selinux-refpolicy/policy/modules/services/dnsmasq.if

## <summary>DNS forwarder and DHCP server.</summary>

########################################
## <summary>
##	Execute dnsmasq server in the dnsmasq domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
#
interface(`dnsmasq_domtrans',`
	gen_require(`
		type dnsmasq_exec_t, dnsmasq_t;
	')

	corecmd_search_bin($1)
	domtrans_pattern($1, dnsmasq_exec_t, dnsmasq_t)
')

########################################
## <summary>
##	Execute the dnsmasq init script in
##	the init script domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
#
interface(`dnsmasq_initrc_domtrans',`
	gen_require(`
		type dnsmasq_initrc_exec_t;
	')

	init_labeled_script_domtrans($1, dnsmasq_initrc_exec_t)
')

########################################
## <summary>
##	Send generic signals to dnsmasq.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
#
interface(`dnsmasq_signal',`
	gen_require(`
		type dnsmasq_t;
	')

	allow $1 dnsmasq_t:process signal;
')

########################################
## <summary>
##	Send null signals to dnsmasq.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
#
interface(`dnsmasq_signull',`
	gen_require(`
		type dnsmasq_t;
	')

	allow $1 dnsmasq_t:process signull;
')

########################################
## <summary>
##	Send kill signals to dnsmasq.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
#
interface(`dnsmasq_kill',`
	gen_require(`
		type dnsmasq_t;
	')

	allow $1 dnsmasq_t:process sigkill;
')

########################################
## <summary>
##	Read dnsmasq config files.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed access.
## </summary>
## </param>
#
interface(`dnsmasq_read_config',`
	gen_require(`
		type dnsmasq_etc_t;
	')

	read_files_pattern($1, dnsmasq_etc_t, dnsmasq_etc_t)
	files_search_etc($1)
')

########################################
## <summary>
##	Write dnsmasq config files.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed access.
## </summary>
## </param>
#
interface(`dnsmasq_write_config',`
	gen_require(`
		type dnsmasq_etc_t;
	')

	write_files_pattern($1, dnsmasq_etc_t, dnsmasq_etc_t)
	files_search_etc($1)
')

########################################
## <summary>
##	Delete dnsmasq pid files.  (Deprecated)
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
#
interface(`dnsmasq_delete_pid_files',`
	refpolicywarn(`$0($*) has been deprecated, please use dnsmasq_delete_runtime_files() instead.')
	dnsmasq_delete_runtime_files($1)
')

########################################
## <summary>
##	Create, read, write, and delete
##	dnsmasq pid files  (Deprecated)
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`dnsmasq_manage_pid_files',`
	refpolicywarn(`$0($*) has been deprecated, please use dnsmasq_manage_runtime_files() instead.')
	dnsmasq_manage_runtime_files($1)	
')

########################################
## <summary>
##	Read dnsmasq pid files.  (Deprecated)
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
#
interface(`dnsmasq_read_pid_files',`
	refpolicywarn(`$0($*) has been deprecated, please use dnsmasq_read_runtime_files() instead.')
	dnsmasq_read_runtime_files($1)
')

########################################
## <summary>
##	Create dnsmasq pid directories.  (Deprecated)
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`dnsmasq_create_pid_dirs',`
	refpolicywarn(`$0($*) has been deprecated, please use dnsmasq_create_runtime_dirs() instead.')
	dnsmasq_create_runtime_dirs($1)
')

########################################
## <summary>
##	Create specified objects in specified
##	directories with a type transition to
##	the dnsmasq pid file type.  (Deprecated)
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="file_type">
##	<summary>
##	Directory to transition on.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`dnsmasq_spec_filetrans_pid',`
	refpolicywarn(`$0($*) has been deprecated, please use dnsmasq_virt_runtime_filetrans_runtime() instead.')
	dnsmasq_virt_runtime_filetrans_runtime($1, $3, $4)
')

########################################
## <summary>
##	Create dnsmasq runtime directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`dnsmasq_create_runtime_dirs',`
	gen_require(`
		type dnsmasq_runtime_t;
	')

	files_search_pids($1)
	allow $1 dnsmasq_runtime_t:dir create_dir_perms;
')

########################################
## <summary>
##	Create specified objects in specified
##	directories with a type transition to
##	the dnsmasq runtime file type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`dnsmasq_virt_runtime_filetrans_runtime',`
	gen_require(`
		type dnsmasq_runtime_t;
	')

	virt_runtime_filetrans($1, dnsmasq_runtime_t, $2, $3)
')

########################################
## <summary>
##	Read dnsmasq runtime files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
#
interface(`dnsmasq_read_runtime_files',`
	gen_require(`
		type dnsmasq_runtime_t;
	')

	read_files_pattern($1, dnsmasq_runtime_t, dnsmasq_runtime_t)
')

########################################
## <summary>
##	Delete dnsmasq runtime files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
#
interface(`dnsmasq_delete_runtime_files',`
	gen_require(`
		type dnsmasq_runtime_t;
	')

	delete_files_pattern($1, dnsmasq_runtime_t, dnsmasq_runtime_t)
')

########################################
## <summary>
##	Create, read, write, and delete
##	dnsmasq runtime files
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`dnsmasq_manage_runtime_files',`
	gen_require(`
		type dnsmasq_runtime_t;
	')

	files_search_pids($1)
	manage_files_pattern($1, dnsmasq_runtime_t, dnsmasq_runtime_t)
')

########################################
## <summary>
##	All of the rules required to
##	administrate an dnsmasq environment.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`dnsmasq_admin',`
	gen_require(`
		type dnsmasq_t, dnsmasq_lease_t, dnsmasq_runtime_t;
		type dnsmasq_initrc_exec_t, dnsmasq_var_log_t;
	')

	allow $1 dnsmasq_t:process { ptrace signal_perms };
	ps_process_pattern($1, dnsmasq_t)

	init_startstop_service($1, $2, dnsmasq_t, dnsmasq_initrc_exec_t)

	files_list_var_lib($1)
	admin_pattern($1, dnsmasq_lease_t)

	logging_search_logs($1)
	admin_pattern($1, dnsmasq_var_log_t)

	files_list_pids($1)
	admin_pattern($1, dnsmasq_runtime_t)
')