
b7e6403 |
type ypbind_initrc_exec_t, nis_initrc_exec_t, var_yp_t;
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
b7e6403 |
allow $1 { ypbind_t yppasswdd_t ypserv_t ypxfr_t }:process { ptrace signal_perms };
|
|
Dominick Grift |
b7e6403 |
ps_process_pattern($1, { ypbind_t yppasswdd_t ypserv_t ypxfr_t })
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
nis_initrc_domtrans($1)
|
|
Chris PeBenito |
9401ae1 |
nis_initrc_domtrans_ypbind($1)
|
|
Chris PeBenito |
9401ae1 |
domain_system_change_exemption($1)
|
|
Dominick Grift |
b7e6403 |
role_transition $2 { nis_initrc_exec_t ypbind_initrc_exec_t } system_r;
|
|
Chris PeBenito |
9401ae1 |
allow $2 system_r;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_list_tmp($1)
|
|
Dominick Grift |
b7e6403 |
admin_pattern($1, { ypserv_tmp_t ypbind_tmp_t })
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_list_pids($1)
|
|
Dominick Grift |
b7e6403 |
admin_pattern($1, { ypserv_var_run_t ypbind_var_run_t yppasswdd_var_run_t })
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_list_etc($1)
|
|
Chris PeBenito |
9401ae1 |
admin_pattern($1, ypserv_conf_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
b7e6403 |
files_search_var($1)
|
|
Dominick Grift |
b7e6403 |
admin_pattern($1, var_yp_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
b7e6403 |
nis_run_ypbind($1, $2)
|
|
Chris PeBenito |
9401ae1 |
')
|