2015-05-15 18:12:54

by Jason Zaman

Subject: [refpolicy] [PATCH v2 1/2] use init_manage_service_template in _admin interfaces A-M

Most foo_admin interfaces have transitions on the
foo_initrc_exec_t to system_r. These are only applicable
for RedHat <6. This replaces them with a template which
can easily be changed for other init systems.

make validate passes for all combinations of distros,
standard/mcs/mls, monolithic y/n and direct_initrc y/n

This patch is for files starting with A-M.
---
Changes from v1:
* Does not pass two _initrc_exec_t files together with { }. That did not work
with other interfaces that were called later. If a module has multiple domains
and initrc files, the template is called multiple times for each set.

* v1 got stuck in the spam filter because it was too big, this is split in two.
---
abrt.if | 5 +----
acct.if | 5 +----
afs.if | 5 +----
aiccu.if | 5 +----
aisexec.if | 5 +----
amavis.if | 5 +----
amtu.if | 5 +----
apache.if | 5 +----
apcupsd.if | 5 +----
apm.if | 5 +----
arpwatch.if | 5 +----
asterisk.if | 5 +----
automount.if | 5 +----
avahi.if | 5 +----
bacula.if | 5 +----
bcfg2.if | 5 +----
bind.if | 5 +----
bird.if | 5 +----
bitlbee.if | 5 +----
bluetooth.if | 5 +----
boinc.if | 5 +----
cachefilesd.if | 5 +----
callweaver.if | 5 +----
canna.if | 5 +----
ccs.if | 5 +----
certmaster.if | 5 +----
certmonger.if | 5 +----
cfengine.if | 5 +----
cgroup.if | 7 ++-----
chronyd.if | 5 +----
cipe.if | 5 +----
clamav.if | 5 +----
cmirrord.if | 5 +----
cobbler.if | 5 +----
collectd.if | 5 +----
condor.if | 5 +----
corosync.if | 5 +----
couchdb.if | 5 +----
ctdb.if | 5 +----
cups.if | 5 +----
cvs.if | 5 +----
cyphesis.if | 5 +----
cyrus.if | 5 +----
dante.if | 5 +----
ddclient.if | 5 +----
denyhosts.if | 5 +----
dhcp.if | 5 +----
dictd.if | 5 +----
dirmngr.if | 5 +----
distcc.if | 5 +----
dkim.if | 5 +----
dnsmasq.if | 5 +----
dnssectrigger.if | 5 +----
dovecot.if | 5 +----
drbd.if | 5 +----
dspam.if | 5 +----
entropyd.if | 5 +----
exim.if | 5 +----
fail2ban.if | 5 +----
fcoe.if | 5 +----
fetchmail.if | 5 +----
firewalld.if | 5 +----
ftp.if | 5 +----
gatekeeper.if | 5 +----
gdomap.if | 5 +----
glance.if | 6 ++----
glusterfs.if | 5 +----
gpm.if | 5 +----
gpsd.if | 5 +----
hadoop.if | 5 +----
hddtemp.if | 5 +----
howl.if | 5 +----
hypervkvp.if | 5 +----
i18n_input.if | 5 +----
icecast.if | 5 +----
ifplugd.if | 5 +----
inn.if | 5 +----
iodine.if | 5 +----
ircd.if | 5 +----
irqbalance.if | 5 +----
iscsi.if | 5 +----
isns.if | 5 +----
jabber.if | 5 +----
kdump.if | 5 +----
kerberos.if | 5 +----
kerneloops.if | 5 +----
keystone.if | 5 +----
kismet.if | 5 +----
ksmtuned.if | 5 +----
kudzu.if | 5 +----
l2tp.if | 5 +----
ldap.if | 5 +----
likewise.if | 5 +----
lircd.if | 5 +----
lldpad.if | 5 +----
mailscanner.if | 5 +----
mcelog.if | 5 +----
memcached.if | 5 +----
minidlna.if | 5 +----
minissdpd.if | 5 +----
mongodb.if | 5 +----
monop.if | 5 +----
mpd.if | 5 +----
mrtg.if | 5 +----
munin.if | 5 +----
mysql.if | 6 ++----
106 files changed, 109 insertions(+), 425 deletions(-)

diff --git a/abrt.if b/abrt.if
index 058d908..22e4ad7 100644
--- a/abrt.if
+++ b/abrt.if
@@ -304,10 +304,7 @@ interface(`abrt_admin',`
allow $1 abrt_domain:process { ptrace signal_perms };
ps_process_pattern($1, abrt_domain)

- init_labeled_script_domtrans($1, abrt_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 abrt_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, abrt_t, abrt_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, abrt_etc_t)
diff --git a/acct.if b/acct.if
index 81280d0..d1f8699 100644
--- a/acct.if
+++ b/acct.if
@@ -106,10 +106,7 @@ interface(`acct_admin',`
allow $1 acct_t:process { ptrace signal_perms };
ps_process_pattern($1, acct_t)

- init_labeled_script_domtrans($1, acct_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 acct_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, acct_t, acct_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, acct_data_t)
diff --git a/afs.if b/afs.if
index 3b41be6..4b243ec 100644
--- a/afs.if
+++ b/afs.if
@@ -103,10 +103,7 @@ interface(`afs_admin',`
allow $1 afs_domain:process { ptrace signal_perms };
ps_process_pattern($1, afs_domain)

- afs_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 afs_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, afs_domain, afs_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, afs_config_t)
diff --git a/aiccu.if b/aiccu.if
index 3b5dcb9..55238af 100644
--- a/aiccu.if
+++ b/aiccu.if
@@ -82,10 +82,7 @@ interface(`aiccu_admin',`
allow $1 aiccu_t:process { ptrace signal_perms };
ps_process_pattern($1, aiccu_t)

- aiccu_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 aiccu_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, aiccu_t, aiccu_initrc_exec_t)

admin_pattern($1, aiccu_etc_t)
files_list_etc($1)
diff --git a/aisexec.if b/aisexec.if
index a2997fa..2b168f7 100644
--- a/aisexec.if
+++ b/aisexec.if
@@ -86,10 +86,7 @@ interface(`aisexecd_admin',`
allow $1 aisexec_t:process { ptrace signal_perms };
ps_process_pattern($1, aisexec_t)

- init_labeled_script_domtrans($1, aisexec_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 aisexec_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, aisexec_t, aisexec_initrc_exec_t)

files_list_var_lib($1)
admin_pattern($1, aisexec_var_lib_t)
diff --git a/amavis.if b/amavis.if
index 60d4f8c..a7770bc 100644
--- a/amavis.if
+++ b/amavis.if
@@ -237,10 +237,7 @@ interface(`amavis_admin',`
allow $1 amavis_t:process { ptrace signal_perms };
ps_process_pattern($1, amavis_t)

- amavis_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 amavis_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, amavis_t, amavis_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, amavis_etc_t)
diff --git a/amtu.if b/amtu.if
index 884b23b..903e81e 100644
--- a/amtu.if
+++ b/amtu.if
@@ -70,8 +70,5 @@ interface(`amtu_admin',`
allow $1 amtu_t:process { ptrace signal_perms };
ps_process_pattern($1, amtu_t)

- init_labeled_script_domtrans($1, amtu_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 amtu_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, amtu_t, amtu_initrc_exec_t)
')
diff --git a/apache.if b/apache.if
index 717c6f7..944cfe8 100644
--- a/apache.if
+++ b/apache.if
@@ -1318,10 +1318,7 @@ interface(`apache_admin',`
ps_process_pattern($1, { httpd_script_domains httpd_t httpd_helper_t })
ps_process_pattern($1, { httpd_rotatelogs_t httpd_suexec_t httpd_passwd_t })

- init_labeled_script_domtrans($1, httpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 httpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, httpd_t, httpd_initrc_exec_t)

apache_manage_all_content($1)
miscfiles_manage_public_files($1)
diff --git a/apcupsd.if b/apcupsd.if
index f3c0aba..d824aa9 100644
--- a/apcupsd.if
+++ b/apcupsd.if
@@ -149,10 +149,7 @@ interface(`apcupsd_admin',`
allow $1 apcupsd_t:process { ptrace signal_perms };
ps_process_pattern($1, apcupsd_t)

- apcupsd_initrc_domtrans($1, apcupsd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 apcupsd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, apcupsd_t, apcupsd_initrc_exec_t)

files_list_var($1)
admin_pattern($1, apcupsd_lock_t)
diff --git a/apm.if b/apm.if
index 1a7a97e..bd802ef 100644
--- a/apm.if
+++ b/apm.if
@@ -166,10 +166,7 @@ interface(`apm_admin',`
allow $1 apmd_t:process { ptrace signal_perms };
ps_process_pattern($1, apmd_t)

- init_labeled_script_domtrans($1, apmd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 apmd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, apmd_t, apmd_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, apmd_log_t)
diff --git a/arpwatch.if b/arpwatch.if
index 50c9b9c..b7e293c 100644
--- a/arpwatch.if
+++ b/arpwatch.if
@@ -143,10 +143,7 @@ interface(`arpwatch_admin',`
allow $1 arpwatch_t:process { ptrace signal_perms };
ps_process_pattern($1, arpwatch_t)

- arpwatch_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 arpwatch_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, arpwatch_t, arpwatch_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, arpwatch_tmp_t)
diff --git a/asterisk.if b/asterisk.if
index 2077053..6099c72 100644
--- a/asterisk.if
+++ b/asterisk.if
@@ -127,10 +127,7 @@ interface(`asterisk_admin',`
allow $1 asterisk_t:process { ptrace signal_perms };
ps_process_pattern($1, asterisk_t)

- init_labeled_script_domtrans($1, asterisk_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 asterisk_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, asterisk_t, asterisk_initrc_exec_t)

asterisk_exec($1)

diff --git a/automount.if b/automount.if
index f24e369..d430f2d 100644
--- a/automount.if
+++ b/automount.if
@@ -159,10 +159,7 @@ interface(`automount_admin',`
allow $1 automount_t:process { ptrace signal_perms };
ps_process_pattern($1, automount_t)

- init_labeled_script_domtrans($1, automount_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 automount_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, automount_t, automount_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, automount_keytab_t)
diff --git a/avahi.if b/avahi.if
index 9078c3d..1fd5f7b 100644
--- a/avahi.if
+++ b/avahi.if
@@ -264,10 +264,7 @@ interface(`avahi_admin',`
allow $1 avahi_t:process { ptrace signal_perms };
ps_process_pattern($1, avahi_t)

- avahi_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 avahi_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, avahi_t, avahi_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, avahi_var_run_t)
diff --git a/bacula.if b/bacula.if
index dcd774e..eebcc36 100644
--- a/bacula.if
+++ b/bacula.if
@@ -74,10 +74,7 @@ interface(`bacula_admin',`
allow $1 bacula_t:process { ptrace signal_perms };
ps_process_pattern($1, bacula_t)

- init_labeled_script_domtrans($1, bacula_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 bacula_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, bacula_t, bacula_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, bacula_etc_t)
diff --git a/bcfg2.if b/bcfg2.if
index ec95d36..5dbbbf6 100644
--- a/bcfg2.if
+++ b/bcfg2.if
@@ -141,10 +141,7 @@ interface(`bcfg2_admin',`
allow $1 bcfg2_t:process { ptrace signal_perms };
ps_process_pattern($1, bcfg2_t)

- bcfg2_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 bcfg2_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, bcfg2_t, bcfg2_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, bcfg2_var_run_t)
diff --git a/bind.if b/bind.if
index 531a8f2..35b6677 100644
--- a/bind.if
+++ b/bind.if
@@ -370,10 +370,7 @@ interface(`bind_admin',`
allow $1 { named_t ndc_t }:process { ptrace signal_perms };
ps_process_pattern($1, { named_t ndc_t })

- init_labeled_script_domtrans($1, named_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 named_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, named_t, named_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, named_tmp_t)
diff --git a/bird.if b/bird.if
index 85c035f..e67c27c 100644
--- a/bird.if
+++ b/bird.if
@@ -26,10 +26,7 @@ interface(`bird_admin',`
allow $1 bird_t:process { ptrace signal_perms };
ps_process_pattern($1, bird_t)

- init_labeled_script_domtrans($1, bird_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 bird_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, bird_t, bird_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, bird_etc_t)
diff --git a/bitlbee.if b/bitlbee.if
index e73fb79..fd46d30 100644
--- a/bitlbee.if
+++ b/bitlbee.if
@@ -47,10 +47,7 @@ interface(`bitlbee_admin',`
allow $1 bitlbee_t:process { ptrace signal_perms };
ps_process_pattern($1, bitlbee_t)

- init_labeled_script_domtrans($1, bitlbee_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 bitlbee_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, bitlbee_t, bitlbee_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, bitlbee_conf_t)
diff --git a/bluetooth.if b/bluetooth.if
index c723a0a..756b596 100644
--- a/bluetooth.if
+++ b/bluetooth.if
@@ -216,10 +216,7 @@ interface(`bluetooth_admin',`
allow $1 bluetooth_t:process { ptrace signal_perms };
ps_process_pattern($1, bluetooth_t)

- init_labeled_script_domtrans($1, bluetooth_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 bluetooth_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, bluetooth_t, bluetooth_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, bluetooth_tmp_t)
diff --git a/boinc.if b/boinc.if
index 02fefaa..fe241e7 100644
--- a/boinc.if
+++ b/boinc.if
@@ -28,10 +28,7 @@ interface(`boinc_admin',`
allow $1 { boinc_t boinc_project_t }:process { ptrace signal_perms };
ps_process_pattern($1, { boinc_t boinc_project_t })

- init_labeled_script_domtrans($1, boinc_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 boinc_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, boinc_t, boinc_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, boinc_log_t)
diff --git a/cachefilesd.if b/cachefilesd.if
index 8de2ab9..efe2a89 100644
--- a/cachefilesd.if
+++ b/cachefilesd.if
@@ -26,10 +26,7 @@ interface(`cachefilesd_admin',`
allow $1 cachefilesd_t:process { ptrace signal_perms };
ps_process_pattern($1, cachefilesd_t)

- init_labeled_script_domtrans($1, cachefilesd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 cachefilesd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cachefilesd_t, cachefilesd_initrc_exec_t)

files_search_var($1)
admin_pattern($1, cachefilesd_cache_t)
diff --git a/callweaver.if b/callweaver.if
index 16f1855..e88350c 100644
--- a/callweaver.if
+++ b/callweaver.if
@@ -65,10 +65,7 @@ interface(`callweaver_admin',`
allow $1 callweaver_t:process { ptrace signal_perms };
ps_process_pattern($1, callweaver_t)

- init_labeled_script_domtrans($1, callweaver_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 callweaver_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, callweaver_t, callweaver_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, callweaver_log_t)
diff --git a/canna.if b/canna.if
index 400db07..079b09e 100644
--- a/canna.if
+++ b/canna.if
@@ -46,10 +46,7 @@ interface(`canna_admin',`
allow $1 canna_t:process { ptrace signal_perms };
ps_process_pattern($1, canna_t)

- init_labeled_script_domtrans($1, canna_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 canna_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, canna_t, canna_initrc_exec_t)

logging_list_logs($1)
admin_pattern($1, canna_log_t)
diff --git a/ccs.if b/ccs.if
index bb17e0f..834cc04 100644
--- a/ccs.if
+++ b/ccs.if
@@ -105,10 +105,7 @@ interface(`ccs_admin',`
allow $1 ccs_t:process { ptrace signal_perms };
ps_process_pattern($1, ccs_t)

- init_labeled_script_domtrans($1, ccs_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ccs_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ccs_t, ccs_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, ccs_conf_t)
diff --git a/certmaster.if b/certmaster.if
index 0c53b18..25939b6 100644
--- a/certmaster.if
+++ b/certmaster.if
@@ -124,10 +124,7 @@ interface(`certmaster_admin',`
allow $1 certmaster_t:process { ptrace signal_perms };
ps_process_pattern($1, certmaster_t)

- init_labeled_script_domtrans($1, certmaster_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 certmaster_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, certmaster_t, certmaster_initrc_exec_t)

files_list_etc($1)
miscfiles_manage_generic_cert_dirs($1)
diff --git a/certmonger.if b/certmonger.if
index 008f8ef..a52667d 100644
--- a/certmonger.if
+++ b/certmonger.if
@@ -162,10 +162,7 @@ interface(`certmonger_admin',`
ps_process_pattern($1, certmonger_t)
allow $1 certmonger_t:process { ptrace signal_perms };

- certmonger_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 certmonger_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, certmonger_t, certmonger_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, certmonger_var_lib_t)
diff --git a/cfengine.if b/cfengine.if
index a731122..a7e3641 100644
--- a/cfengine.if
+++ b/cfengine.if
@@ -97,10 +97,7 @@ interface(`cfengine_admin',`
allow $1 cfengine_domain:process { ptrace signal_perms };
ps_process_pattern($1, cfengine_domain)

- init_labeled_script_domtrans($1, cfengine_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 cfengine_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cfengine_domain, cfengine_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, { cfengine_log_t cfengine_var_lib_t })
diff --git a/cgroup.if b/cgroup.if
index 85ca63f..6653c55 100644
--- a/cgroup.if
+++ b/cgroup.if
@@ -180,11 +180,8 @@ interface(`cgroup_admin',`
admin_pattern($1, cgred_var_run_t)
files_list_pids($1)

- cgroup_initrc_domtrans_cgconfig($1)
- cgroup_initrc_domtrans_cgred($1)
- domain_system_change_exemption($1)
- role_transition $2 { cgconfig_initrc_exec_t cgred_initrc_exec_t } system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cgred_t, cgred_initrc_exec_t)
+ init_manage_service_template($1, $2, cgconfig_t, cgconfig_initrc_exec_t)

cgroup_run_cgclear($1, $2)
')
diff --git a/chronyd.if b/chronyd.if
index 32e8265..6a121a3 100644
--- a/chronyd.if
+++ b/chronyd.if
@@ -184,10 +184,7 @@ interface(`chronyd_admin',`
allow $1 chronyd_t:process { ptrace signal_perms };
ps_process_pattern($1, chronyd_t)

- chronyd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 chronyd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, chronyd_t, chronyd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, chronyd_keys_t)
diff --git a/cipe.if b/cipe.if
index 5fb51b2..c590aa2 100644
--- a/cipe.if
+++ b/cipe.if
@@ -25,8 +25,5 @@ interface(`cipe_admin',`
allow $1 ciped_t:process { ptrace signal_perms };
ps_process_pattern($1, ciped_t)

- init_labeled_script_domtrans($1, ciped_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ciped_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ciped_t, ciped_initrc_exec_t)
')
diff --git a/clamav.if b/clamav.if
index 4cc4a5c..7dc1af4 100644
--- a/clamav.if
+++ b/clamav.if
@@ -205,10 +205,7 @@ interface(`clamav_admin',`
allow $1 { clamd_t clamscan_t freshclam_t }:process { ptrace signal_perms };
ps_process_pattern($1, { clamd_t clamscan_t freshclam_t })

- init_labeled_script_domtrans($1, clamd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 clamd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, clamd_t, clamd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, clamd_etc_t)
diff --git a/cmirrord.if b/cmirrord.if
index cc4e7cb..4dc9905 100644
--- a/cmirrord.if
+++ b/cmirrord.if
@@ -106,10 +106,7 @@ interface(`cmirrord_admin',`
allow $1 cmirrord_t:process { ptrace signal_perms };
ps_process_pattern($1, cmirrord_t)

- cmirrord_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 cmirrord_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cmirrord_t, cmirrord_initrc_exec_t)

files_list_pids($1)
admin_pattern($1, cmirrord_var_run_t)
diff --git a/cobbler.if b/cobbler.if
index c223f81..38bc9cc 100644
--- a/cobbler.if
+++ b/cobbler.if
@@ -183,10 +183,7 @@ interface(`cobbler_admin',`
allow $1 cobblerd_t:process { ptrace signal_perms };
ps_process_pattern($1, cobblerd_t)

- cobblerd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 cobblerd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cobblerd_t, cobblerd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, cobbler_etc_t)
diff --git a/collectd.if b/collectd.if
index 954309e..c5233c8 100644
--- a/collectd.if
+++ b/collectd.if
@@ -26,10 +26,7 @@ interface(`collectd_admin',`
allow $1 collectd_t:process { ptrace signal_perms };
ps_process_pattern($1, collectd_t)

- init_labeled_script_domtrans($1, collectd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 collectd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, collectd_t, collectd_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, collectd_var_run_t)
diff --git a/condor.if b/condor.if
index c80aaf5..21af45f 100644
--- a/condor.if
+++ b/condor.if
@@ -66,10 +66,7 @@ interface(`condor_admin',`
allow $1 condor_domain:process { ptrace signal_perms };
ps_process_pattern($1, condor_domain)

- init_labeled_script_domtrans($1, condor_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 condor_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, condor_domain, condor_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, condor_conf_t)
diff --git a/corosync.if b/corosync.if
index 694a037..c2b378a 100644
--- a/corosync.if
+++ b/corosync.if
@@ -165,10 +165,7 @@ interface(`corosync_admin',`
allow $1 corosync_t:process { ptrace signal_perms };
ps_process_pattern($1, corosync_t)

- corosync_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 corosync_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, corosync_t, corosync_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, corosync_tmp_t)
diff --git a/couchdb.if b/couchdb.if
index 715a826..d53f86a 100644
--- a/couchdb.if
+++ b/couchdb.if
@@ -103,10 +103,7 @@ interface(`couchdb_admin',`
allow $1 couchdb_t:process { ptrace signal_perms };
ps_process_pattern($1, couchdb_t)

- init_labeled_script_domtrans($1, couchdb_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 couchdb_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, couchdb_t, couchdb_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, couchdb_conf_t)
diff --git a/ctdb.if b/ctdb.if
index b25b01d..83e224b 100644
--- a/ctdb.if
+++ b/ctdb.if
@@ -66,10 +66,7 @@ interface(`ctdb_admin',`
allow $1 ctdbd_t:process { ptrace signal_perms };
ps_process_pattern($1, ctdbd_t)

- init_labeled_script_domtrans($1, ctdbd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ctdbd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ctdbd_t, ctdbd_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, ctdbd_log_t)
diff --git a/cups.if b/cups.if
index 3023be7..6025300 100644
--- a/cups.if
+++ b/cups.if
@@ -357,10 +357,7 @@ interface(`cups_admin',`
ps_process_pattern($1, { cupsd_t cupsd_config_t cupsd_lpd_t })
ps_process_pattern($1, { cups_pdf_t hplip_t ptal_t })

- init_labeled_script_domtrans($1, cupsd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 cupsd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cupsd_t, cupsd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { cupsd_etc_t cupsd_rw_etc_t ptal_etc_t })
diff --git a/cvs.if b/cvs.if
index 64775fd..01cce48 100644
--- a/cvs.if
+++ b/cvs.if
@@ -65,10 +65,7 @@ interface(`cvs_admin',`
allow $1 cvs_t:process { ptrace signal_perms };
ps_process_pattern($1, cvs_t)

- init_labeled_script_domtrans($1, cvs_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 cvs_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cvs_t, cvs_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, cvs_keytab_t)
diff --git a/cyphesis.if b/cyphesis.if
index df8aa4a..d929015 100644
--- a/cyphesis.if
+++ b/cyphesis.if
@@ -45,10 +45,7 @@ interface(`cyphesis_admin',`
allow $1 cyphesis_t:process { ptrace signal_perms };
ps_process_pattern($1, cyphesis_t)

- init_labeled_script_domtrans($1, cyphesis_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 cyphesis_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cyphesis_t, cyphesis_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, cyphesis_log_t)
diff --git a/cyrus.if b/cyrus.if
index 83bfda6..b85d8be 100644
--- a/cyrus.if
+++ b/cyrus.if
@@ -67,10 +67,7 @@ interface(`cyrus_admin',`
allow $1 cyrus_t:process { ptrace signal_perms };
ps_process_pattern($1, cyrus_t)

- init_labeled_script_domtrans($1, cyrus_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 cyrus_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, cyrus_t, cyrus_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, cyrus_keytab_t)
diff --git a/dante.if b/dante.if
index e709177..85e12ff 100644
--- a/dante.if
+++ b/dante.if
@@ -26,10 +26,7 @@ interface(`dante_admin',`
allow $1 dante_t:process { ptrace signal_perms };
ps_process_pattern($1, dante_t)

- init_labeled_script_domtrans($1, dante_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dante_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dante_t, dante_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, dante_conf_t)
diff --git a/ddclient.if b/ddclient.if
index 5606b40..ff557b3 100644
--- a/ddclient.if
+++ b/ddclient.if
@@ -73,10 +73,7 @@ interface(`ddclient_admin',`
allow $1 ddclient_t:process { ptrace signal_perms };
ps_process_pattern($1, ddclient_t)

- init_labeled_script_domtrans($1, ddclient_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ddclient_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ddclient_t, ddclient_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, ddclient_etc_t)
diff --git a/denyhosts.if b/denyhosts.if
index a7326da..822264f 100644
--- a/denyhosts.if
+++ b/denyhosts.if
@@ -63,10 +63,7 @@ interface(`denyhosts_admin',`
allow $1 denyhosts_t:process { ptrace signal_perms };
ps_process_pattern($1, denyhosts_t)

- denyhosts_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 denyhosts_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, denyhosts_t, denyhosts_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, denyhosts_var_lib_t)
diff --git a/dhcp.if b/dhcp.if
index c697edb..c6c9861 100644
--- a/dhcp.if
+++ b/dhcp.if
@@ -84,10 +84,7 @@ interface(`dhcpd_admin',`
allow $1 dhcpd_t:process { ptrace signal_perms };
ps_process_pattern($1, dhcpd_t)

- init_labeled_script_domtrans($1, dhcpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dhcpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dhcpd_t, dhcpd_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, dhcpd_tmp_t)
diff --git a/dictd.if b/dictd.if
index 3cc3494..2b08886 100644
--- a/dictd.if
+++ b/dictd.if
@@ -41,10 +41,7 @@ interface(`dictd_admin',`
allow $1 dictd_t:process { ptrace signal_perms };
ps_process_pattern($1, dictd_t)

- init_labeled_script_domtrans($1, dictd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dictd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dictd_t, dictd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, dictd_etc_t)
diff --git a/dirmngr.if b/dirmngr.if
index e5f6733..68c8c5d 100644
--- a/dirmngr.if
+++ b/dirmngr.if
@@ -26,10 +26,7 @@ interface(`dirmngr_admin',`
allow $1 dirmngr_t:process { ptrace signal_perms };
ps_process_pattern($1, dirmngr_t)

- init_labeled_script_domtrans($1, dirmngr_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dirmngr_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dirmngr_t, dirmngr_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, dirmngr_conf_t)
diff --git a/distcc.if b/distcc.if
index 473823d..4490ec0 100644
--- a/distcc.if
+++ b/distcc.if
@@ -26,10 +26,7 @@ interface(`distcc_admin',`
allow $1 distccd_t:process { ptrace signal_perms };
ps_process_pattern($1, distccd_t)

- init_labeled_script_domtrans($1, distccd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 distccd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, distccd_t, distccd_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, distccd_log_t)
diff --git a/dkim.if b/dkim.if
index 386e494..26655cc 100644
--- a/dkim.if
+++ b/dkim.if
@@ -26,10 +26,7 @@ interface(`dkim_admin',`
allow $1 dkim_milter_t:process { ptrace signal_perms };
ps_process_pattern($1, dkim_milter_t)

- init_labeled_script_domtrans($1, dkim_milter_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dkim_milter_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dkim_milter_t, dkim_milter_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, dkim_milter_private_key_t)
diff --git a/dnsmasq.if b/dnsmasq.if
index 62e4948..10ff51a 100644
--- a/dnsmasq.if
+++ b/dnsmasq.if
@@ -273,10 +273,7 @@ interface(`dnsmasq_admin',`
allow $1 dnsmasq_t:process { ptrace signal_perms };
ps_process_pattern($1, dnsmasq_t)

- init_labeled_script_domtrans($1, dnsmasq_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dnsmasq_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dnsmasq_t, dnsmasq_initrc_exec_t)

files_list_var_lib($1)
admin_pattern($1, dnsmasq_lease_t)
diff --git a/dnssectrigger.if b/dnssectrigger.if
index 456da5c..880a3fd 100644
--- a/dnssectrigger.if
+++ b/dnssectrigger.if
@@ -26,10 +26,7 @@ interface(`dnssectrigger_admin',`
allow $1 dnssec_triggerd_t:process { ptrace signal_perms };
ps_process_pattern($1, dnssec_triggerd_t)

- init_labeled_script_domtrans($1, dnssec_triggerd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dnssec_triggerd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dnssec_triggerd_t, dnssec_triggerd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, dnssec_trigger_conf_t)
diff --git a/dovecot.if b/dovecot.if
index d5badb7..4308ca8 100644
--- a/dovecot.if
+++ b/dovecot.if
@@ -149,10 +149,7 @@ interface(`dovecot_admin',`
allow $1 dovecot_t:process { ptrace signal_perms };
ps_process_pattern($1, dovecot_t)

- init_labeled_script_domtrans($1, dovecot_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dovecot_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dovecot_t, dovecot_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { dovecot_keytab_t dovecot_etc_t })
diff --git a/drbd.if b/drbd.if
index 9a21639..9084ecf 100644
--- a/drbd.if
+++ b/drbd.if
@@ -46,10 +46,7 @@ interface(`drbd_admin',`
allow $1 drbd_t:process { ptrace signal_perms };
ps_process_pattern($1, drbd_t)

- init_labeled_script_domtrans($1, drbd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 drbd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, drbd_t, drbd_initrc_exec_t)

files_search_locks($1)
admin_pattern($1, drbd_lock_t)
diff --git a/dspam.if b/dspam.if
index 18f2452..c0e8192 100644
--- a/dspam.if
+++ b/dspam.if
@@ -66,10 +66,7 @@ interface(`dspam_admin',`
allow $1 dspam_t:process { ptrace signal_perms };
ps_process_pattern($1, dspam_t)

- init_labeled_script_domtrans($1, dspam_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 dspam_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dspam_t, dspam_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, dspam_log_t)
diff --git a/entropyd.if b/entropyd.if
index 1161fbf..776a5c9 100644
--- a/entropyd.if
+++ b/entropyd.if
@@ -25,10 +25,7 @@ interface(`entropyd_admin',`
allow $1 entropyd_t:process { ptrace signal_perms };
ps_process_pattern($1, entropyd_t)

- init_labeled_script_domtrans($1, entropyd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 entropyd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, entropyd_t, entropyd_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, entropyd_var_run_t)
diff --git a/exim.if b/exim.if
index 9bbc690..7ba1907 100644
--- a/exim.if
+++ b/exim.if
@@ -288,10 +288,7 @@ interface(`exim_admin',`
allow $1 exim_t:process { ptrace signal_perms };
ps_process_pattern($1, exim_t)

- init_labeled_script_domtrans($1, exim_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 exim_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, exim_t, exim_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, exim_keytab_t)
diff --git a/fail2ban.if b/fail2ban.if
index 50d0084..0571b2a 100644
--- a/fail2ban.if
+++ b/fail2ban.if
@@ -266,10 +266,7 @@ interface(`fail2ban_admin',`
allow $1 { fail2ban_t fail2ban_client_t }:process { ptrace signal_perms };
ps_process_pattern($1, { fail2ban_t fail2ban_client_t })

- init_labeled_script_domtrans($1, fail2ban_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 fail2ban_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, fail2ban_t, fail2ban_initrc_exec_t)

logging_list_logs($1)
admin_pattern($1, fail2ban_log_t)
diff --git a/fcoe.if b/fcoe.if
index c3484a9..f241160 100644
--- a/fcoe.if
+++ b/fcoe.if
@@ -44,10 +44,7 @@ interface(`fcoe_admin',`
allow $1 fcoemon_t:process { ptrace signal_perms };
ps_process_pattern($1, fcoemon_t)

- init_labeled_script_domtrans($1, fcoemon_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 fcoemon_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, fcoemon_t, fcoemon_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, fcoemon_var_run_t)
diff --git a/fetchmail.if b/fetchmail.if
index c3f7916..06f3ebb 100644
--- a/fetchmail.if
+++ b/fetchmail.if
@@ -23,10 +23,7 @@ interface(`fetchmail_admin',`
type fetchmail_var_run_t, fetchmail_initrc_exec_t, fetchmail_log_t;
')

- init_labeled_script_domtrans($1, fetchmail_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 fetchmail_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, fetchmail_t, fetchmail_initrc_exec_t)

allow $1 fetchmail_t:process { ptrace signal_perms };
ps_process_pattern($1, fetchmail_t)
diff --git a/firewalld.if b/firewalld.if
index c62c567..70c1229 100644
--- a/firewalld.if
+++ b/firewalld.if
@@ -86,10 +86,7 @@ interface(`firewalld_admin',`
allow $1 firewalld_t:process { ptrace signal_perms };
ps_process_pattern($1, firewalld_t)

- init_labeled_script_domtrans($1, firewalld_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 firewalld_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, firewalld_t, firewalld_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, firewalld_var_run_t)
diff --git a/ftp.if b/ftp.if
index 65adda9..12b1b3c 100644
--- a/ftp.if
+++ b/ftp.if
@@ -182,10 +182,7 @@ interface(`ftp_admin',`
allow $1 { ftpd_t ftpdctl_t sftpd_t anon_sftpd_t }:process { ptrace signal_perms };
ps_process_pattern($1, { ftpd_t ftpdctl_t sftpd_t anon_sftpd_t })

- init_labeled_script_domtrans($1, ftpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ftpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ftpd_t, ftpd_initrc_exec_t)

miscfiles_manage_public_files($1)

diff --git a/gatekeeper.if b/gatekeeper.if
index 30926d7..c4bc44c 100644
--- a/gatekeeper.if
+++ b/gatekeeper.if
@@ -26,10 +26,7 @@ interface(`gatekeeper_admin',`
allow $1 gatekeeper_t:process { ptrace signal_perms };
ps_process_pattern($1, gatekeeper_t)

- init_labeled_script_domtrans($1, gatekeeper_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 gatekeeper_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, gatekeeper_t, gatekeeper_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, gatekeeper_etc_t)
diff --git a/gdomap.if b/gdomap.if
index 7d6b6b7..5ecf51d 100644
--- a/gdomap.if
+++ b/gdomap.if
@@ -45,10 +45,7 @@ interface(`gdomap_admin',`
allow $1 gdomap_t:process { ptrace signal_perms };
ps_process_pattern($1, gdomap_t)

- init_labeled_script_domtrans($1, gdomap_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 gdomap_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, gdomap_t, gdomap_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, gdomap_conf_t)
diff --git a/glance.if b/glance.if
index 9eacb2c..a7725ea 100644
--- a/glance.if
+++ b/glance.if
@@ -245,10 +245,8 @@ interface(`glance_admin',`
allow $1 { glance_api_t glance_registry_t }:process signal_perms;
ps_process_pattern($1, { glance_api_t glance_registry_t })

- init_labeled_script_domtrans($1, { glance_api_initrc_exec_t glance_registry_initrc_exec_t })
- domain_system_change_exemption($1)
- role_transition $2 { glance_api_initrc_exec_t glance_registry_initrc_exec_t } system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, glance_api_t, glance_api_initrc_exec_t)
+ init_manage_service_template($1, $2, glance_registry_t, glance_registry_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, glance_log_t)
diff --git a/glusterfs.if b/glusterfs.if
index 05233c8..a3f095d 100644
--- a/glusterfs.if
+++ b/glusterfs.if
@@ -46,10 +46,7 @@ interface(`glusterfs_admin',`
type glusterd_var_run_t;
')

- init_labeled_script_domtrans($1, glusterd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 glusterd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, glusterd_t, glusterd_initrc_exec_t)

allow $1 glusterd_t:process { ptrace signal_perms };
ps_process_pattern($1, glusterd_t)
diff --git a/gpm.if b/gpm.if
index f1528c9..d7de36a 100644
--- a/gpm.if
+++ b/gpm.if
@@ -106,10 +106,7 @@ interface(`gpm_admin',`
allow $1 gpm_t:process { ptrace signal_perms };
ps_process_pattern($1, gpm_t)

- init_labeled_script_domtrans($1, gpm_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 gpm_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, gpm_t, gpm_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, gpm_conf_t)
diff --git a/gpsd.if b/gpsd.if
index 92eb564..196e0f6 100644
--- a/gpsd.if
+++ b/gpsd.if
@@ -91,10 +91,7 @@ interface(`gpsd_admin',`
allow $1 gpsd_t:process { ptrace signal_perms };
ps_process_pattern($1, gpsd_t)

- init_labeled_script_domtrans($1, gpsd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 gpsd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, gpsd_t, gpsd_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, gpsd_var_run_t)
diff --git a/hadoop.if b/hadoop.if
index 2b0d488..5d417b4 100644
--- a/hadoop.if
+++ b/hadoop.if
@@ -441,10 +441,7 @@ interface(`hadoop_admin',`
allow $1 { hadoop_domain hadoop_initrc_domain hadoop_t zookeeper_t zookeeper_server_t }:process { ptrace signal_perms };
ps_process_pattern($1, { hadoop_domain hadoop_initrc_domain hadoop_t zookeeper_t zookeeper_server_t })

- init_labeled_script_domtrans($1, hadoop_init_script_file)
- domain_system_change_exemption($1)
- role_transition $2 hadoop_init_script_file system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, hadoop_domain, hadoop_init_script_file)

files_search_etc($1)
admin_pattern($1, { hadoop_etc_t zookeeper_etc_t })
diff --git a/hddtemp.if b/hddtemp.if
index 1728071..99acdc8 100644
--- a/hddtemp.if
+++ b/hddtemp.if
@@ -63,10 +63,7 @@ interface(`hddtemp_admin',`
allow $1 hddtemp_t:process { ptrace signal_perms };
ps_process_pattern($1, hddtemp_t)

- init_labeled_script_domtrans($1, hddtemp_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 hddtemp_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, hddtemp_t, hddtemp_initrc_exec_t)

admin_pattern($1, hddtemp_etc_t)
files_search_etc($1)
diff --git a/howl.if b/howl.if
index dc609f0..b89f82e 100644
--- a/howl.if
+++ b/howl.if
@@ -43,10 +43,7 @@ interface(`howl_admin',`
allow $1 howl_t:process { ptrace signal_perms };
ps_process_pattern($1, howl_t)

- init_labeled_script_domtrans($1, howl_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 howl_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, howl_t, howl_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, howl_var_run_t)
diff --git a/hypervkvp.if b/hypervkvp.if
index 6517fad..9775774 100644
--- a/hypervkvp.if
+++ b/hypervkvp.if
@@ -25,8 +25,5 @@ interface(`hypervkvp_admin',`
allow $1 hypervkvpd_t:process { ptrace signal_perms };
ps_process_pattern($1, hypervkvpd_t)

- init_labeled_script_domtrans($1, hypervkvpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 hypervkvpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, hypervkvpd_t, hypervkvpd_initrc_exec_t)
')
diff --git a/i18n_input.if b/i18n_input.if
index 5eab254..37ff663 100644
--- a/i18n_input.if
+++ b/i18n_input.if
@@ -40,10 +40,7 @@ interface(`i18n_input_admin',`
allow $1 i18n_input_t:process { ptrace signal_perms };
ps_process_pattern($1, i18n_input_t)

- init_labeled_script_domtrans($1, i18n_input_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 i18n_input_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, i18n_input_t, i18n_input_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, i18n_input_var_run_t)
diff --git a/icecast.if b/icecast.if
index 580b533..2d32ce6 100644
--- a/icecast.if
+++ b/icecast.if
@@ -176,10 +176,7 @@ interface(`icecast_admin',`
type icecast_var_run_t;
')

- icecast_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 icecast_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, icecast_t, icecast_initrc_exec_t)

allow $1 icecast_t:process { ptrace signal_perms };
ps_process_pattern($1, icecast_t)
diff --git a/ifplugd.if b/ifplugd.if
index 8999899..2aacc4e 100644
--- a/ifplugd.if
+++ b/ifplugd.if
@@ -122,10 +122,7 @@ interface(`ifplugd_admin',`
allow $1 ifplugd_t:process { ptrace signal_perms };
ps_process_pattern($1, ifplugd_t)

- init_labeled_script_domtrans($1, ifplugd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ifplugd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ifplugd_t, ifplugd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, ifplugd_etc_t)
diff --git a/inn.if b/inn.if
index eb87f23..7eff1ab 100644
--- a/inn.if
+++ b/inn.if
@@ -230,10 +230,7 @@ interface(`inn_admin',`
type innd_var_run_t, innd_initrc_exec_t;
')

- init_labeled_script_domtrans($1, innd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 innd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, innd_t, innd_initrc_exec_t)

allow $1 innd_t:process { ptrace signal_perms };
ps_process_pattern($1, innd_t)
diff --git a/iodine.if b/iodine.if
index a0bfbd0..e813a57 100644
--- a/iodine.if
+++ b/iodine.if
@@ -47,8 +47,5 @@ interface(`iodine_admin',`
allow $1 iodined_t:process { ptrace signal_perms };
ps_process_pattern($1, iodined_t)

- init_labeled_script_domtrans($1, iodined_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 iodined_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, iodined_t, iodined_initrc_exec_t)
')
diff --git a/ircd.if b/ircd.if
index 1a88664..3a6c3af 100644
--- a/ircd.if
+++ b/ircd.if
@@ -23,10 +23,7 @@ interface(`ircd_admin',`
type ircd_log_t, ircd_var_lib_t, ircd_var_run_t;
')

- init_labeled_script_domtrans($1, ircd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ircd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ircd_t, ircd_initrc_exec_t)

allow $1 ircd_t:process { ptrace signal_perms };
ps_process_pattern($1, ircd_t)
diff --git a/irqbalance.if b/irqbalance.if
index d7113e7..19b7b16 100644
--- a/irqbalance.if
+++ b/irqbalance.if
@@ -25,10 +25,7 @@ interface(`irqbalance_admin',`
allow $1 irqbalance_t:process { ptrace signal_perms };
ps_process_pattern($1, irqbalance_t)

- init_labeled_script_domtrans($1, irqbalance_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 irqbalance_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, irqbalance_t, irqbalance_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, irqbalance_var_run_t)
diff --git a/iscsi.if b/iscsi.if
index 1a35420..ce0df75 100644
--- a/iscsi.if
+++ b/iscsi.if
@@ -105,10 +105,7 @@ interface(`iscsi_admin',`
allow $1 iscsid_t:process { ptrace signal_perms };
ps_process_pattern($1, iscsid_t)

- init_labeled_script_domtrans($1, iscsi_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 iscsi_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, iscsi_t, iscsi_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, iscsi_log_t)
diff --git a/isns.if b/isns.if
index da7e970..c5b8a34 100644
--- a/isns.if
+++ b/isns.if
@@ -26,10 +26,7 @@ interface(`isnsd_admin',`
allow $1 isnsd_t:process { ptrace signal_perms };
ps_process_pattern($1, isnsd_t)

- init_labeled_script_domtrans($1, isnsd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 isnsd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, isnsd_t, isnsd_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, isnsd_var_lib_t)
diff --git a/jabber.if b/jabber.if
index 7eb3811..40ae8d2 100644
--- a/jabber.if
+++ b/jabber.if
@@ -81,10 +81,7 @@ interface(`jabber_admin',`
allow $1 jabberd_domain:process { ptrace signal_perms };
ps_process_pattern($1, jabberd_domain)

- init_labeled_script_domtrans($1, jabberd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 jabberd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, jabberd_domain, jabberd_initrc_exec_t)

files_search_locks($1)
admin_pattern($1, jabberd_lock_t)
diff --git a/kdump.if b/kdump.if
index 3a00b3a..94f78c0 100644
--- a/kdump.if
+++ b/kdump.if
@@ -102,10 +102,7 @@ interface(`kdump_admin',`
allow $1 { kdump_t kdumpctl_t }:process { ptrace signal_perms };
ps_process_pattern($1, { kdump_t kdumpctl_t })

- init_labeled_script_domtrans($1, kdump_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 kdump_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, kdump_t, kdump_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, kdump_etc_t)
diff --git a/kerberos.if b/kerberos.if
index 77a5c49..97fc16c 100644
--- a/kerberos.if
+++ b/kerberos.if
@@ -493,10 +493,7 @@ interface(`kerberos_admin',`
allow $1 { kadmind_t krb5kdc_t kpropd_t }:process { ptrace signal_perms };
ps_process_pattern($1, { kadmind_t krb5kdc_t kpropd_t })

- init_labeled_script_domtrans($1, kerberos_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 kerberos_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, { kadmind_t krb5kdc_t }, kerberos_initrc_exec_t)

logging_list_logs($1)
admin_pattern($1, kadmind_log_t)
diff --git a/kerneloops.if b/kerneloops.if
index 714448f..5077ce5 100644
--- a/kerneloops.if
+++ b/kerneloops.if
@@ -108,10 +108,7 @@ interface(`kerneloops_admin',`
allow $1 kerneloops_t:process { ptrace signal_perms };
ps_process_pattern($1, kerneloops_t)

- init_labeled_script_domtrans($1, kerneloops_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 kerneloops_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, kerneloops_t, kerneloops_initrc_exec_t)

files_search_tmp($1)
admin_pattern($1, kerneloops_tmp_t)
diff --git a/keystone.if b/keystone.if
index e88fb16..44aba27 100644
--- a/keystone.if
+++ b/keystone.if
@@ -26,10 +26,7 @@ interface(`keystone_admin',`
allow $1 keystone_t:process { ptrace signal_perms };
ps_process_pattern($1, keystone_t)

- init_labeled_script_domtrans($1, keystone_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 keystone_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, keystone_t, keystone_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, keystone_log_t)
diff --git a/kismet.if b/kismet.if
index f20de6e..9ef087d 100644
--- a/kismet.if
+++ b/kismet.if
@@ -286,10 +286,7 @@ interface(`kismet_admin',`
type kismet_log_t, kismet_tmp_t, kismet_initrc_exec_t;
')

- init_labeled_script_domtrans($1, kismet_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 kismet_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, kismet_t, kismet_initrc_exec_t)

ps_process_pattern($1, kismet_t)
allow $1 kismet_t:process { ptrace signal_perms };
diff --git a/ksmtuned.if b/ksmtuned.if
index 93a64bc..cc0227e 100644
--- a/ksmtuned.if
+++ b/ksmtuned.if
@@ -61,10 +61,7 @@ interface(`ksmtuned_admin',`
type ksmtuned_initrc_exec_t, ksmtuned_log_t;
')

- ksmtuned_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 ksmtuned_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ksmtuned_t, ksmtuned_initrc_exec_t)

allow $1 ksmtuned_t:process { ptrace signal_perms };
ps_process_pattern($1, ksmtuned_t)
diff --git a/kudzu.if b/kudzu.if
index 5297064..4b9caf4 100644
--- a/kudzu.if
+++ b/kudzu.if
@@ -89,10 +89,7 @@ interface(`kudzu_admin',`
allow $1 kudzu_t:process { ptrace signal_perms };
ps_process_pattern($1, kudzu_t)

- init_labeled_script_domtrans($1, kudzu_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 kudzu_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, kudzu_t, kudzu_initrc_exec_t)

files_search_tmp($1)
admin_pattern($1, kudzu_tmp_t)
diff --git a/l2tp.if b/l2tp.if
index 73e2803..f981467 100644
--- a/l2tp.if
+++ b/l2tp.if
@@ -86,10 +86,7 @@ interface(`l2tp_admin',`
allow $1 l2tpd_t:process { ptrace signal_perms };
ps_process_pattern($1, l2tpd_t)

- init_labeled_script_domtrans($1, l2tpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 l2tpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, l2tpd_t, l2tpd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, l2tp_conf_t)
diff --git a/ldap.if b/ldap.if
index 3602712..6d95732 100644
--- a/ldap.if
+++ b/ldap.if
@@ -122,10 +122,7 @@ interface(`ldap_admin',`
allow $1 slapd_t:process { ptrace signal_perms };
ps_process_pattern($1, slapd_t)

- init_labeled_script_domtrans($1, slapd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 slapd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, slapd_t, slapd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { slapd_etc_t slapd_db_t slapd_cert_t slapd_keytab_t })
diff --git a/likewise.if b/likewise.if
index bd20e8c..0dedf0a 100644
--- a/likewise.if
+++ b/likewise.if
@@ -110,10 +110,7 @@ interface(`likewise_admin',`
allow $1 likewise_domains:process { ptrace signal_perms };
ps_process_pattern($1, likewise_domains)

- init_labeled_script_domtrans($1, likewise_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 likewise_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, likewise_domains, likewise_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { likewise_etc_t likewise_pstore_lock_t likewise_krb5_ad_t })
diff --git a/lircd.if b/lircd.if
index dff21a7..4eda783 100644
--- a/lircd.if
+++ b/lircd.if
@@ -84,10 +84,7 @@ interface(`lircd_admin',`
allow $1 lircd_t:process { ptrace signal_perms };
ps_process_pattern($1, lircd_t)

- init_labeled_script_domtrans($1, lircd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 lircd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, lircd_t, lircd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, lircd_etc_t)
diff --git a/lldpad.if b/lldpad.if
index d18c960..0e7d6b7 100644
--- a/lldpad.if
+++ b/lldpad.if
@@ -45,10 +45,7 @@ interface(`lldpad_admin',`
allow $1 lldpad_t:process { ptrace signal_perms };
ps_process_pattern($1, lldpad_t)

- init_labeled_script_domtrans($1, lldpad_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 lldpad_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, lldpad_t, lldpad_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, lldpad_var_lib_t)
diff --git a/mailscanner.if b/mailscanner.if
index 214cb44..05767bd 100644
--- a/mailscanner.if
+++ b/mailscanner.if
@@ -47,10 +47,7 @@ interface(`mscan_admin',`
allow $1 mscan_t:process { ptrace signal_perms };
ps_process_pattern($1, mscan_t)

- init_labeled_script_domtrans($1, mscan_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 mscan_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, mscan_t, mscan_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, mscan_etc_t)
diff --git a/mcelog.if b/mcelog.if
index f89651e..bdcf3e2 100644
--- a/mcelog.if
+++ b/mcelog.if
@@ -45,10 +45,7 @@ interface(`mcelog_admin',`
allow $1 mcelog_t:process { ptrace signal_perms };
ps_process_pattern($1, mcelog_t)

- init_labeled_script_domtrans($1, mcelog_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 mcelog_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, mcelog_t, mcelog_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, mcelog_etc_t)
diff --git a/memcached.if b/memcached.if
index 1d4eb19..9449397 100644
--- a/memcached.if
+++ b/memcached.if
@@ -124,10 +124,7 @@ interface(`memcached_admin',`
allow $1 memcached_t:process { ptrace signal_perms };
ps_process_pattern($1, memcached_t)

- init_labeled_script_domtrans($1, memcached_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 memcached_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, memcached_t, memcached_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, memcached_var_run_t)
diff --git a/minidlna.if b/minidlna.if
index 358917a..cc883c0 100644
--- a/minidlna.if
+++ b/minidlna.if
@@ -26,10 +26,7 @@ interface(`minidlna_admin',`
allow $1 minidlna_t:process { ptrace signal_perms };
ps_process_pattern($1, minidlna_t)

- minidlna_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 minidlna_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, minidlna_t, minidlna_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, minidlna_conf_t)
diff --git a/minissdpd.if b/minissdpd.if
index f37a116..56d3a93 100644
--- a/minissdpd.if
+++ b/minissdpd.if
@@ -45,10 +45,7 @@ interface(`minissdpd_admin',`
allow $1 minissdpd_t:process { ptrace signal_perms };
ps_process_pattern($1, minissdpd_t)

- init_labeled_script_domtrans($1, minissdpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 minissdpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, minissdpd_t, minissdpd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, minissdpd_conf_t)
diff --git a/mongodb.if b/mongodb.if
index b247d25..7e28134 100644
--- a/mongodb.if
+++ b/mongodb.if
@@ -26,10 +26,7 @@ interface(`mongodb_admin',`
allow $1 mongod_t:process { ptrace signal_perms };
ps_process_pattern($1, mongod_t)

- init_labeled_script_domtrans($1, mongod_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 mongod_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, mongod_t, mongod_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, mongod_log_t)
diff --git a/monop.if b/monop.if
index a6ec137..18a9bac 100644
--- a/monop.if
+++ b/monop.if
@@ -26,10 +26,7 @@ interface(`monop_admin',`
allow $1 monopd_t:process { ptrace signal_perms };
ps_process_pattern($1, monopd_t)

- init_labeled_script_domtrans($1, monopd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 monopd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, monopd_t, monopd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, monopd_etc_t)
diff --git a/mpd.if b/mpd.if
index 5fa77c7..affd9c8 100644
--- a/mpd.if
+++ b/mpd.if
@@ -347,10 +347,7 @@ interface(`mpd_admin',`
allow $1 mpd_t:process { ptrace signal_perms };
ps_process_pattern($1, mpd_t)

- mpd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 mpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, mpd_t, mpd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, mpd_etc_t)
diff --git a/mrtg.if b/mrtg.if
index c595094..edafa6b 100644
--- a/mrtg.if
+++ b/mrtg.if
@@ -47,10 +47,7 @@ interface(`mrtg_admin',`
allow $1 mrtg_t:process { ptrace signal_perms };
ps_process_pattern($1, mrtg_t)

- init_labeled_script_domtrans($1, mrtg_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 mrtg_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, mrtg_t, mrtg_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, mrtg_etc_t)
diff --git a/munin.if b/munin.if
index b744fe3..06af328 100644
--- a/munin.if
+++ b/munin.if
@@ -173,10 +173,7 @@ interface(`munin_admin',`
allow $1 { munin_plugin_domain munin_t }:process { ptrace signal_perms };
ps_process_pattern($1, { munin_plugin_domain munin_t })

- init_labeled_script_domtrans($1, munin_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 munin_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, munin_t, munin_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, { munin_tmp_t munin_plugin_tmp_content })
diff --git a/mysql.if b/mysql.if
index 687af38..4371826 100644
--- a/mysql.if
+++ b/mysql.if
@@ -450,10 +450,8 @@ interface(`mysql_admin',`
allow $1 { mysqld_safe_t mysqld_t mysqlmanagerd_t }:process { ptrace signal_perms };
ps_process_pattern($1, { mysqld_safe_t mysqld_t mysqlmanagerd_t })

- init_labeled_script_domtrans($1, { mysqlmanagerd_initrc_exec_t mysqld_initrc_exec_t })
- domain_system_change_exemption($1)
- role_transition $2 { mysqlmanagerd_initrc_exec_t mysqld_initrc_exec_t } system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, mysqld_t, mysqld_initrc_exec_t)
+ init_manage_service_template($1, $2, mysqlmanagerd_t, mysqlmanagerd_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, { mysqlmanagerd_var_run_t mysqld_var_run_t })
--
2.3.6

2015-05-15 18:12:55

by Jason Zaman

Subject: [refpolicy] [PATCH v2 2/2] use init_manage_service_template in _admin interfaces N-Z

Most foo_admin interfaces have transitions on the
foo_initrc_exec_t to system_r. These are only applicable
for RedHat <6. This replaces them with a template which
can easily be changed for other init systems.

make validate passes for all combinations of distros,
standard/mcs/mls, monolithic y/n and direct_initrc y/n

This patch is for files starting with N-Z.
---
Changes from v1:
* Does not pass two _initrc_exec_t files together with { }. That did not work
with other interfaces that were called later. If a module has multiple domains
and initrc files, the template is called multiple times for each set.

* v1 got stuck in the spam filter because it was too big, this is split in two.
---
nagios.if | 5 +----
nessus.if | 5 +----
networkmanager.if | 5 +----
nis.if | 7 ++-----
nscd.if | 5 +----
nsd.if | 5 +----
nslcd.if | 5 +----
ntop.if | 5 +----
ntp.if | 5 +----
numad.if | 5 +----
nut.if | 5 +----
oident.if | 5 +----
openct.if | 5 +----
openhpi.if | 5 +----
openvpn.if | 5 +----
openvswitch.if | 5 +----
pacemaker.if | 5 +----
pads.if | 5 +----
pcscd.if | 5 +----
pegasus.if | 5 +----
perdition.if | 5 +----
pingd.if | 5 +----
pkcs.if | 5 +----
polipo.if | 5 +----
portmap.if | 5 +----
portreserve.if | 5 +----
postfix.if | 5 +----
postfixpolicyd.if | 5 +----
postgrey.if | 5 +----
ppp.if | 5 +----
prelude.if | 5 +----
privoxy.if | 5 +----
psad.if | 5 +----
puppet.if | 6 ++----
pxe.if | 5 +----
pyicqt.if | 5 +----
pyzor.if | 5 +----
qpid.if | 5 +----
quantum.if | 5 +----
quota.if | 5 +----
rabbitmq.if | 5 +----
radius.if | 5 +----
radvd.if | 5 +----
raid.if | 5 +----
redis.if | 5 +----
resmgr.if | 5 +----
rgmanager.if | 5 +----
rhcs.if | 7 +++----
rhsmcertd.if | 5 +----
ricci.if | 5 +----
rngd.if | 5 +----
roundup.if | 5 +----
rpc.if | 7 +++----
rpcbind.if | 5 +----
rpm.if | 5 +----
rtkit.if | 5 +----
rwho.if | 5 +----
samba.if | 5 +----
samhain.if | 5 +----
sanlock.if | 5 +----
sasl.if | 5 +----
sblim.if | 5 +----
sendmail.if | 4 +---
sensord.if | 5 +----
shorewall.if | 5 +----
slpd.if | 5 +----
smartmon.if | 5 +----
smokeping.if | 5 +----
smstools.if | 5 +----
snmp.if | 5 +----
snort.if | 5 +----
soundserver.if | 5 +----
spamassassin.if | 5 +----
squid.if | 5 +----
sssd.if | 5 +----
svnserve.if | 5 +----
sysstat.if | 5 +----
systemtap.if | 5 +----
tcsd.if | 5 +----
tgtd.if | 5 +----
tor.if | 5 +----
transproxy.if | 5 +----
tuned.if | 5 +----
ulogd.if | 5 +----
uptime.if | 5 +----
uucp.if | 5 +----
uuidd.if | 5 +----
varnishd.if | 10 ++--------
vdagent.if | 5 +----
vhostmd.if | 5 +----
virt.if | 5 +----
vnstatd.if | 5 +----
watchdog.if | 5 +----
wdmd.if | 5 +----
xfs.if | 5 +----
zabbix.if | 6 ++----
zarafa.if | 5 +----
zebra.if | 5 +----
98 files changed, 106 insertions(+), 396 deletions(-)

diff --git a/nagios.if b/nagios.if
index 0641e97..93f07fd 100644
--- a/nagios.if
+++ b/nagios.if
@@ -204,10 +204,7 @@ interface(`nagios_admin',`
allow $1 { nagios_t nrpe_t nagios_plugin_domain }:process { ptrace signal_perms };
ps_process_pattern($1, { nagios_t nrpe_t nagios_plugin_domain })

- init_labeled_script_domtrans($1, nagios_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 nagios_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, nagios_t, nagios_initrc_exec_t)

files_search_tmp($1)
admin_pattern($1, { nagios_eventhandler_plugin_tmp_t nagios_tmp_t nagios_system_plugin_tmp_t })
diff --git a/nessus.if b/nessus.if
index 42e9ed4..b1defe3 100644
--- a/nessus.if
+++ b/nessus.if
@@ -40,10 +40,7 @@ interface(`nessus_admin',`
allow $1 nessusd_t:process { ptrace signal_perms };
ps_process_pattern($1, nessusd_t)

- init_labeled_script_domtrans($1, nessusd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 nessusd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, nessusd_t, nessusd_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, nessusd_log_t)
diff --git a/networkmanager.if b/networkmanager.if
index baebe99..e15f18f 100644
--- a/networkmanager.if
+++ b/networkmanager.if
@@ -297,10 +297,7 @@ interface(`networkmanager_admin',`
allow $1 { wpa_cli_t NetworkManager_t }:process { ptrace signal_perms };
ps_process_pattern($1, { wpa_cli_t NetworkManager_t })

- init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 NetworkManager_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, NetworkManager_t, NetworkManager_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, { NetworkManager_etc_t NetworkManager_etc_rw_t })
diff --git a/nis.if b/nis.if
index 46e55c3..f7cb0a6 100644
--- a/nis.if
+++ b/nis.if
@@ -381,11 +381,8 @@ interface(`nis_admin',`
allow $1 { ypbind_t yppasswdd_t ypserv_t ypxfr_t }:process { ptrace signal_perms };
ps_process_pattern($1, { ypbind_t yppasswdd_t ypserv_t ypxfr_t })

- nis_initrc_domtrans($1)
- nis_initrc_domtrans_ypbind($1)
- domain_system_change_exemption($1)
- role_transition $2 { nis_initrc_exec_t ypbind_initrc_exec_t } system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ypbind_t, ypbind_initrc_exec_t)
+ init_manage_service_template($1, $2, ypserv_t, nis_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, { ypserv_tmp_t ypbind_tmp_t })
diff --git a/nscd.if b/nscd.if
index 8f2ab09..e92e2d0 100644
--- a/nscd.if
+++ b/nscd.if
@@ -299,10 +299,7 @@ interface(`nscd_admin',`
allow $1 nscd_t:process { ptrace signal_perms };
ps_process_pattern($1, nscd_t)

- init_labeled_script_domtrans($1, nscd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 nscd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, nscd_t, nscd_initrc_exec_t)

logging_list_logs($1)
admin_pattern($1, nscd_log_t)
diff --git a/nsd.if b/nsd.if
index a9c60ff..208cc12 100644
--- a/nsd.if
+++ b/nsd.if
@@ -54,10 +54,7 @@ interface(`nsd_admin',`
allow $1 nsd_t:process { ptrace signal_perms };
ps_process_pattern($1, nsd_t)

- init_labeled_script_domtrans($1, nsd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 nsd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, nsd_t, nsd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, { nsd_conf_t nsd_db_t })
diff --git a/nslcd.if b/nslcd.if
index bbd7cac..86bc919 100644
--- a/nslcd.if
+++ b/nslcd.if
@@ -102,10 +102,7 @@ interface(`nslcd_admin',`
allow $1 nslcd_t:process { ptrace signal_perms };
ps_process_pattern($1, nslcd_t)

- nslcd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 nslcd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, nslcd_t, nslcd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, nslcd_conf_t)
diff --git a/ntop.if b/ntop.if
index beaee73..4ffb735 100644
--- a/ntop.if
+++ b/ntop.if
@@ -26,10 +26,7 @@ interface(`ntop_admin',`
allow $1 ntop_t:process { ptrace signal_perms };
ps_process_pattern($1, ntop_t)

- init_labeled_script_domtrans($1, ntop_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ntop_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ntop_t, ntop_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, ntop_etc_t)
diff --git a/ntp.if b/ntp.if
index e96a309..299f85c 100644
--- a/ntp.if
+++ b/ntp.if
@@ -166,10 +166,7 @@ interface(`ntp_admin',`
allow $1 ntpd_t:process { ptrace signal_perms };
ps_process_pattern($1, ntpd_t)

- init_labeled_script_domtrans($1, ntpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ntpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ntpd_t, ntpd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { ntpd_key_t ntp_conf_t })
diff --git a/numad.if b/numad.if
index 0d3c270..77cd980 100644
--- a/numad.if
+++ b/numad.if
@@ -26,10 +26,7 @@ interface(`numad_admin',`
allow $1 numad_t:process { ptrace signal_perms };
ps_process_pattern($1, numad_t)

- init_labeled_script_domtrans($1, numad_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 numad_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, numad_t, numad_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, numad_log_t)
diff --git a/nut.if b/nut.if
index c606ae6..7e27efe 100644
--- a/nut.if
+++ b/nut.if
@@ -26,10 +26,7 @@ interface(`nut_admin',`
allow $1 nut_domain:process { ptrace signal_perms };
ps_process_pattern($1, nut_domain)

- init_labeled_script_domtrans($1, nut_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 nut_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, nut_domain, nut_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, nut_conf_t)
diff --git a/oident.if b/oident.if
index 513f452..0bce8c7 100644
--- a/oident.if
+++ b/oident.if
@@ -131,10 +131,7 @@ interface(`oident_admin',`
allow $1 oidentd_t:process { ptrace signal_perms };
ps_process_pattern($1, oidentd_t)

- init_labeled_script_domtrans($1, oidentd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 oidentd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, oidentd_t, oidentd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, oidentd_config_t)
diff --git a/openct.if b/openct.if
index a55238b..fbb910f 100644
--- a/openct.if
+++ b/openct.if
@@ -120,10 +120,7 @@ interface(`openct_admin',`
allow $1 openct_t:process { ptrace signal_perms };
ps_process_pattern($1, openct_t)

- init_labeled_script_domtrans($1, openct_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 openct_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, openct_t, openct_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, openct_var_run_t)
diff --git a/openhpi.if b/openhpi.if
index 3c86958..a167d25 100644
--- a/openhpi.if
+++ b/openhpi.if
@@ -26,10 +26,7 @@ interface(`openhpi_admin',`
allow $1 openhpid_t:process { ptrace signal_perms };
ps_process_pattern($1, openhpid_t)

- init_labeled_script_domtrans($1, openhpid_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 openhpid_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, openhpid_t, openhpid_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, openhpid_var_lib_t)
diff --git a/openvpn.if b/openvpn.if
index 6837e9a..ca3e2f2 100644
--- a/openvpn.if
+++ b/openvpn.if
@@ -150,10 +150,7 @@ interface(`openvpn_admin',`
allow $1 openvpn_t:process { ptrace signal_perms };
ps_process_pattern($1, openvpn_t)

- init_labeled_script_domtrans($1, openvpn_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 openvpn_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, openvpn_t, openvpn_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { openvpn_etc_t openvpn_etc_rw_t })
diff --git a/openvswitch.if b/openvswitch.if
index 9b15730..cf9e657 100644
--- a/openvswitch.if
+++ b/openvswitch.if
@@ -64,10 +64,7 @@ interface(`openvswitch_admin',`
allow $1 openvswitch_t:process { ptrace signal_perms };
ps_process_pattern($1, openvswitch_t)

- init_labeled_script_domtrans($1, openvswitch_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 openvswitch_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, openvswitch_t, openvswitch_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, openvswitch_conf_t)
diff --git a/pacemaker.if b/pacemaker.if
index 9682d9a..2202234 100644
--- a/pacemaker.if
+++ b/pacemaker.if
@@ -26,10 +26,7 @@ interface(`pacemaker_admin',`
allow $1 pacemaker_t:process { ptrace signal_perms };
ps_process_pattern($1, pacemaker_t)

- init_labeled_script_domtrans($1, pacemaker_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pacemaker_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pacemaker_t, pacemaker_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, pacemaker_var_lib_t)
diff --git a/pads.if b/pads.if
index 6e097c9..544169e 100644
--- a/pads.if
+++ b/pads.if
@@ -26,10 +26,7 @@ interface(`pads_admin', `
allow $1 pads_t:process { ptrace signal_perms };
ps_process_pattern($1, pads_t)

- init_labeled_script_domtrans($1, pads_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pads_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pads_t, pads_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, pads_var_run_t)
diff --git a/pcscd.if b/pcscd.if
index 7f77d32..e858008 100644
--- a/pcscd.if
+++ b/pcscd.if
@@ -128,10 +128,7 @@ interface(`pcscd_admin',`
allow $1 pcscd_t:process { ptrace signal_perms };
ps_process_pattern($1, pcscd_t)

- init_labeled_script_domtrans($1, pcscd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pcscd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pcscd_t, pcscd_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, pcscd_var_run_t)
diff --git a/pegasus.if b/pegasus.if
index d2fc677..ed2f077 100644
--- a/pegasus.if
+++ b/pegasus.if
@@ -27,10 +27,7 @@ interface(`pegasus_admin',`
allow $1 pegasus_t:process { ptrace signal_perms };
ps_process_pattern($1, pegasus_t)

- init_labeled_script_domtrans($1, pegasus_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pegasus_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pegasus_t, pegasus_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, pegasus_conf_t)
diff --git a/perdition.if b/perdition.if
index 47e09e1..debfd38 100644
--- a/perdition.if
+++ b/perdition.if
@@ -40,10 +40,7 @@ interface(`perdition_admin',`
allow $1 perdition_t:process { ptrace signal_perms };
ps_process_pattern($1, perdition_t)

- init_labeled_script_domtrans($1, perdition_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 perdition_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, perdition_t, perdition_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, perdition_etc_t)
diff --git a/pingd.if b/pingd.if
index 21a6ecb..30d36fe 100644
--- a/pingd.if
+++ b/pingd.if
@@ -84,10 +84,7 @@ interface(`pingd_admin',`
allow $1 pingd_t:process { ptrace signal_perms };
ps_process_pattern($1, pingd_t)

- init_labeled_script_domtrans($1, pingd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pingd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pingd_t, pingd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, pingd_etc_t)
diff --git a/pkcs.if b/pkcs.if
index 69be2aa..d21ba76 100644
--- a/pkcs.if
+++ b/pkcs.if
@@ -26,10 +26,7 @@ interface(`pkcs_admin_slotd',`
allow $1 pkcs_slotd_t:process { ptrace signal_perms };
ps_process_pattern($1, pkcs_slotd_t)

- init_labeled_script_domtrans($1, pkcs_slotd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pkcs_slotd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pkcs_slotd_t, pkcs_slotd_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, pkcs_slotd_var_lib_t)
diff --git a/polipo.if b/polipo.if
index ae27bb7..b523ccc 100644
--- a/polipo.if
+++ b/polipo.if
@@ -125,10 +125,7 @@ interface(`polipo_admin',`
allow $1 polipo_system_t:process { ptrace signal_perms };
ps_process_pattern($1, polipo_system_t)

- polipo_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 polipo_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, polipo_t, polipo_initrc_exec_t)

files_search_var($1)
admin_pattern($1, polipo_cache_t)
diff --git a/portmap.if b/portmap.if
index 9f982b5..ee8cd17 100644
--- a/portmap.if
+++ b/portmap.if
@@ -114,10 +114,7 @@ interface(`portmap_admin',`
allow $1 { portmap_t portmap_helper_t }:process { ptrace signal_perms };
ps_process_pattern($1, { portmap_t portmap_helper_t })

- init_labeled_script_domtrans($1, portmap_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 portmap_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, portmap_t, portmap_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, portmap_var_run_t)
diff --git a/portreserve.if b/portreserve.if
index 5ad5291..0401fd2 100644
--- a/portreserve.if
+++ b/portreserve.if
@@ -108,10 +108,7 @@ interface(`portreserve_admin',`
allow $1 portreserve_t:process { ptrace signal_perms };
ps_process_pattern($1, portreserve_t)

- portreserve_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 portreserve_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, portreserve_t, portreserve_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, portreserve_etc_t)
diff --git a/postfix.if b/postfix.if
index ded95ec..d54fa51 100644
--- a/postfix.if
+++ b/postfix.if
@@ -720,10 +720,7 @@ interface(`postfix_admin',`
allow $1 postfix_domain:process { ptrace signal_perms };
ps_process_pattern($1, postfix_domain)

- init_labeled_script_domtrans($1, postfix_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 postfix_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, postfix_t, postfix_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, { postfix_prng_t postfix_etc_t postfix_exec_t postfix_keytab_t })
diff --git a/postfixpolicyd.if b/postfixpolicyd.if
index 5de8173..3d925b7 100644
--- a/postfixpolicyd.if
+++ b/postfixpolicyd.if
@@ -26,10 +26,7 @@ interface(`postfixpolicyd_admin',`
allow $1 postfix_policyd_t:process { ptrace signal_perms };
ps_process_pattern($1, postfix_policyd_t)

- init_labeled_script_domtrans($1, postfix_policyd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 postfix_policyd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, postfix_policyd_t, postfix_policyd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, postfix_policyd_conf_t)
diff --git a/postgrey.if b/postgrey.if
index b9e71b5..50b620d 100644
--- a/postgrey.if
+++ b/postgrey.if
@@ -67,10 +67,7 @@ interface(`postgrey_admin',`
allow $1 postgrey_t:process { ptrace signal_perms };
ps_process_pattern($1, postgrey_t)

- init_labeled_script_domtrans($1, postgrey_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 postgrey_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, postgrey_t, postgrey_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, postgrey_etc_t)
diff --git a/ppp.if b/ppp.if
index cd8b8b9..52c2acf 100644
--- a/ppp.if
+++ b/ppp.if
@@ -487,10 +487,7 @@ interface(`ppp_admin',`
allow $1 { pptp_t pppd_t }:process { ptrace signal_perms };
ps_process_pattern($1, { pptp_t pppd_t })

- ppp_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 pppd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pppd_t, pppd_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, pppd_tmp_t)
diff --git a/prelude.if b/prelude.if
index db8f510..406d8ac 100644
--- a/prelude.if
+++ b/prelude.if
@@ -126,10 +126,7 @@ interface(`prelude_admin',`
allow $1 { prelude_t prelude_audisp_t prelude_lml_t prelude_correlator_t }:process { ptrace signal_perms };
ps_process_pattern($1, { prelude_t prelude_audisp_t prelude_lml_t prelude_correlator_t })

- init_labeled_script_domtrans($1, prelude_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 prelude_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, prelude_t, prelude_initrc_exec_t)

files_search_spool($1)
admin_pattern($1, prelude_spool_t)
diff --git a/privoxy.if b/privoxy.if
index bdcee30..30a6e1f 100644
--- a/privoxy.if
+++ b/privoxy.if
@@ -26,10 +26,7 @@ interface(`privoxy_admin',`
allow $1 privoxy_t:process { ptrace signal_perms };
ps_process_pattern($1, privoxy_t)

- init_labeled_script_domtrans($1, privoxy_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 privoxy_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, privoxy_t, privoxy_initrc_exec_t)

logging_list_logs($1)
admin_pattern($1, privoxy_log_t)
diff --git a/psad.if b/psad.if
index cdc83d2..645dca6 100644
--- a/psad.if
+++ b/psad.if
@@ -242,10 +242,7 @@ interface(`psad_admin',`
allow $1 psad_t:process { ptrace signal_perms };
ps_process_pattern($1, psad_t)

- init_labeled_script_domtrans($1, psad_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 psad_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, psad_t, psad_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, psad_etc_t)
diff --git a/puppet.if b/puppet.if
index 7cb8b1f..79ef096 100644
--- a/puppet.if
+++ b/puppet.if
@@ -211,10 +211,8 @@ interface(`puppet_admin',`
allow $1 { puppet_t puppetca_t puppetmaster_t }:process { ptrace signal_perms };
ps_process_pattern($1, { puppet_t puppetca_t puppetmaster_t })

- init_labeled_script_domtrans($1, { puppet_initrc_exec_t puppetmaster_initrc_exec_t })
- domain_system_change_exemption($1)
- role_transition $2 { puppet_initrc_exec_t puppetmaster_initrc_exec_t } system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, puppet_t, puppet_initrc_exec_t)
+ init_manage_service_template($1, $2, puppetmaster_t, puppetmaster_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, puppet_etc_t)
diff --git a/pxe.if b/pxe.if
index 7da286f..7924c86 100644
--- a/pxe.if
+++ b/pxe.if
@@ -26,10 +26,7 @@ interface(`pxe_admin',`
allow $1 pxe_t:process { ptrace signal_perms };
ps_process_pattern($1, pxe_t)

- init_labeled_script_domtrans($1, pxe_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pxe_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pxe_t, pxe_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, pxe_log_t)
diff --git a/pyicqt.if b/pyicqt.if
index 0ccea82..89fcf94 100644
--- a/pyicqt.if
+++ b/pyicqt.if
@@ -26,10 +26,7 @@ interface(`pyicqt_admin',`
allow $1 pyicqt_t:process { ptrace signal_perms };
ps_process_pattern($1, pyicqt_t)

- init_labeled_script_domtrans($1, pyicqt_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pyicqt_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pyicqt_t, pyicqt_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, pyicqt_conf_t)
diff --git a/pyzor.if b/pyzor.if
index c05a504..127cfb8 100644
--- a/pyzor.if
+++ b/pyzor.if
@@ -118,10 +118,7 @@ interface(`pyzor_admin',`
allow $1 pyzord_t:process { ptrace signal_perms };
ps_process_pattern($1, pyzord_t)

- init_labeled_script_domtrans($1, pyzord_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 pyzord_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, pyzord_t, pyzord_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, pyzor_etc_t)
diff --git a/qpid.if b/qpid.if
index fe2adf8..457b143 100644
--- a/qpid.if
+++ b/qpid.if
@@ -177,10 +177,7 @@ interface(`qpidd_admin',`
allow $1 qpidd_t:process { ptrace signal_perms };
ps_process_pattern($1, qpidd_t)

- qpidd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 qpidd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, qpidd_t, qpidd_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, qpidd_var_lib_t)
diff --git a/quantum.if b/quantum.if
index afc0068..b158c7e 100644
--- a/quantum.if
+++ b/quantum.if
@@ -26,10 +26,7 @@ interface(`quantum_admin',`
allow $1 quantum_t:process { ptrace signal_perms };
ps_process_pattern($1, quantum_t)

- init_labeled_script_domtrans($1, quantum_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 quantum_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, quantum_t, quantum_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, quantum_log_t)
diff --git a/quota.if b/quota.if
index 68611e3..3fbb18e 100644
--- a/quota.if
+++ b/quota.if
@@ -184,10 +184,7 @@ interface(`quota_admin',`
allow $1 { quota_nld_t quota_t }:process { ptrace signal_perms };
ps_process_pattern($1, { quota_nld_t quota_t })

- init_labeled_script_domtrans($1, quota_nld_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 quota_nld_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, quota_nld_t, quota_nld_initrc_exec_t)

files_list_all($1)
admin_pattern($1, { quota_db_t quota_flag_t quota_nld_var_run_t })
diff --git a/rabbitmq.if b/rabbitmq.if
index 2c3d338..71f30bb 100644
--- a/rabbitmq.if
+++ b/rabbitmq.if
@@ -45,10 +45,7 @@ interface(`rabbitmq_admin',`
allow $1 { rabbitmq_epmd_t rabbitmq_beam_t }:process { ptrace signal_perms };
ps_process_pattern($1, { rabbitmq_epmd_t rabbitmq_beam_t })

- init_labeled_script_domtrans($1, rabbitmq_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 rabbitmq_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, { rabbitmq_epmd_t rabbitmq_beam_t }, rabbitmq_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, rabbitmq_var_log_t)
diff --git a/radius.if b/radius.if
index 4460582..b0a7db0 100644
--- a/radius.if
+++ b/radius.if
@@ -41,10 +41,7 @@ interface(`radius_admin',`
allow $1 radiusd_t:process { ptrace signal_perms };
ps_process_pattern($1, radiusd_t)

- init_labeled_script_domtrans($1, radiusd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 radiusd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, radiusd_t, radiusd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { radiusd_etc_t radiusd_etc_rw_t })
diff --git a/radvd.if b/radvd.if
index ac7058d..a9a77f5 100644
--- a/radvd.if
+++ b/radvd.if
@@ -26,10 +26,7 @@ interface(`radvd_admin',`
allow $1 radvd_t:process { ptrace signal_perms };
ps_process_pattern($1, radvd_t)

- init_labeled_script_domtrans($1, radvd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 radvd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, radvd_t, radvd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, radvd_etc_t)
diff --git a/raid.if b/raid.if
index 951db7f..60198cf 100644
--- a/raid.if
+++ b/raid.if
@@ -91,10 +91,7 @@ interface(`raid_admin_mdadm',`
allow $1 mdadm_t:process { ptrace signal_perms };
ps_process_pattern($1, mdadm_t)

- init_labeled_script_domtrans($1, mdadm_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 mdadm_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, mdadm_t, mdadm_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, mdadm_var_run_t)
diff --git a/redis.if b/redis.if
index 3969450..0c0d62d 100644
--- a/redis.if
+++ b/redis.if
@@ -26,10 +26,7 @@ interface(`redis_admin',`
allow $1 redis_t:process { ptrace signal_perms };
ps_process_pattern($1, redis_t)

- init_labeled_script_domtrans($1, redis_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 redis_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, redis_t, redis_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, redis_log_t)
diff --git a/resmgr.if b/resmgr.if
index 0d93db6..30312f5 100644
--- a/resmgr.if
+++ b/resmgr.if
@@ -46,10 +46,7 @@ interface(`resmgr_admin',`
allow $1 resmgrd_t:process { ptrace signal_perms };
ps_process_pattern($1, resmgrd_t)

- init_labeled_script_domtrans($1, resmgrd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 resmgrd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, resmgrd_t, resmgrd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, resmgrd_etc_t)
diff --git a/rgmanager.if b/rgmanager.if
index 1c2f9aa..a1be103 100644
--- a/rgmanager.if
+++ b/rgmanager.if
@@ -105,10 +105,7 @@ interface(`rgmanager_admin',`
allow $1 rgmanager_t:process { ptrace signal_perms };
ps_process_pattern($1, rgmanager_t)

- init_labeled_script_domtrans($1, rgmanager_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 rgmanager_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, rgmanager_t, rgmanager_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, rgmanager_tmp_t)
diff --git a/rhcs.if b/rhcs.if
index c8bdea2..fa4c5d9 100644
--- a/rhcs.if
+++ b/rhcs.if
@@ -467,15 +467,14 @@ interface(`rhcs_admin',`
attribute cluster_log;
type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t;
type fenced_tmp_t, qdiskd_var_lib_t;
+ type dlm_controld_t, foghorn_t;
')

allow $1 cluster_domain:process { ptrace signal_perms };
ps_process_pattern($1, cluster_domain)

- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t })
- domain_system_change_exemption($1)
- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, dlm_controld_t, dlm_controld_initrc_exec_t)
+ init_manage_service_template($1, $2, foghorn_t, foghorn_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, cluster_pid)
diff --git a/rhsmcertd.if b/rhsmcertd.if
index 6dbc905..019f668 100644
--- a/rhsmcertd.if
+++ b/rhsmcertd.if
@@ -285,10 +285,7 @@ interface(`rhsmcertd_admin',`
allow $1 rhsmcertd_t:process { ptrace signal_perms };
ps_process_pattern($1, rhsmcertd_t)

- rhsmcertd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 rhsmcertd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, rhsmcertd_t, rhsmcertd_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, rhsmcertd_log_t)
diff --git a/ricci.if b/ricci.if
index 2ab3ed1..05015c8 100644
--- a/ricci.if
+++ b/ricci.if
@@ -203,10 +203,7 @@ interface(`ricci_admin',`
allow $1 ricci_t:process { ptrace signal_perms };
ps_process_pattern($1, ricci_t)

- init_labeled_script_domtrans($1, ricci_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ricci_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ricci_t, ricci_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, ricci_tmp_t)
diff --git a/rngd.if b/rngd.if
index 13f788f..51397eb 100644
--- a/rngd.if
+++ b/rngd.if
@@ -25,10 +25,7 @@ interface(`rngd_admin',`
allow $1 rngd_t:process { ptrace signal_perms };
ps_process_pattern($1, rngd_t)

- init_labeled_script_domtrans($1, rngd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 rngd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, rngd_t, rngd_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, rngd_var_run_t)
diff --git a/roundup.if b/roundup.if
index 975bb6a..0a351b5 100644
--- a/roundup.if
+++ b/roundup.if
@@ -26,10 +26,7 @@ interface(`roundup_admin',`
allow $1 roundup_t:process { ptrace signal_perms };
ps_process_pattern($1, roundup_t)

- init_labeled_script_domtrans($1, roundup_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 roundup_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, roundup_t, roundup_initrc_exec_t)

files_list_var_lib($1)
admin_pattern($1, roundup_var_lib_t)
diff --git a/rpc.if b/rpc.if
index 0bf13c2..70c986a 100644
--- a/rpc.if
+++ b/rpc.if
@@ -391,15 +391,14 @@ interface(`rpc_admin',`
type nfsd_initrc_exec_t, rpcd_initrc_exec_t, exports_t;
type var_lib_nfs_t, rpcd_var_run_t, gssd_tmp_t;
type nfsd_ro_t, nfsd_rw_t, gssd_keytab_t;
+ type nfsd_t, rpcd_t;
')

allow $1 rpc_domain:process { ptrace signal_perms };
ps_process_pattern($1, rpc_domain)

- init_labeled_script_domtrans($1, { nfsd_initrc_exec_t rpcd_initrc_exec_t })
- domain_system_change_exemption($1)
- role_transition $2 { nfsd_initrc_exec_t rpcd_initrc_exec_t } system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, nfsd_t, nfsd_initrc_exec_t)
+ init_manage_service_template($1, $2, rpcd_t, rpcd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { gssd_keytab_t exports_t })
diff --git a/rpcbind.if b/rpcbind.if
index f78fef0..da34256 100644
--- a/rpcbind.if
+++ b/rpcbind.if
@@ -160,10 +160,7 @@ interface(`rpcbind_admin',`
allow $1 rpcbind_t:process { ptrace signal_perms };
ps_process_pattern($1, rpcbind_t)

- init_labeled_script_domtrans($1, rpcbind_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 rpcbind_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, rpcbind_t, rpcbind_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, rpcbind_var_run_t)
diff --git a/rpm.if b/rpm.if
index fc9c8d8..554536f 100644
--- a/rpm.if
+++ b/rpm.if
@@ -634,10 +634,7 @@ interface(`rpm_admin',`
allow $1 { rpm_t rpm_script_t }:process { ptrace signal_perms };
ps_process_pattern($1, { rpm_t rpm_script_t })

- init_labeled_script_domtrans($1, rpm_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 rpm_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, rpm_t, rpm_initrc_exec_t)

admin_pattern($1, rpm_file_t)

diff --git a/rtkit.if b/rtkit.if
index e904ec4..39e82ad 100644
--- a/rtkit.if
+++ b/rtkit.if
@@ -90,8 +90,5 @@ interface(`rtkit_admin',`
allow $1 rtkit_daemon_t:process { ptrace signal_perms };
ps_process_pattern($1, rtkit_daemon_t)

- init_labeled_script_domtrans($1, rtkit_daemon_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 rtkit_daemon_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, rtkit_daemon_t, rtkit_daemon_initrc_exec_t)
')
diff --git a/rwho.if b/rwho.if
index 0360ff0..b07754b 100644
--- a/rwho.if
+++ b/rwho.if
@@ -142,10 +142,7 @@ interface(`rwho_admin',`
allow $1 rwho_t:process { ptrace signal_perms };
ps_process_pattern($1, rwho_t)

- init_labeled_script_domtrans($1, rwho_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 rwho_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, rwho_t, rwho_initrc_exec_t)

logging_list_logs($1)
admin_pattern($1, rwho_log_t)
diff --git a/samba.if b/samba.if
index 50d07fb..a9b0c3a 100644
--- a/samba.if
+++ b/samba.if
@@ -695,10 +695,7 @@ interface(`samba_admin',`
allow $1 { nmbd_t smbd_t }:process { ptrace signal_perms };
ps_process_pattern($1, { nmbd_t smbd_t })

- init_labeled_script_domtrans($1, samba_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 samba_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, samba_t, samba_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, { samba_etc_t smbd_keytab_t })
diff --git a/samhain.if b/samhain.if
index b1ebcee..053e454 100644
--- a/samhain.if
+++ b/samhain.if
@@ -221,10 +221,7 @@ interface(`samhain_admin',`
ps_process_pattern($1, samhain_domain)

# duplicate role transition: remove samhain_admin(sysadm_t, sysadm_r) first
- # init_labeled_script_domtrans($1, samhain_initrc_exec_t)
- # domain_system_change_exemption($1)
- # role_transition $2 samhain_initrc_exec_t system_r;
- # allow $2 system_r;
+ # init_manage_service_template($1, $2, samhain_domain, samhain_initrc_exec_t)

files_list_var_lib($1)
admin_pattern($1, samhain_db_t)
diff --git a/sanlock.if b/sanlock.if
index cd6c213..2c4feed 100644
--- a/sanlock.if
+++ b/sanlock.if
@@ -104,10 +104,7 @@ interface(`sanlock_admin',`
allow $1 sanlock_t:process { ptrace signal_perms };
ps_process_pattern($1, sanlock_t)

- sanlock_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 sanlock_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, sanlock_t, sanlock_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, sanlock_var_run_t)
diff --git a/sasl.if b/sasl.if
index 8c3c151..3bbf29b 100644
--- a/sasl.if
+++ b/sasl.if
@@ -45,10 +45,7 @@ interface(`sasl_admin',`
allow $1 saslauthd_t:process { ptrace signal_perms };
ps_process_pattern($1, saslauthd_t)

- init_labeled_script_domtrans($1, saslauthd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 saslauthd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, saslauthd_t, saslauthd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, saslauthd_keytab_t)
diff --git a/sblim.if b/sblim.if
index 98c9e0a..f3c6717 100644
--- a/sblim.if
+++ b/sblim.if
@@ -64,10 +64,7 @@ interface(`sblim_admin',`
allow $1 sblim_domain:process { ptrace signal_perms };
ps_process_pattern($1, sblim_domain)

- init_labeled_script_domtrans($1, sblim_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 sblim_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, sblim_domain, sblim_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, sblim_var_run_t)
diff --git a/sendmail.if b/sendmail.if
index 35ad2a7..761fd1c 100644
--- a/sendmail.if
+++ b/sendmail.if
@@ -360,9 +360,7 @@ interface(`sendmail_admin',`
allow $1 { unconfined_sendmail_t sendmail_t }:process { ptrace signal_perms };
ps_process_pattern($1, { unconfined_sendmail_t sendmail_t })

- init_labeled_script_domtrans($1, sendmail_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 sendmail_initrc_exec_t system_r;
+ init_manage_service_template($1, $2, sendmail_t, sendmail_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, sendmail_keytab_t)
diff --git a/sensord.if b/sensord.if
index d204752..a1d174b 100644
--- a/sensord.if
+++ b/sensord.if
@@ -25,10 +25,7 @@ interface(`sensord_admin',`
allow $1 sensord_t:process { ptrace signal_perms };
ps_process_pattern($1, sensord_t)

- init_labeled_script_domtrans($1, sensord_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 sensord_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, sensord_t, sensord_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, sensord_var_run_t)
diff --git a/shorewall.if b/shorewall.if
index 1aeef8a..5eaff00 100644
--- a/shorewall.if
+++ b/shorewall.if
@@ -179,10 +179,7 @@ interface(`shorewall_admin',`
allow $1 shorewall_t:process { ptrace signal_perms };
ps_process_pattern($1, shorewall_t)

- init_labeled_script_domtrans($1, shorewall_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 shorewall_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, shorewall_t, shorewall_initrc_exec_t)

can_exec($1, shorewall_exec_t)

diff --git a/slpd.if b/slpd.if
index ca32e89..25b1386 100644
--- a/slpd.if
+++ b/slpd.if
@@ -26,10 +26,7 @@ interface(`slpd_admin',`
allow $1 slpd_t:process { ptrace signal_perms };
ps_process_pattern($1, slpd_t)

- init_labeled_script_domtrans($1, slpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 slpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, slpd_t, slpd_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, slpd_log_t)
diff --git a/smartmon.if b/smartmon.if
index e0644b5..1b80197 100644
--- a/smartmon.if
+++ b/smartmon.if
@@ -45,10 +45,7 @@ interface(`smartmon_admin',`
allow $1 fsdaemon_t:process { ptrace signal_perms };
ps_process_pattern($1, fsdaemon_t)

- init_labeled_script_domtrans($1, fsdaemon_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 fsdaemon_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, fsdaemon_t, fsdaemon_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, fsdaemon_tmp_t)
diff --git a/smokeping.if b/smokeping.if
index 1fa51c1..fe1459e 100644
--- a/smokeping.if
+++ b/smokeping.if
@@ -161,10 +161,7 @@ interface(`smokeping_admin',`
allow $1 smokeping_t:process { ptrace signal_perms };
ps_process_pattern($1, smokeping_t)

- smokeping_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 smokeping_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, smokeping_t, smokeping_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, smokeping_var_lib_t)
diff --git a/smstools.if b/smstools.if
index 81136f0..7253219 100644
--- a/smstools.if
+++ b/smstools.if
@@ -27,10 +27,7 @@ interface(`smstools_admin',`
allow $1 smsd_t:process { ptrace signal_perms };
ps_process_pattern($1, smsd_t)

- init_labeled_script_domtrans($1, smsd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 smsd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, smsd_t, smsd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, smsd_conf_t)
diff --git a/snmp.if b/snmp.if
index 7a9cc9d..867fbb8 100644
--- a/snmp.if
+++ b/snmp.if
@@ -182,10 +182,7 @@ interface(`snmp_admin',`
allow $1 snmpd_t:process { ptrace signal_perms };
ps_process_pattern($1, snmpd_t)

- init_labeled_script_domtrans($1, snmpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 snmpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, snmpd_t, snmpd_initrc_exec_t)

logging_list_logs($1)
admin_pattern($1, snmpd_log_t)
diff --git a/snort.if b/snort.if
index 7d86b34..3ac3e94 100644
--- a/snort.if
+++ b/snort.if
@@ -45,10 +45,7 @@ interface(`snort_admin',`
allow $1 snort_t:process { ptrace signal_perms };
ps_process_pattern($1, snort_t)

- init_labeled_script_domtrans($1, snort_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 snort_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, snort_t, snort_initrc_exec_t)

admin_pattern($1, snort_etc_t)
files_search_etc($1)
diff --git a/soundserver.if b/soundserver.if
index a5abc5a..622083e 100644
--- a/soundserver.if
+++ b/soundserver.if
@@ -41,10 +41,7 @@ interface(`soundserver_admin',`
allow $1 soundd_t:process { ptrace signal_perms };
ps_process_pattern($1, soundd_t)

- init_labeled_script_domtrans($1, soundd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 soundd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, soundd_t, soundd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, soundd_etc_t)
diff --git a/spamassassin.if b/spamassassin.if
index 7f5a1cc..9505db9 100644
--- a/spamassassin.if
+++ b/spamassassin.if
@@ -384,10 +384,7 @@ interface(`spamassassin_admin',`
allow $1 spamd_t:process { ptrace signal_perms };
ps_process_pattern($1, spamd_t)

- init_labeled_script_domtrans($1, spamd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 spamd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, spamd_t, spamd_initrc_exec_t)

files_list_tmp($1)
admin_pattern($1, spamd_tmp_t)
diff --git a/squid.if b/squid.if
index 5e1f053..22a9cf4 100644
--- a/squid.if
+++ b/squid.if
@@ -216,10 +216,7 @@ interface(`squid_admin',`
allow $1 squid_t:process { ptrace signal_perms };
ps_process_pattern($1, squid_t)

- init_labeled_script_domtrans($1, squid_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 squid_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, squid_t, squid_initrc_exec_t)

files_list_var($1)
admin_pattern($1, squid_cache_t)
diff --git a/sssd.if b/sssd.if
index a240455..33a8245 100644
--- a/sssd.if
+++ b/sssd.if
@@ -342,10 +342,7 @@ interface(`sssd_admin',`
allow $1 sssd_t:process { ptrace signal_perms };
ps_process_pattern($1, sssd_t)

- sssd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 sssd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, sssd_t, sssd_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, sssd_conf_t)
diff --git a/svnserve.if b/svnserve.if
index 5cd46e9..c1deaa4 100644
--- a/svnserve.if
+++ b/svnserve.if
@@ -25,10 +25,7 @@ interface(`svnserve_admin',`
allow $1 svnserve_t:process { ptrace signal_perms };
ps_process_pattern($1, svnserve_t)

- init_labeled_script_domtrans($1, svnserve_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 svnserve_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, svnserve_t, svnserve_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, svnserve_var_run_t)
diff --git a/sysstat.if b/sysstat.if
index 14ae3f2..ab84adf 100644
--- a/sysstat.if
+++ b/sysstat.if
@@ -46,10 +46,7 @@ interface(`sysstat_admin',`
allow $1 sysstat_t:process { ptrace signal_perms };
ps_process_pattern($1, sysstat_t)

- init_labeled_script_domtrans($1, sysstat_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 sysstat_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, sysstat_t, sysstat_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, sysstat_log_t)
diff --git a/systemtap.if b/systemtap.if
index d60a21e..417ab39 100644
--- a/systemtap.if
+++ b/systemtap.if
@@ -26,10 +26,7 @@ interface(`stapserver_admin',`
allow $1 stapserver_t:process { ptrace signal_perms };
ps_process_pattern($1, stapserver_t)

- init_labeled_script_domtrans($1, stapserver_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 stapserver_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, stapserver_t, stapserver_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, stapserver_conf_t)
diff --git a/tcsd.if b/tcsd.if
index b42ec1d..bbcfe28 100644
--- a/tcsd.if
+++ b/tcsd.if
@@ -141,10 +141,7 @@ interface(`tcsd_admin',`
allow $1 tcsd_t:process { ptrace signal_perms };
ps_process_pattern($1, tcsd_t)

- tcsd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 tcsd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, tcsd_t, tcsd_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, tcsd_var_lib_t)
diff --git a/tgtd.if b/tgtd.if
index dc5b46e..348ba3c 100644
--- a/tgtd.if
+++ b/tgtd.if
@@ -83,10 +83,7 @@ interface(`tgtd_admin',`
allow $1 tgtd_t:process { ptrace signal_perms };
ps_process_pattern($1, tgtd_t)

- init_labeled_script_domtrans($1, tgtd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 tgtd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, tgtd_t, tgtd_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, tgtd_var_lib_t)
diff --git a/tor.if b/tor.if
index 61c2e07..0e937e3 100644
--- a/tor.if
+++ b/tor.if
@@ -45,10 +45,7 @@ interface(`tor_admin',`
allow $1 tor_t:process { ptrace signal_perms };
ps_process_pattern($1, tor_t)

- init_labeled_script_domtrans($1, tor_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 tor_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, tor_t, tor_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, tor_etc_t)
diff --git a/transproxy.if b/transproxy.if
index 81a8351..da66c3e 100644
--- a/transproxy.if
+++ b/transproxy.if
@@ -25,10 +25,7 @@ interface(`transproxy_admin',`
allow $1 transproxy_t:process { ptrace signal_perms };
ps_process_pattern($1, transproxy_t)

- init_labeled_script_domtrans($1, transproxy_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 transproxy_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, transproxy_t, transproxy_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, transproxy_var_run_t)
diff --git a/tuned.if b/tuned.if
index e29db63..8bff06c 100644
--- a/tuned.if
+++ b/tuned.if
@@ -122,10 +122,7 @@ interface(`tuned_admin',`
allow $1 tuned_t:process { ptrace signal_perms };
ps_process_pattern($1, tuned_t)

- tuned_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 tuned_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, tuned_t, tuned_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, { tuned_etc_t tuned_rw_etc_t })
diff --git a/ulogd.if b/ulogd.if
index 9b95c3e..66f375b 100644
--- a/ulogd.if
+++ b/ulogd.if
@@ -126,10 +126,7 @@ interface(`ulogd_admin',`
allow $1 ulogd_t:process { ptrace signal_perms };
ps_process_pattern($1, ulogd_t)

- init_labeled_script_domtrans($1, ulogd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 ulogd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, ulogd_t, ulogd_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, ulogd_etc_t)
diff --git a/uptime.if b/uptime.if
index 19f4724..b5afd2a 100644
--- a/uptime.if
+++ b/uptime.if
@@ -26,10 +26,7 @@ interface(`uptime_admin',`
allow $1 uptimed_t:process { ptrace signal_perms };
ps_process_pattern($1, uptimed_t)

- init_labeled_script_domtrans($1, uptimed_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 uptimed_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, uptimed_t, uptimed_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, uptimed_etc_t)
diff --git a/uucp.if b/uucp.if
index af9acc0..dc16612 100644
--- a/uucp.if
+++ b/uucp.if
@@ -104,10 +104,7 @@ interface(`uucp_admin',`
type uucpd_var_run_t, uucpd_initrc_exec_t;
')

- init_labeled_script_domtrans($1, uucpd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 uucpd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, uucpd_t, uucpd_initrc_exec_t)

allow $1 uucpd_t:process { ptrace signal_perms };
ps_process_pattern($1, uucpd_t)
diff --git a/uuidd.if b/uuidd.if
index 6e48653..a576a6e 100644
--- a/uuidd.if
+++ b/uuidd.if
@@ -181,10 +181,7 @@ interface(`uuidd_admin',`
allow $1 uuidd_t:process signal_perms;
ps_process_pattern($1, uuidd_t)

- uuidd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 uuidd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, uuidd_t, uuidd_initrc_exec_t)

files_search_var_lib($1)
admin_pattern($1, uuidd_var_lib_t)
diff --git a/varnishd.if b/varnishd.if
index 1c35171..fa2ccbf 100644
--- a/varnishd.if
+++ b/varnishd.if
@@ -160,10 +160,7 @@ interface(`varnishd_admin_varnishlog',`
allow $1 varnishlog_t:process { ptrace signal_perms };
ps_process_pattern($1, varnishlog_t)

- init_labeled_script_domtrans($1, varnishlog_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 varnishlog_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, varnishlog_t, varnishlog_initrc_exec_t)

files_list_pids($1)
admin_pattern($1, varnishlog_var_run_t)
@@ -199,10 +196,7 @@ interface(`varnishd_admin',`
allow $1 varnishd_t:process { ptrace signal_perms };
ps_process_pattern($1, varnishd_t)

- init_labeled_script_domtrans($1, varnishd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 varnishd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, varnishd_t, varnishd_initrc_exec_t)

files_list_var_lib($1)
admin_pattern($1, varnishd_var_lib_t)
diff --git a/vdagent.if b/vdagent.if
index 31c752e..6957e8a 100644
--- a/vdagent.if
+++ b/vdagent.if
@@ -121,10 +121,7 @@ interface(`vdagent_admin',`
allow $1 vdagent_t:process signal_perms;
ps_process_pattern($1, vdagent_t)

- init_labeled_script_domtrans($1, vdagentd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 vdagentd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, vdagentd_t, vdagentd_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, vdagent_log_t)
diff --git a/vhostmd.if b/vhostmd.if
index 22edd58..d7cff66 100644
--- a/vhostmd.if
+++ b/vhostmd.if
@@ -219,10 +219,7 @@ interface(`vhostmd_admin',`
allow $1 vhostmd_t:process { ptrace signal_perms };
ps_process_pattern($1, vhostmd_t)

- vhostmd_initrc_domtrans($1)
- domain_system_change_exemption($1)
- role_transition $2 vhostmd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, vhostmd_t, vhostmd_initrc_exec_t)

fs_search_tmpfs($1)
admin_pattern($1, vhostmd_tmpfs_t)
diff --git a/virt.if b/virt.if
index fd087b9..a606d9d 100644
--- a/virt.if
+++ b/virt.if
@@ -1171,10 +1171,7 @@ interface(`virt_admin',`
ps_process_pattern($1, { virt_domain svirt_lxc_domain virtd_t })
ps_process_pattern($1, { virtd_lxc_t virsh_t virt_bridgehelper_t virt_qmf_t })

- init_labeled_script_domtrans($1, virtd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 virtd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, virtd_t, virtd_initrc_exec_t)

fs_search_tmpfs($1)
admin_pattern($1, virt_tmpfs_type)
diff --git a/vnstatd.if b/vnstatd.if
index 137ac44..2a711fa 100644
--- a/vnstatd.if
+++ b/vnstatd.if
@@ -168,10 +168,7 @@ interface(`vnstatd_admin',`
allow $1 vnstatd_t:process { ptrace signal_perms };
ps_process_pattern($1, vnstatd_t)

- init_labeled_script_domtrans($1, vnstatd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 vnstatd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, vnstatd_t, vnstatd_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, vnstatd_var_run_t)
diff --git a/watchdog.if b/watchdog.if
index 6461a77..c2b2dd4 100644
--- a/watchdog.if
+++ b/watchdog.if
@@ -26,10 +26,7 @@ interface(`watchdog_admin',`
allow $1 watchdog_t:process { ptrace signal_perms };
ps_process_pattern($1, watchdog_t)

- init_labeled_script_domtrans($1, watchdog_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 watchdog_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, watchdog_t, watchdog_initrc_exec_t)

logging_search_logs($1)
admin_pattern($1, watchdog_log_t)
diff --git a/wdmd.if b/wdmd.if
index 1e3aec0..f76d6e6 100644
--- a/wdmd.if
+++ b/wdmd.if
@@ -45,10 +45,7 @@ interface(`wdmd_admin',`
allow $1 wdmd_t:process { ptrace signal_perms };
ps_process_pattern($1, wdmd_t)

- init_labeled_script_domtrans($1, wdmd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 wdmd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, wdmd_t, wdmd_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, wdmd_var_run_t)
diff --git a/xfs.if b/xfs.if
index 4570b86..609b464 100644
--- a/xfs.if
+++ b/xfs.if
@@ -84,10 +84,7 @@ interface(`xfs_admin',`
allow $1 xfs_t:process { ptrace signal_perms };
ps_process_pattern($1, xfs_t)

- init_labeled_script_domtrans($1, xfs_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 xfs_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, xfs_t, xfs_initrc_exec_t)

files_search_pids($1)
admin_pattern($1, xfs_var_run_t)
diff --git a/zabbix.if b/zabbix.if
index 29d87d7..5932ce4 100644
--- a/zabbix.if
+++ b/zabbix.if
@@ -146,10 +146,8 @@ interface(`zabbix_admin',`
allow $1 { zabbix_t zabbix_agent_t }:process { ptrace signal_perms };
ps_process_pattern($1, { zabbix_t zabbix_agent_t })

- init_labeled_script_domtrans($1, { zabbix_agent_initrc_exec_t zabbix_initrc_exec_t })
- domain_system_change_exemption($1)
- role_transition $2 { zabbix_agent_initrc_exec_t zabbix_initrc_exec_t } system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, zabbix_t, zabbix_initrc_exec_t)
+ init_manage_service_template($1, $2, zabbix_agent_t, zabbix_agent_initrc_exec_t)

logging_list_logs($1)
admin_pattern($1, zabbix_log_t)
diff --git a/zarafa.if b/zarafa.if
index 83b4ca5..240d160 100644
--- a/zarafa.if
+++ b/zarafa.if
@@ -152,10 +152,7 @@ interface(`zarafa_admin',`
allow $1 zarafa_domain:process { ptrace signal_perms };
ps_process_pattern($1, zarafa_domain)

- init_labeled_script_domtrans($1, zarafa_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 zarafa_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, zarafa_t, zarafa_initrc_exec_t)

files_search_etc($1)
admin_pattern($1, zarafa_etc_t)
diff --git a/zebra.if b/zebra.if
index 3416401..a011864 100644
--- a/zebra.if
+++ b/zebra.if
@@ -69,10 +69,7 @@ interface(`zebra_admin',`
allow $1 zebra_t:process { ptrace signal_perms };
ps_process_pattern($1, zebra_t)

- init_labeled_script_domtrans($1, zebra_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 zebra_initrc_exec_t system_r;
- allow $2 system_r;
+ init_manage_service_template($1, $2, zebra_t, zebra_initrc_exec_t)

files_list_etc($1)
admin_pattern($1, zebra_conf_t)
--
2.3.6