modutils: adjust interfaces after recent binaries merge

policy/modules/system/modutils.if

@@ -121,6 +121,77 @@ interface(`modutils_manage_module_config',`
 	manage_files_pattern($1, modules_conf_t, modules_conf_t)
 ')
 
+########################################
+## <summary>
+##	Execute any modutil,
+##	like insmod, kmod, depmod or updates-modules,
+##	in the kmod domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`modutils_domtrans',`
+	gen_require(`
+		type kmod_t, kmod_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, kmod_exec_t, kmod_t)
+')
+
+########################################
+## <summary>
+##	Execute any modutil,
+##	like insmod, kmod, depmod or updates-modules,
+##	in the kmod domain, and allow the specified role
+##	the kmod domain, and use the caller's terminal.
+##	Has a sigchld backchannel.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`modutils_run',`
+	gen_require(`
+		attribute_role kmod_roles;
+	')
+
+	modutils_domtrans_insmod($1)
+	roleattribute $2 kmod_roles;
+')
+
+########################################
+## <summary>
+##	Execute any modutil,
+##	like insmod, kmod, depmod or updates-modules,
+##	in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`modutils_exec',`
+	gen_require(`
+		type kmod_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, kmod_exec_t)
+')
+
 ########################################
 ## <summary>
 ##	Unconditionally execute insmod in the insmod domain.
@@ -134,12 +205,8 @@ interface(`modutils_manage_module_config',`
 # cjp: this is added for pppd, due to nested
 # conditionals not working.
 interface(`modutils_domtrans_insmod_uncond',`
-	gen_require(`
-		type insmod_t, insmod_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, insmod_exec_t, insmod_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_domtrans() instead.')
+	modutils_domtrans($1)
 ')
 
 ########################################
@@ -153,12 +220,8 @@ interface(`modutils_domtrans_insmod_uncond',`
 ## </param>
 #
 interface(`modutils_domtrans_insmod',`
-	gen_require(`
-		type insmod_t, insmod_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, insmod_exec_t, insmod_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_domtrans() instead.')
+	modutils_domtrans($1)
 ')
 
 ########################################
@@ -181,12 +244,8 @@ interface(`modutils_domtrans_insmod',`
 ## <rolecap/>
 #
 interface(`modutils_run_insmod',`
-	gen_require(`
-		type insmod_t;
-	')
-
-	modutils_domtrans_insmod($1)
-	role $2 types insmod_t;
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_run() instead.')
+	modutils_run($1, $2)
 ')
 
 ########################################
@@ -200,12 +259,8 @@ interface(`modutils_run_insmod',`
 ## </param>
 #
 interface(`modutils_exec_insmod',`
-	gen_require(`
-		type insmod_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	can_exec($1, insmod_exec_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_exec() instead.')
+	modutils_exec($1)
 ')
 
 ########################################
@@ -219,12 +274,8 @@ interface(`modutils_exec_insmod',`
 ## </param>
 #
 interface(`modutils_domtrans_depmod',`
-	gen_require(`
-		type depmod_t, depmod_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, depmod_exec_t, depmod_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_domtrans() instead.')
+	modutils_domtrans($1)
 ')
 
 ########################################
@@ -244,12 +295,8 @@ interface(`modutils_domtrans_depmod',`
 ## <rolecap/>
 #
 interface(`modutils_run_depmod',`
-	gen_require(`
-		type depmod_t, insmod_t;
-	')
-
-	modutils_domtrans_depmod($1)
-	role $2 types depmod_t;
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_run() instead.')
+	modutils_run($1, $2)
 ')
 
 ########################################
@@ -263,12 +310,8 @@ interface(`modutils_run_depmod',`
 ## </param>
 #
 interface(`modutils_exec_depmod',`
-	gen_require(`
-		type depmod_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	can_exec($1, depmod_exec_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_exec() instead.')
+	modutils_exec($1)
 ')
 
 ########################################
@@ -282,12 +325,8 @@ interface(`modutils_exec_depmod',`
 ## </param>
 #
 interface(`modutils_domtrans_update_mods',`
-	gen_require(`
-		type update_modules_t, update_modules_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, update_modules_exec_t, update_modules_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_domtrans() instead.')
+	modutils_domtrans($1)
 ')
 
 ########################################
@@ -307,12 +346,8 @@ interface(`modutils_domtrans_update_mods',`
 ## <rolecap/>
 #
 interface(`modutils_run_update_mods',`
-	gen_require(`
-		attribute_role update_modules_roles;
-	')
-
-	modutils_domtrans_update_mods($1)
-	roleattribute $2 update_modules_roles;
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_run() instead.')
+	modutils_run($1, $2)
 ')
 
 ########################################
@@ -326,12 +361,8 @@ interface(`modutils_run_update_mods',`
 ## </param>
 #
 interface(`modutils_exec_update_mods',`
-	gen_require(`
-		type update_modules_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	can_exec($1, update_modules_exec_t)
+	refpolicywarn(`$0($*) has been deprecated, please use modutils_exec() instead.')
+	modutils_exec($1)
 ')
 
 ########################################

policy/modules/system/modutils.te

@@ -5,12 +5,15 @@ policy_module(modutils, 1.17.2)
 # Declarations
 #
 
+attribute_role kmod_roles;
+
 type kmod_t alias { insmod_t depmod_t update_modules_t };
 type kmod_exec_t alias { insmod_exec_t depmod_exec_t update_modules_exec_t };
 application_domain(kmod_t, kmod_exec_t)
 kernel_domtrans_to(kmod_t, kmod_exec_t)
 mls_file_write_all_levels(kmod_t)
-role system_r types kmod_t;
+roleattribute system_r kmod_roles;
+role kmod_roles types kmod_t;
 
 # module loading config
 type modules_conf_t;