## Fast incremental file transfer for synchronization. ######################################## ## ## Make rsync executable file an ## entry point for the specified domain. ## ## ## ## The domain for which rsync_exec_t is an entrypoint. ## ## # interface(`rsync_entry_type',` gen_require(` type rsync_exec_t; ') domain_entry_file($1, rsync_exec_t) ') ######################################## ## ## Execute a rsync in a specified domain. ## ## ##

## Execute a rsync in a specified domain. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##
## ## ## Domain allowed to transition. ## ## ## ## ## Domain to transition to. ## ## # interface(`rsync_entry_spec_domtrans',` gen_require(` type rsync_exec_t; ') corecmd_search_bin($1) domain_auto_transition_pattern($1, rsync_exec_t, $2) ') ######################################## ## ## Execute a rsync in a specified domain. ## ## ##

## Execute a rsync in a specified domain. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##
## ## ## Domain allowed to transition. ## ## ## ## ## Domain to transition to. ## ## # interface(`rsync_entry_domtrans',` gen_require(` type rsync_exec_t; ') corecmd_search_bin($1) domain_auto_transition_pattern($1, rsync_exec_t, $2) ') ######################################## ## ## Execute the rsync program in the rsync domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`rsync_domtrans',` gen_require(` type rsync_t, rsync_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, rsync_exec_t, rsync_t) ') ######################################## ## ## Execute rsync in the rsync domain, and ## allow the specified role the rsync domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## Role allowed access. ## ## # interface(`rsync_run',` gen_require(` attribute_role rsync_roles; ') rsync_domtrans($1) roleattribute $2 rsync_roles; ') ######################################## ## ## Execute rsync in the caller domain. ## ## ## ## Domain allowed access. ## ## # interface(`rsync_exec',` gen_require(` type rsync_exec_t; ') corecmd_search_bin($1) can_exec($1, rsync_exec_t) ') ######################################## ## ## Read rsync config files. ## ## ## ## Domain allowed access. ## ## # interface(`rsync_read_config',` gen_require(` type rsync_etc_t; ') files_search_etc($1) allow $1 rsync_etc_t:file read_file_perms; ') ######################################## ## ## Write rsync config files. ## ## ## ## Domain allowed access. ## ## # interface(`rsync_write_config',` gen_require(` type rsync_etc_t; ') files_search_etc($1) allow $1 rsync_etc_t:file write_file_perms; ') ######################################## ## ## Create, read, write, and delete ## rsync config files. ## ## ## ## Domain allowed access. ## ## # interface(`rsync_manage_config_files',` gen_require(` type rsync_etc_t; ') files_search_etc($1) manage_files_pattern($1, rsync_etc_t, rsync_etc_t) ') ######################################## ## ## Create specified objects in etc directories ## with rsync etc type. ## ## ## ## Domain allowed to transition. ## ## ## ## ## Class of the object being created. ## ## ## ## ## The name of the object being created. ## ## # interface(`rsync_etc_filetrans_config',` gen_require(` type rsync_etc_t; ') files_etc_filetrans($1, rsync_etc_t, $2, $3) ') ######################################## ## ## All of the rules required to ## administrate an rsync environment. ## ## ## ## Domain allowed access. ## ## ## ## ## Role allowed access. ## ## ## # interface(`rsync_admin',` gen_require(` type rsync_t, rsync_etc_t, rsync_data_t; type rsync_log_t, rsync_tmp_t, rsync_runtime_t; ') allow $1 rsync_t:process { ptrace signal_perms }; ps_process_pattern($1, rsync_t) files_search_etc($1) admin_pattern($1, rsync_etc_t) admin_pattern($1, rsync_data_t) logging_search_logs($1) admin_pattern($1, rsync_log_t) files_search_tmp($1) admin_pattern($1, rsync_tmp_t) files_search_runtime($1) admin_pattern($1, rsync_runtime_t) ')