|
|
beb8879 |
## <summary>Subscription Management Certificate Daemon policy</summary>
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Transition to rhsmcertd.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
Chris PeBenito |
8103c78 |
## <summary>
|
|
|
899b713 |
## Domain allowed to transition.
|
|
Chris PeBenito |
8103c78 |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_domtrans',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_t, rhsmcertd_exec_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_search_bin($1)
|
|
|
1ec3d1a |
domtrans_pattern($1, rhsmcertd_exec_t, rhsmcertd_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Execute rhsmcertd server in the rhsmcertd domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_initrc_domtrans',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_initrc_exec_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
init_labeled_script_domtrans($1, rhsmcertd_initrc_exec_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Read rhsmcertd's log files.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
## <rolecap/>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_read_log',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_log_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
logging_search_logs($1)
|
|
|
1ec3d1a |
read_files_pattern($1, rhsmcertd_log_t, rhsmcertd_log_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Append to rhsmcertd log files.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_append_log',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_log_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
logging_search_logs($1)
|
|
|
1ec3d1a |
append_files_pattern($1, rhsmcertd_log_t, rhsmcertd_log_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Manage rhsmcertd log files
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_manage_log',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_log_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
logging_search_logs($1)
|
|
|
1ec3d1a |
manage_dirs_pattern($1, rhsmcertd_log_t, rhsmcertd_log_t)
|
|
|
1ec3d1a |
manage_files_pattern($1, rhsmcertd_log_t, rhsmcertd_log_t)
|
|
|
1ec3d1a |
manage_lnk_files_pattern($1, rhsmcertd_log_t, rhsmcertd_log_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Search rhsmcertd lib directories.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_search_lib',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_var_lib_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
Dominick Grift |
6d82217 |
allow $1 rhsmcertd_var_lib_t:dir search_dir_perms;
|
|
|
beb8879 |
files_search_var_lib($1)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Read rhsmcertd lib files.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_read_lib_files',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_var_lib_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_search_var_lib($1)
|
|
|
1ec3d1a |
read_files_pattern($1, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Manage rhsmcertd lib files.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_manage_lib_files',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_var_lib_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_search_var_lib($1)
|
|
|
1ec3d1a |
manage_files_pattern($1, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Manage rhsmcertd lib directories.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_manage_lib_dirs',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_var_lib_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_search_var_lib($1)
|
|
|
1ec3d1a |
manage_dirs_pattern($1, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## Read rhsmcertd PID files.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_read_pid_files',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_var_run_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_search_pids($1)
|
|
|
1ec3d1a |
allow $1 rhsmcertd_var_run_t:file read_file_perms;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
####################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Connect to rhsmcertd over a unix domain
|
|
|
1ec3d1a |
## stream socket.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_stream_connect',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_t, rhsmcertd_var_run_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_search_pids($1)
|
|
|
1ec3d1a |
stream_connect_pattern($1, rhsmcertd_var_run_t, rhsmcertd_var_run_t, rhsmcertd_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#######################################
|
|
|
1ec3d1a |
## <summary>
|
|
Chris PeBenito |
8103c78 |
## Send and receive messages from
|
|
Chris PeBenito |
8103c78 |
## rhsmcertd over dbus.
|
|
|
899b713 |
## </summary>
|
|
|
899b713 |
## <param name="domain">
|
|
Chris PeBenito |
8103c78 |
## <summary>
|
|
Chris PeBenito |
8103c78 |
## Domain allowed access.
|
|
Chris PeBenito |
8103c78 |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_dbus_chat',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_t;
|
|
|
1ec3d1a |
class dbus send_msg;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow $1 rhsmcertd_t:dbus send_msg;
|
|
|
1ec3d1a |
allow rhsmcertd_t $1:dbus send_msg;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
######################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Dontaudit Send and receive messages from
|
|
|
1ec3d1a |
## rhsmcertd over dbus.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`rhsmcertd_dontaudit_dbus_chat',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_t;
|
|
|
1ec3d1a |
class dbus send_msg;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
dontaudit $1 rhsmcertd_t:dbus send_msg;
|
|
|
1ec3d1a |
dontaudit rhsmcertd_t $1:dbus send_msg;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
beb8879 |
## All of the rules required to administrate
|
|
|
beb8879 |
## an rhsmcertd environment
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
beb8879 |
## <param name="role">
|
|
|
beb8879 |
## <summary>
|
|
|
beb8879 |
## Role allowed access.
|
|
|
beb8879 |
## </summary>
|
|
|
beb8879 |
## </param>
|
|
|
beb8879 |
## <rolecap/>
|
|
|
1ec3d1a |
#
|
|
|
beb8879 |
|
|
|
1ec3d1a |
interface(`rhsmcertd_admin',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type rhsmcertd_t, rhsmcertd_initrc_exec_t, rhsmcertd_log_t;
|
|
|
beb8879 |
type rhsmcertd_var_lib_t, rhsmcertd_var_run_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
beb8879 |
allow $1 rhsmcertd_t:process signal_perms;
|
|
|
1ec3d1a |
ps_process_pattern($1, rhsmcertd_t)
|
|
|
beb8879 |
|
|
|
1ec3d1a |
tunable_policy(`deny_ptrace',`',`
|
|
|
1ec3d1a |
allow $1 rhsmcertd_t:process ptrace;
|
|
|
1ec3d1a |
')
|
|
|
899b713 |
|
|
|
beb8879 |
rhsmcertd_initrc_domtrans($1)
|
|
|
beb8879 |
domain_system_change_exemption($1)
|
|
|
beb8879 |
role_transition $2 rhsmcertd_initrc_exec_t system_r;
|
|
|
beb8879 |
allow $2 system_r;
|
|
|
899b713 |
|
|
|
beb8879 |
logging_search_logs($1)
|
|
|
beb8879 |
admin_pattern($1, rhsmcertd_log_t)
|
|
|
899b713 |
|
|
|
beb8879 |
files_search_var_lib($1)
|
|
|
beb8879 |
admin_pattern($1, rhsmcertd_var_lib_t)
|
|
|
899b713 |
|
|
|
beb8879 |
files_search_pids($1)
|
|
|
beb8879 |
admin_pattern($1, rhsmcertd_var_run_t)
|
|
|
beb8879 |
|
|
|
beb8879 |
files_search_locks($1)
|
|
|
beb8879 |
admin_pattern($1, rhsmcertd_lock_t)
|
|
Dominick Grift |
6d82217 |
|
|
|
1ec3d1a |
')
|