## <summary>Livecd tool for building alternate livecd for different os and policy versions.</summary>

########################################
## <summary>
##	Execute a domain transition to run livecd.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`livecd_domtrans',`
	gen_require(`
		type livecd_t, livecd_exec_t;
	')

	domtrans_pattern($1, livecd_exec_t, livecd_t)
')

########################################
## <summary>
##	Execute livecd in the livecd domain, and
##	allow the specified role the livecd domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
#
interface(`livecd_run',`
	gen_require(`
		type livecd_t;
		type livecd_exec_t;
		#attribute_role livecd_roles;
	')

	livecd_domtrans($1)
	#roleattribute $2 livecd_roles;
	role $2 types livecd_t;
	role_transition $2 livecd_exec_t system_r;

        seutil_run_setfiles_mac(livecd_t, system_r)

        optional_policy(`
                mount_run(livecd_t, $2)
        ')
')

########################################
## <summary>
##	Dontaudit read/write to a livecd leaks
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`livecd_dontaudit_leaks',`
	gen_require(`
		type livecd_t;
	')

	dontaudit $1 livecd_t:unix_dgram_socket { read write };
')

########################################
## <summary>
##	Read livecd temporary files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`livecd_read_tmp_files',`
	gen_require(`
		type livecd_tmp_t;
	')

	files_search_tmp($1)
	read_files_pattern($1, livecd_tmp_t, livecd_tmp_t)
')

########################################
## <summary>
##	Read and write livecd temporary files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`livecd_rw_tmp_files',`
	gen_require(`
		type livecd_tmp_t;
	')

	files_search_tmp($1)
	rw_files_pattern($1, livecd_tmp_t, livecd_tmp_t)
')

########################################
## <summary>
##	Allow read and write access to livecd semaphores.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`livecd_rw_semaphores',`
	gen_require(`
		type livecd_t;
	')

	allow $1 livecd_t:sem { unix_read unix_write associate read write };
')