Chris PeBenito 9401ae1
## <summary>Xen hypervisor</summary>
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Execute a domain transition to run xend.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
## 	<summary>
Chris PeBenito 9401ae1
##	Domain allowed to transition.
Chris PeBenito 9401ae1
## 	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_domtrans',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xend_t, xend_exec_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	domtrans_pattern($1, xend_exec_t, xend_t)
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Dominick Grift 163313a
##	Execute xend in the caller domain.
Dominick Grift 163313a
## </summary>
Dominick Grift 163313a
## <param name="domain">
Dominick Grift 163313a
##	<summary>
Dominick Grift 163313a
##	Domain allowed access.
Dominick Grift 163313a
##	</summary>
Dominick Grift 163313a
## </param>
Dominick Grift 163313a
#
Dominick Grift 163313a
interface(`xen_exec',`
Dominick Grift 163313a
	gen_require(`
Dominick Grift 163313a
		type xend_exec_t;
Dominick Grift 163313a
	')
Dominick Grift 163313a
Dominick Grift 163313a
	corecmd_search_bin($1)
Dominick Grift 163313a
	can_exec($1, xend_exec_t)
Dominick Grift 163313a
')
Dominick Grift 163313a
Dominick Grift 163313a
########################################
Dominick Grift 163313a
## <summary>
Chris PeBenito 9401ae1
##	Inherit and use xen file descriptors.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
##	<summary>
Chris PeBenito 9401ae1
##	Domain allowed access.
Chris PeBenito 9401ae1
##	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_use_fds',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xend_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	allow $1 xend_t:fd use;
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Do not audit attempts to inherit
Chris PeBenito 9401ae1
##	xen file descriptors.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
##	<summary>
Chris PeBenito 9401ae1
##	Domain to not audit.
Chris PeBenito 9401ae1
##	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_dontaudit_use_fds',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xend_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	dontaudit $1 xend_t:fd use;
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Dominick Grift 163313a
##	Create, read, write, and delete
Dominick Grift 163313a
##	xend image directories.
Dominick Grift 163313a
## </summary>
Dominick Grift 163313a
## <param name="domain">
Dominick Grift 163313a
##	<summary>
Dominick Grift 163313a
##	Domain allowed access.
Dominick Grift 163313a
##	</summary>
Dominick Grift 163313a
## </param>
Dominick Grift 163313a
#
Dominick Grift 163313a
interface(`xen_manage_image_dirs',`
Dominick Grift 163313a
	gen_require(`
Dominick Grift 163313a
		type xend_var_lib_t;
Dominick Grift 163313a
	')
Dominick Grift 163313a
Dominick Grift 163313a
	files_search_var_lib($1)
Dominick Grift 163313a
	manage_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
Dominick Grift 163313a
')
Dominick Grift 163313a
Dominick Grift 163313a
########################################
Dominick Grift 163313a
## <summary>
Chris PeBenito 9401ae1
##	Read xend image files.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
## 	<summary>
Chris PeBenito 9401ae1
##	Domain allowed access.
Chris PeBenito 9401ae1
## 	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_read_image_files',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xen_image_t, xend_var_lib_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	files_list_var_lib($1)
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	list_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
Chris PeBenito 9401ae1
	read_files_pattern($1, { xend_var_lib_t xen_image_t }, xen_image_t)
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Allow the specified domain to read/write
Chris PeBenito 9401ae1
##	xend image files.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
## 	<summary>
Chris PeBenito 9401ae1
##	Domain allowed access.
Chris PeBenito 9401ae1
## 	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_rw_image_files',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xen_image_t, xend_var_lib_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	files_list_var_lib($1)
Chris PeBenito 9401ae1
	allow $1 xend_var_lib_t:dir search_dir_perms;
Chris PeBenito 9401ae1
	rw_files_pattern($1, xen_image_t, xen_image_t)
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Allow the specified domain to append
Chris PeBenito 9401ae1
##	xend log files.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
## 	<summary>
Chris PeBenito 9401ae1
##	Domain allowed access.
Chris PeBenito 9401ae1
## 	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_append_log',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xend_var_log_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	logging_search_logs($1)
Chris PeBenito 9401ae1
	append_files_pattern($1, xend_var_log_t, xend_var_log_t)
Chris PeBenito 9401ae1
	dontaudit $1 xend_var_log_t:file write;
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Create, read, write, and delete the
Chris PeBenito 9401ae1
##	xend log files.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
## 	<summary>
Chris PeBenito 9401ae1
##	Domain allowed access.
Chris PeBenito 9401ae1
## 	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_manage_log',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xend_var_log_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	logging_search_logs($1)
Chris PeBenito 9401ae1
	manage_dirs_pattern($1, xend_var_log_t, xend_var_log_t)
Chris PeBenito 9401ae1
	manage_files_pattern($1, xend_var_log_t, xend_var_log_t)
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Dominick Grift 163313a
#######################################
Dominick Grift 163313a
## <summary>
Dominick Grift 163313a
##	Read xenstored pid files.
Dominick Grift 163313a
## </summary>
Dominick Grift 163313a
## <param name="domain">
Dominick Grift 163313a
##	<summary>
Dominick Grift 163313a
##	Domain allowed access.
Dominick Grift 163313a
##	</summary>
Dominick Grift 163313a
## </param>
Dominick Grift 163313a
#
Dominick Grift 163313a
interface(`xen_read_xenstored_pid_files',`
Dominick Grift 163313a
	gen_require(`
Dominick Grift 163313a
		type xenstored_var_run_t;
Dominick Grift 163313a
	')
Dominick Grift 163313a
Dominick Grift 163313a
	files_search_pids($1)
Dominick Grift 163313a
	read_files_pattern($1, xenstored_var_run_t, xenstored_var_run_t)
Dominick Grift 163313a
')
Dominick Grift 163313a
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Do not audit attempts to read and write
Chris PeBenito 9401ae1
##	Xen unix domain stream sockets.  These
Chris PeBenito 9401ae1
##	are leaked file descriptors.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
##	<summary>
Chris PeBenito 9401ae1
##	Domain to not audit.
Chris PeBenito 9401ae1
##	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_dontaudit_rw_unix_stream_sockets',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xend_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	dontaudit $1 xend_t:unix_stream_socket { read write };
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Connect to xenstored over an unix stream socket.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
##	<summary>
Chris PeBenito 9401ae1
##	Domain allowed access.
Chris PeBenito 9401ae1
##	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_stream_connect_xenstore',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xenstored_t, xenstored_var_run_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	files_search_pids($1)
Chris PeBenito 9401ae1
	stream_connect_pattern($1, xenstored_var_run_t, xenstored_var_run_t, xenstored_t)
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Connect to xend over an unix domain stream socket.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
##	<summary>
Chris PeBenito 9401ae1
##	Domain allowed access.
Chris PeBenito 9401ae1
##	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_stream_connect',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xend_t, xend_var_run_t, xend_var_lib_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	files_search_pids($1)
Chris PeBenito 9401ae1
	stream_connect_pattern($1, xend_var_run_t, xend_var_run_t, xend_t)
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	files_search_var_lib($1)
Chris PeBenito 9401ae1
	stream_connect_pattern($1, xend_var_lib_t, xend_var_lib_t, xend_t)
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Execute a domain transition to run xm.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Domain allowed to transition.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_domtrans_xm',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xm_t, xm_exec_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	domtrans_pattern($1, xm_exec_t, xm_t)
Chris PeBenito 9401ae1
')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
########################################
Chris PeBenito 9401ae1
## <summary>
Chris PeBenito 9401ae1
##	Connect to xm over an unix stream socket.
Chris PeBenito 9401ae1
## </summary>
Chris PeBenito 9401ae1
## <param name="domain">
Chris PeBenito 9401ae1
##	<summary>
Chris PeBenito 9401ae1
##	Domain allowed access.
Chris PeBenito 9401ae1
##	</summary>
Chris PeBenito 9401ae1
## </param>
Chris PeBenito 9401ae1
#
Chris PeBenito 9401ae1
interface(`xen_stream_connect_xm',`
Chris PeBenito 9401ae1
	gen_require(`
Chris PeBenito 9401ae1
		type xm_t;
Chris PeBenito 9401ae1
	')
Chris PeBenito 9401ae1
Chris PeBenito 9401ae1
	files_search_pids($1)
Chris PeBenito 9401ae1
	stream_connect_pattern($1, xenstored_var_run_t, xenstored_var_run_t, xm_t)
Chris PeBenito 9401ae1
')