selinux-refpolicy/policy/modules/services/consolekit.if

157 lines
3.3 KiB
Plaintext

## <summary>Framework for facilitating multiple user sessions on desktops.</summary>
########################################
## <summary>
## Execute a domain transition to run consolekit.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`consolekit_domtrans',`
gen_require(`
type consolekit_t, consolekit_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, consolekit_exec_t, consolekit_t)
')
########################################
## <summary>
## Send and receive messages from
## consolekit over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`consolekit_dbus_chat',`
gen_require(`
type consolekit_t;
class dbus send_msg;
')
allow $1 consolekit_t:dbus send_msg;
allow consolekit_t $1:dbus send_msg;
')
########################################
## <summary>
## Use consolekit inhibit locks.
##
## The program gets passed an FD to a fifo_file to hold.
## When the application is done with the lock, it closes the FD.
## Implements this API: https://www.freedesktop.org/wiki/Software/systemd/inhibit/
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`consolekit_use_inhibit_lock',`
gen_require(`
type consolekit_t, consolekit_runtime_t;
')
allow $1 consolekit_t:fd use;
allow $1 consolekit_runtime_t:fifo_file rw_inherited_fifo_file_perms;
')
########################################
## <summary>
## Read consolekit log files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`consolekit_read_log',`
gen_require(`
type consolekit_log_t;
')
read_files_pattern($1, consolekit_log_t, consolekit_log_t)
logging_search_logs($1)
')
########################################
## <summary>
## Create, read, write, and delete
## consolekit log files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`consolekit_manage_log',`
gen_require(`
type consolekit_log_t;
')
manage_files_pattern($1, consolekit_log_t, consolekit_log_t)
files_search_runtime($1)
')
########################################
## <summary>
## Read consolekit PID files. (Deprecated)
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`consolekit_read_pid_files',`
refpolicywarn(`$0($*) has been deprecated, please use consolekit_read_runtime_files() instead.')
consolekit_read_runtime_files($1)
')
########################################
## <summary>
## Read consolekit runtime files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`consolekit_read_runtime_files',`
gen_require(`
type consolekit_runtime_t;
')
files_search_runtime($1)
allow $1 consolekit_runtime_t:dir list_dir_perms;
read_files_pattern($1, consolekit_runtime_t, consolekit_runtime_t)
')
########################################
## <summary>
## Watch consolekit runtime dir.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`consolekit_watch_runtime_dir',`
gen_require(`
type consolekit_runtime_t;
')
allow $1 consolekit_runtime_t:dir watch;
')