2017-09-10 15:33:20

by Christian Göttsche

Subject: [refpolicy] [PATCH] fakehwclock: update

- add initrc filecontext
- drop domtrans/run interface in favor of new admin interface
---
fakehwclock.fc | 2 ++
fakehwclock.if | 37 +++++++++++--------------------------
fakehwclock.te | 3 +++
3 files changed, 16 insertions(+), 26 deletions(-)

diff --git a/fakehwclock.fc b/fakehwclock.fc
index 0ab3bd8..459bd5c 100644
--- a/fakehwclock.fc
+++ b/fakehwclock.fc
@@ -1,5 +1,7 @@
/etc/fake-hwclock\.data -- gen_context(system_u:object_r:fakehwclock_backup_t,s0)

+/etc/rc\.d/init\.d/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
+
/usr/bin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)

/usr/sbin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
diff --git a/fakehwclock.if b/fakehwclock.if
index 24cc7d1..63afb52 100644
--- a/fakehwclock.if
+++ b/fakehwclock.if
@@ -2,28 +2,8 @@

########################################
## <summary>
-## Execute a domain transition to run fake-hwclock.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed to transition.
-## </summary>
-## </param>
-#
-interface(`fakehwclock_domtrans',`
- gen_require(`
- type fakehwclock_t, fakehwclock_exec_t;
- ')
-
- corecmd_search_bin($1)
- domtrans_pattern($1, fakehwclock_exec_t, fakehwclock_t)
-')
-
-########################################
-## <summary>
-## Execute fake-hwclock in the fake-hwclock domain,
-## and allow the specified role
-## the fake-hwclock domain.
+## All the rules required to
+## administrate an fake-hwclock environment.
## </summary>
## <param name="domain">
## <summary>
@@ -36,11 +16,16 @@ interface(`fakehwclock_domtrans',`
## </summary>
## </param>
#
-interface(`fakehwclock_run',`
+interface(`fakehwclock_admin',`
gen_require(`
- attribute_role fakehwclock_roles;
+ type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
+ type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
')

- fakehwclock_domtrans($1)
- roleattribute $2 fakehwclock_roles;
+ admin_process_pattern($1, fakehwclock_t)
+
+ init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
+
+ files_search_etc($1)
+ admin_pattern($1, fakehwclock_backup_t)
')
diff --git a/fakehwclock.te b/fakehwclock.te
index 0a896a3..20bc5a0 100644
--- a/fakehwclock.te
+++ b/fakehwclock.te
@@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
type fakehwclock_backup_t;
files_type(fakehwclock_backup_t)

+type fakehwclock_initrc_exec_t;
+init_script_file(fakehwclock_initrc_exec_t)
+
type fakehwclock_unit_t;
init_unit_file(fakehwclock_unit_t)

--
2.14.1

2017-09-11 23:26:26

by Chris PeBenito

Subject: [refpolicy] [PATCH] fakehwclock: update

On 09/10/2017 11:33 AM, Christian G?ttsche via refpolicy wrote:
> - add initrc filecontext
> - drop domtrans/run interface in favor of new admin interface
> ---
> fakehwclock.fc | 2 ++
> fakehwclock.if | 37 +++++++++++--------------------------
> fakehwclock.te | 3 +++
> 3 files changed, 16 insertions(+), 26 deletions(-)
>
> diff --git a/fakehwclock.fc b/fakehwclock.fc
> index 0ab3bd8..459bd5c 100644
> --- a/fakehwclock.fc
> +++ b/fakehwclock.fc
> @@ -1,5 +1,7 @@
> /etc/fake-hwclock\.data -- gen_context(system_u:object_r:fakehwclock_backup_t,s0)
>
> +/etc/rc\.d/init\.d/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
> +
> /usr/bin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
>
> /usr/sbin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)

No fc for the unit?


> diff --git a/fakehwclock.if b/fakehwclock.if
> index 24cc7d1..63afb52 100644
> --- a/fakehwclock.if
> +++ b/fakehwclock.if
> @@ -2,28 +2,8 @@
>
> ########################################
> ## <summary>
> -## Execute a domain transition to run fake-hwclock.
> -## </summary>
> -## <param name="domain">
> -## <summary>
> -## Domain allowed to transition.
> -## </summary>
> -## </param>
> -#
> -interface(`fakehwclock_domtrans',`

Do not delete interfaces, deprecate them.


> - gen_require(`
> - type fakehwclock_t, fakehwclock_exec_t;
> - ')
> -
> - corecmd_search_bin($1)
> - domtrans_pattern($1, fakehwclock_exec_t, fakehwclock_t)
> -')
> -
> -########################################
> -## <summary>
> -## Execute fake-hwclock in the fake-hwclock domain,
> -## and allow the specified role
> -## the fake-hwclock domain.
> +## All the rules required to
> +## administrate an fake-hwclock environment.
> ## </summary>
> ## <param name="domain">
> ## <summary>
> @@ -36,11 +16,16 @@ interface(`fakehwclock_domtrans',`
> ## </summary>
> ## </param>
> #
> -interface(`fakehwclock_run',`
> +interface(`fakehwclock_admin',`
> gen_require(`
> - attribute_role fakehwclock_roles;
> + type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
> + type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
> ')
>
> - fakehwclock_domtrans($1)
> - roleattribute $2 fakehwclock_roles;
> + admin_process_pattern($1, fakehwclock_t)
> +
> + init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
> +
> + files_search_etc($1)
> + admin_pattern($1, fakehwclock_backup_t)
> ')
> diff --git a/fakehwclock.te b/fakehwclock.te
> index 0a896a3..20bc5a0 100644
> --- a/fakehwclock.te
> +++ b/fakehwclock.te
> @@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
> type fakehwclock_backup_t;
> files_type(fakehwclock_backup_t)
>
> +type fakehwclock_initrc_exec_t;
> +init_script_file(fakehwclock_initrc_exec_t)
> +
> type fakehwclock_unit_t;
> init_unit_file(fakehwclock_unit_t)
>
>


--
Chris PeBenito