9127219358
There is more than 5000 parameter documentations. Only about 300 are
differently done. Change them to be consistently indented.
param with one space
and content inside with one tab
This was done with:
sed -ri '
/^##[[:space:]]*<param/,/^##[[:space:]]*<[/]param>/{
s/^##[[:space:]]*/##\t/;
s/^##[[:space:]]*(<[/]?summary)/##\t\1/;
s/^##[[:space:]]*(<[/]?param)/## \1/;
}' policy/modules/*/*.if
Signed-off-by: Markus Linnala <Markus.Linnala@cybercom.com>
366 lines
7.2 KiB
Plaintext
366 lines
7.2 KiB
Plaintext
## <summary>Xen hypervisor.</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute a domain transition to run xend.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_domtrans',`
|
|
gen_require(`
|
|
type xend_t, xend_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, xend_exec_t, xend_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute xend in the caller domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_exec',`
|
|
gen_require(`
|
|
type xend_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
can_exec($1, xend_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Inherit and use xen file descriptors.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_use_fds',`
|
|
gen_require(`
|
|
type xend_t;
|
|
')
|
|
|
|
allow $1 xend_t:fd use;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to inherit
|
|
## xen file descriptors.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_dontaudit_use_fds',`
|
|
gen_require(`
|
|
type xend_t;
|
|
')
|
|
|
|
dontaudit $1 xend_t:fd use;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create, read, write, and delete
|
|
## xend image directories.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_manage_image_dirs',`
|
|
gen_require(`
|
|
type xend_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
manage_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read xend image files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_read_image_files',`
|
|
gen_require(`
|
|
type xen_image_t, xend_var_lib_t;
|
|
')
|
|
|
|
files_list_var_lib($1)
|
|
list_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
|
|
read_files_pattern($1, { xend_var_lib_t xen_image_t }, xen_image_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write xend image files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_rw_image_files',`
|
|
gen_require(`
|
|
type xen_image_t, xend_var_lib_t;
|
|
')
|
|
|
|
files_list_var_lib($1)
|
|
allow $1 xend_var_lib_t:dir search_dir_perms;
|
|
rw_files_pattern($1, xen_image_t, xen_image_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Append xend log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_append_log',`
|
|
gen_require(`
|
|
type xend_var_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
append_files_pattern($1, xend_var_log_t, xend_var_log_t)
|
|
dontaudit $1 xend_var_log_t:file write;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create, read, write, and delete
|
|
## xend log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_manage_log',`
|
|
gen_require(`
|
|
type xend_var_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
manage_dirs_pattern($1, xend_var_log_t, xend_var_log_t)
|
|
manage_files_pattern($1, xend_var_log_t, xend_var_log_t)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Read xenstored pid files. (Deprecated)
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_read_xenstored_pid_files',`
|
|
refpolicywarn(`$0($*) has been deprecated, please use xen_read_xenstored_runtime_files() instead.')
|
|
xen_read_xenstored_runtime_files($1)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Read xenstored runtime files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_read_xenstored_runtime_files',`
|
|
gen_require(`
|
|
type xenstored_runtime_t;
|
|
')
|
|
|
|
files_search_runtime($1)
|
|
read_files_pattern($1, xenstored_runtime_t, xenstored_runtime_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read and write
|
|
## Xen unix domain stream sockets.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_dontaudit_rw_unix_stream_sockets',`
|
|
gen_require(`
|
|
type xend_t;
|
|
')
|
|
|
|
dontaudit $1 xend_t:unix_stream_socket { read write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to xenstored with a unix
|
|
## domain stream socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_stream_connect_xenstore',`
|
|
gen_require(`
|
|
type xenstored_t, xenstored_runtime_t;
|
|
')
|
|
|
|
files_search_runtime($1)
|
|
stream_connect_pattern($1, xenstored_runtime_t, xenstored_runtime_t, xenstored_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to xend with a unix
|
|
## domain stream socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_stream_connect',`
|
|
gen_require(`
|
|
type xend_t, xend_runtime_t, xend_var_lib_t;
|
|
')
|
|
|
|
files_search_runtime($1)
|
|
stream_connect_pattern($1, xend_runtime_t, xend_runtime_t, xend_t)
|
|
|
|
files_search_var_lib($1)
|
|
stream_connect_pattern($1, xend_var_lib_t, xend_var_lib_t, xend_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create in a xend_runtime_t directory (Deprecated)
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="private type">
|
|
## <summary>
|
|
## The type of the object to be created.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="object">
|
|
## <summary>
|
|
## The object class of the object being created.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_pid_filetrans',`
|
|
refpolicywarn(`$0($*) has been deprecated, please use xen_runtime_filetrans() instead.')
|
|
xen_runtime_filetrans($1, $2, $3)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create in a xend_runtime_t directory
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="private type">
|
|
## <summary>
|
|
## The type of the object to be created.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="object">
|
|
## <summary>
|
|
## The object class of the object being created.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_runtime_filetrans',`
|
|
gen_require(`
|
|
type xend_runtime_t;
|
|
')
|
|
|
|
filetrans_pattern($1, xend_runtime_t, $2, $3)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute a domain transition to run xm.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_domtrans_xm',`
|
|
gen_require(`
|
|
type xm_t, xm_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, xm_exec_t, xm_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to xm with a unix
|
|
## domain stream socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`xen_stream_connect_xm',`
|
|
gen_require(`
|
|
type xm_t, xenstored_runtime_t;
|
|
')
|
|
|
|
files_search_runtime($1)
|
|
stream_connect_pattern($1, xenstored_runtime_t, xenstored_runtime_t, xm_t)
|
|
')
|