Attachment 1472012 Details for Bug 1589086 – third version of bolt interfaces

third version of bolt interfaces

file_1589086.txt (text/plain), 2.93 KB, created by Milos Malik on 2018-08-01 07:44:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Milos Malik

Created: 2018-08-01 07:44:52 UTC

Size: 2.93 KB

patch

obsolete

>## <summary>policy for bolt</summary>
>
>########################################
>## <summary>
>##	Execute bolt_exec_t in the bolt domain.
>## </summary>
>## <param name="domain">
>## <summary>
>##	Domain allowed to transition.
>## </summary>
>## </param>
>#
>interface(`bolt_domtrans',`
>	gen_require(`
>		type bolt_t, bolt_exec_t;
>	')
>
>	corecmd_search_bin($1)
>	domtrans_pattern($1, bolt_exec_t, bolt_t)
>')
>
>######################################
>## <summary>
>##	Execute bolt in the caller domain.
>## </summary>
>## <param name="domain">
>##	<summary>
>##	Domain allowed access.
>##	</summary>
>## </param>
>#
>interface(`bolt_exec',`
>	gen_require(`
>		type bolt_exec_t;
>	')
>
>	corecmd_search_bin($1)
>	can_exec($1, bolt_exec_t)
>')
>
>########################################
>## <summary>
>##	Search bolt lib directories.
>## </summary>
>## <param name="domain">
>##	<summary>
>##	Domain allowed access.
>##	</summary>
>## </param>
>#
>interface(`bolt_search_lib',`
>	gen_require(`
>		type bolt_var_lib_t;
>	')
>
>	allow $1 bolt_var_lib_t:dir search_dir_perms;
>	files_search_var_lib($1)
>')
>
>########################################
>## <summary>
>##	Read bolt lib files.
>## </summary>
>## <param name="domain">
>##	<summary>
>##	Domain allowed access.
>##	</summary>
>## </param>
>#
>interface(`bolt_read_lib_files',`
>	gen_require(`
>		type bolt_var_lib_t;
>	')
>
>	files_search_var_lib($1)
>	read_files_pattern($1, bolt_var_lib_t, bolt_var_lib_t)
>')
>
>########################################
>## <summary>
>##	Manage bolt lib files.
>## </summary>
>## <param name="domain">
>##	<summary>
>##	Domain allowed access.
>##	</summary>
>## </param>
>#
>interface(`bolt_manage_lib_files',`
>	gen_require(`
>		type bolt_var_lib_t;
>	')
>
>	files_search_var_lib($1)
>	manage_files_pattern($1, bolt_var_lib_t, bolt_var_lib_t)
>')
>
>########################################
>## <summary>
>##	Manage bolt lib directories.
>## </summary>
>## <param name="domain">
>##	<summary>
>##	Domain allowed access.
>##	</summary>
>## </param>
>#
>interface(`bolt_manage_lib_dirs',`
>	gen_require(`
>		type bolt_var_lib_t;
>	')
>
>	files_search_var_lib($1)
>	manage_dirs_pattern($1, bolt_var_lib_t, bolt_var_lib_t)
>')
>
>
>########################################
>## <summary>
>##	All of the rules required to administrate
>##	an bolt environment
>## </summary>
>## <param name="domain">
>##	<summary>
>##	Domain allowed access.
>##	</summary>
>## </param>
>## <param name="role">
>##	<summary>
>##	Role allowed access.
>##	</summary>
>## </param>
>## <rolecap/>
>#
>interface(`bolt_admin',`
>	gen_require(`
>		type bolt_t;
>		type bolt_var_lib_t;
>	')
>
>	allow $1 bolt_t:process { signal_perms };
>	ps_process_pattern($1, bolt_t)
>
>    tunable_policy(`deny_ptrace',`',`
>        allow $1 bolt_t:process ptrace;
>    ')
>
>	files_search_var_lib($1)
>	admin_pattern($1, bolt_var_lib_t)
>	optional_policy(`
>		systemd_passwd_agent_exec($1)
>		systemd_read_fifo_file_passwd_run($1)
>	')
>')

Actions: View

Attachments on bug 1589086: 1472009 | 1472010 | 1472012