## policy for mcollective
########################################
##
## Execute TEMPLATE in the mcollective domin.
##
##
##
## Domain allowed to transition.
##
##
#
interface(`mcollective_domtrans',`
gen_require(`
type mcollective_t, mcollective_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, mcollective_exec_t, mcollective_t)
')
########################################
##
## Search mcollective conf directories.
##
##
##
## Domain allowed access.
##
##
#
interface(`mcollective_search_conf',`
gen_require(`
type mcollective_etc_rw_t;
')
allow $1 mcollective_etc_rw_t:dir search_dir_perms;
files_search_etc($1)
')
########################################
##
## Read mcollective conf files.
##
##
##
## Domain allowed access.
##
##
#
interface(`mcollective_read_conf_files',`
gen_require(`
type mcollective_etc_rw_t;
')
allow $1 mcollective_etc_rw_t:dir list_dir_perms;
read_files_pattern($1, mcollective_etc_rw_t, mcollective_etc_rw_t)
files_search_etc($1)
')
########################################
##
## Manage mcollective conf files.
##
##
##
## Domain allowed access.
##
##
#
interface(`mcollective_manage_conf_files',`
gen_require(`
type mcollective_etc_rw_t;
')
manage_files_pattern($1, mcollective_etc_rw_t, mcollective_etc_rw_t)
files_search_etc($1)
')
########################################
##
## All of the rules required to administrate
## an mcollective environment
##
##
##
## Domain allowed access.
##
##
##
##
## Role allowed access.
##
##
##
#
interface(`mcollective_admin',`
gen_require(`
type mcollective_t;
type mcollective_etc_rw_t;
')
allow $1 mcollective_t:process { ptrace signal_perms };
ps_process_pattern($1, mcollective_t)
files_search_etc($1)
admin_pattern($1, mcollective_etc_rw_t)
optional_policy(`
systemd_passwd_agent_exec($1)
systemd_read_fifo_file_passwd_run($1)
')
')