221 lines
4.3 KiB
Plaintext
221 lines
4.3 KiB
Plaintext
## <summary>Collection of tools for managing UNIX services.</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## An ipc channel between the
|
|
## supervised domain and svc_start_t.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`daemontools_ipc_domain',`
|
|
gen_require(`
|
|
type svc_start_t;
|
|
')
|
|
|
|
allow $1 svc_start_t:process sigchld;
|
|
allow $1 svc_start_t:fd use;
|
|
allow $1 svc_start_t:fifo_file rw_fifo_file_perms;
|
|
allow svc_start_t $1:process signal;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create a domain which can be
|
|
## started by daemontools.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Type to be used as a domain.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="entrypoint">
|
|
## <summary>
|
|
## Type of the program to be used as an entry point to this domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`daemontools_service_domain',`
|
|
gen_require(`
|
|
type svc_run_t;
|
|
')
|
|
|
|
domain_auto_transition_pattern(svc_run_t, $2, $1)
|
|
daemontools_ipc_domain($1)
|
|
|
|
allow svc_run_t $1:process signal;
|
|
allow $1 svc_run_t:fd use;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute svc start in the svc
|
|
## start domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`daemontools_domtrans_start',`
|
|
gen_require(`
|
|
type svc_start_t, svc_start_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, svc_start_exec_t, svc_start_t)
|
|
')
|
|
|
|
######################################
|
|
## <summary>
|
|
## Execute svc start in the svc
|
|
## start domain, and allow the
|
|
## specified role the svc start domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`daemonstools_run_start',`
|
|
gen_require(`
|
|
attribute_role svc_start_roles;
|
|
')
|
|
|
|
daemontools_domtrans_start($1)
|
|
roleattribute $2 svc_start_roles;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute avc run in the svc run domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`daemontools_domtrans_run',`
|
|
gen_require(`
|
|
type svc_run_t, svc_run_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, svc_run_exec_t, svc_run_t)
|
|
')
|
|
|
|
######################################
|
|
## <summary>
|
|
## Send child terminated signals
|
|
## to svc run.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`daemontools_sigchld_run',`
|
|
gen_require(`
|
|
type svc_run_t;
|
|
')
|
|
|
|
allow $1 svc_run_t:process sigchld;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute avc multilog in the svc
|
|
## multilog domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`daemontools_domtrans_multilog',`
|
|
gen_require(`
|
|
type svc_multilog_t, svc_multilog_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, svc_multilog_exec_t, svc_multilog_t)
|
|
')
|
|
|
|
######################################
|
|
## <summary>
|
|
## Search svc svc directories.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`daemontools_search_svc_dir',`
|
|
gen_require(`
|
|
type svc_svc_t;
|
|
')
|
|
|
|
files_search_var($1)
|
|
allow $1 svc_svc_t:dir search_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read svc avc files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`daemontools_read_svc',`
|
|
gen_require(`
|
|
type svc_svc_t;
|
|
')
|
|
|
|
files_search_var($1)
|
|
allow $1 svc_svc_t:dir list_dir_perms;
|
|
allow $1 svc_svc_t:file read_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create, read, write and delete
|
|
## svc svc content.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`daemontools_manage_svc',`
|
|
gen_require(`
|
|
type svc_svc_t;
|
|
')
|
|
|
|
files_search_var($1)
|
|
allow $1 svc_svc_t:dir manage_dir_perms;
|
|
allow $1 svc_svc_t:fifo_file manage_fifo_file_perms;
|
|
allow $1 svc_svc_t:file manage_file_perms;
|
|
allow $1 svc_svc_t:lnk_file manage_lnk_file_perms;
|
|
')
|