- add initrc filecontext
- deprecate domtrans/run interface in favor of new admin interface
v2:
- deprecate interfaces instead of dropping
---
fakehwclock.fc | 6 ++++--
fakehwclock.if | 34 ++++++++++++++++++++++++++++++++++
fakehwclock.te | 3 +++
3 files changed, 41 insertions(+), 2 deletions(-)
diff --git a/fakehwclock.fc b/fakehwclock.fc
index 0ab3bd8..85ea931 100644
--- a/fakehwclock.fc
+++ b/fakehwclock.fc
@@ -1,7 +1,9 @@
/etc/fake-hwclock\.data -- gen_context(system_u:object_r:fakehwclock_backup_t,s0)
-/usr/bin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
+/etc/rc\.d/init\.d/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
-/usr/sbin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
+/usr/bin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
/usr/lib/systemd/system/fake-hwclock\.service -- gen_context(system_u:object_r:fakehwclock_unit_t,s0)
+
+/usr/sbin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
diff --git a/fakehwclock.if b/fakehwclock.if
index 24cc7d1..3e5afb1 100644
--- a/fakehwclock.if
+++ b/fakehwclock.if
@@ -11,6 +11,8 @@
## </param>
#
interface(`fakehwclock_domtrans',`
+ refpolicywarn(`$0($*) has been deprecated')
+
gen_require(`
type fakehwclock_t, fakehwclock_exec_t;
')
@@ -37,6 +39,8 @@ interface(`fakehwclock_domtrans',`
## </param>
#
interface(`fakehwclock_run',`
+ refpolicywarn(`$0($*) has been deprecated')
+
gen_require(`
attribute_role fakehwclock_roles;
')
@@ -44,3 +48,33 @@ interface(`fakehwclock_run',`
fakehwclock_domtrans($1)
roleattribute $2 fakehwclock_roles;
')
+
+########################################
+## <summary>
+## All the rules required to
+## administrate an fake-hwclock environment.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+#
+interface(`fakehwclock_admin',`
+ gen_require(`
+ type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
+ type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
+ ')
+
+ admin_process_pattern($1, fakehwclock_t)
+
+ init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
+
+ files_search_etc($1)
+ admin_pattern($1, fakehwclock_backup_t)
+')
diff --git a/fakehwclock.te b/fakehwclock.te
index 0a896a3..20bc5a0 100644
--- a/fakehwclock.te
+++ b/fakehwclock.te
@@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
type fakehwclock_backup_t;
files_type(fakehwclock_backup_t)
+type fakehwclock_initrc_exec_t;
+init_script_file(fakehwclock_initrc_exec_t)
+
type fakehwclock_unit_t;
init_unit_file(fakehwclock_unit_t)
--
2.14.1
On 09/12/2017 05:54 AM, Christian G?ttsche via refpolicy wrote:
> - add initrc filecontext
> - deprecate domtrans/run interface in favor of new admin interface
>
> v2:
>
> - deprecate interfaces instead of dropping
> ---
> fakehwclock.fc | 6 ++++--
> fakehwclock.if | 34 ++++++++++++++++++++++++++++++++++
> fakehwclock.te | 3 +++
> 3 files changed, 41 insertions(+), 2 deletions(-)
>
> diff --git a/fakehwclock.fc b/fakehwclock.fc
> index 0ab3bd8..85ea931 100644
> --- a/fakehwclock.fc
> +++ b/fakehwclock.fc
> @@ -1,7 +1,9 @@
> /etc/fake-hwclock\.data -- gen_context(system_u:object_r:fakehwclock_backup_t,s0)
>
> -/usr/bin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
> +/etc/rc\.d/init\.d/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
>
> -/usr/sbin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
> +/usr/bin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
>
> /usr/lib/systemd/system/fake-hwclock\.service -- gen_context(system_u:object_r:fakehwclock_unit_t,s0)
> +
> +/usr/sbin/fake-hwclock -- gen_context(system_u:object_r:fakehwclock_exec_t,s0)
> diff --git a/fakehwclock.if b/fakehwclock.if
> index 24cc7d1..3e5afb1 100644
> --- a/fakehwclock.if
> +++ b/fakehwclock.if
> @@ -11,6 +11,8 @@
> ## </param>
> #
> interface(`fakehwclock_domtrans',`
> + refpolicywarn(`$0($*) has been deprecated')
> +
> gen_require(`
> type fakehwclock_t, fakehwclock_exec_t;
> ')
> @@ -37,6 +39,8 @@ interface(`fakehwclock_domtrans',`
> ## </param>
> #
> interface(`fakehwclock_run',`
> + refpolicywarn(`$0($*) has been deprecated')
> +
> gen_require(`
> attribute_role fakehwclock_roles;
> ')
> @@ -44,3 +48,33 @@ interface(`fakehwclock_run',`
> fakehwclock_domtrans($1)
> roleattribute $2 fakehwclock_roles;
> ')
> +
> +########################################
> +## <summary>
> +## All the rules required to
> +## administrate an fake-hwclock environment.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed to transition.
> +## </summary>
> +## </param>
> +## <param name="role">
> +## <summary>
> +## Role allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`fakehwclock_admin',`
> + gen_require(`
> + type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
> + type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
> + ')
> +
> + admin_process_pattern($1, fakehwclock_t)
> +
> + init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
> +
> + files_search_etc($1)
> + admin_pattern($1, fakehwclock_backup_t)
> +')
> diff --git a/fakehwclock.te b/fakehwclock.te
> index 0a896a3..20bc5a0 100644
> --- a/fakehwclock.te
> +++ b/fakehwclock.te
> @@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
> type fakehwclock_backup_t;
> files_type(fakehwclock_backup_t)
>
> +type fakehwclock_initrc_exec_t;
> +init_script_file(fakehwclock_initrc_exec_t)
> +
> type fakehwclock_unit_t;
> init_unit_file(fakehwclock_unit_t)
Merged.
--
Chris PeBenito