selinux-refpolicy/policy/modules/apps/vmware.if

87 lines
1.7 KiB
Plaintext
Raw Normal View History

2006-04-26 18:18:15 +00:00
## <summary>VMWare Workstation virtual machines</summary>
2008-11-05 16:10:46 +00:00
########################################
2006-04-26 19:24:38 +00:00
## <summary>
2008-11-05 16:10:46 +00:00
## Role access for vmware
2006-04-26 19:24:38 +00:00
## </summary>
2008-11-05 16:10:46 +00:00
## <param name="role">
2006-04-26 19:24:38 +00:00
## <summary>
2008-11-05 16:10:46 +00:00
## Role allowed access
2006-04-26 19:24:38 +00:00
## </summary>
## </param>
2008-11-05 16:10:46 +00:00
## <param name="domain">
2006-04-26 19:24:38 +00:00
## <summary>
2008-11-05 16:10:46 +00:00
## User domain for the role
2006-04-26 19:24:38 +00:00
## </summary>
## </param>
#
2008-11-05 16:10:46 +00:00
interface(`vmware_role',`
gen_require(`
2008-11-05 16:10:46 +00:00
type vmware_t, vmware_exec_t;
')
2006-04-26 18:18:15 +00:00
2008-11-05 16:10:46 +00:00
role $1 types vmware_t;
2006-04-26 18:18:15 +00:00
2008-11-05 16:10:46 +00:00
# Transition from the user domain to the derived domain.
domtrans_pattern($2, vmware_exec_t, vmware_t)
2006-04-26 20:30:08 +00:00
2008-11-05 16:10:46 +00:00
# allow ps to show vmware and allow the user to kill it
ps_process_pattern($2, vmware_t)
allow $2 vmware_t:process signal;
2006-04-26 18:18:15 +00:00
')
########################################
## <summary>
## Read VMWare system configuration files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`vmware_read_system_config',`
gen_require(`
type vmware_sys_conf_t;
')
2008-11-05 16:10:46 +00:00
allow $1 vmware_sys_conf_t:file { getattr read };
2006-04-26 18:18:15 +00:00
')
########################################
## <summary>
## Append to VMWare system configuration files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`vmware_append_system_config',`
gen_require(`
type vmware_sys_conf_t;
')
allow $1 vmware_sys_conf_t:file append;
')
########################################
## <summary>
## Append to VMWare log files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`vmware_append_log',`
gen_require(`
type vmware_log_t;
')
logging_search_logs($1)
append_files_pattern($1, vmware_log_t, vmware_log_t)
')