70 lines
1.2 KiB
Plaintext
70 lines
1.2 KiB
Plaintext
|
## <summary>Policy for podman</summary>
|
||
|
|
|
||
|
|
########################################
|
||
|
|
## <summary>
|
||
|
|
## Execute podman in the podman domain.
|
||
|
|
## </summary>
|
||
|
|
## <param name="domain">
|
||
|
|
## <summary>
|
||
|
|
## Domain allowed to transition.
|
||
|
|
## </summary>
|
||
|
|
## </param>
|
||
|
|
#
|
||
|
|
interface(`podman_domtrans',`
|
||
|
|
gen_require(`
|
||
|
|
type podman_t, podman_exec_t;
|
||
|
|
')
|
||
|
|
|
||
|
|
corecmd_search_bin($1)
|
||
|
|
domtrans_pattern($1, podman_exec_t, podman_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
## <summary>
|
||
|
|
## Execute podman in the podman domain,
|
||
|
|
## and allow the specified role the
|
||
|
|
## podman domain.
|
||
|
|
## </summary>
|
||
|
|
## <param name="domain">
|
||
|
|
## <summary>
|
||
|
|
## Domain allowed to transition.
|
||
|
|
## </summary>
|
||
|
|
## </param>
|
||
|
|
## <param name="role">
|
||
|
|
## <summary>
|
||
|
|
## The role to be allowed the podman domain.
|
||
|
|
## </summary>
|
||
|
|
## </param>
|
||
|
|
#
|
||
|
|
interface(`podman_run',`
|
||
|
|
gen_require(`
|
||
|
|
type podman_t;
|
||
|
|
')
|
||
|
|
|
||
|
|
role $2 types podman_t;
|
||
|
|
|
||
|
|
podman_domtrans($1)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
## <summary>
|
||
|
|
## All of the rules required to
|
||
|
|
## administrate a podman
|
||
|
|
## environment.
|
||
|
|
## </summary>
|
||
|
|
## <param name="domain">
|
||
|
|
## <summary>
|
||
|
|
## Domain allowed access.
|
||
|
|
## </summary>
|
||
|
|
## </param>
|
||
|
|
## <param name="role">
|
||
|
|
## <summary>
|
||
|
|
## Role allowed access.
|
||
|
|
## </summary>
|
||
|
|
## </param>
|
||
|
|
## <rolecap/>
|
||
|
|
#
|
||
|
|
interface(`podman_admin',`
|
||
|
|
podman_run($1, $2)
|
||
|
|
')
|