From: sven.vermeulen@siphos.be (Sven Vermeulen)
Date: Tue, 27 Sep 2011 18:35:04 +0200
Subject: [refpolicy] [PATCH 1/2] Asterisk admin must be able to run
 'asterisk -r'
In-Reply-To: <4E81C982.7000507@redhat.com>
References: <20110926195542.GA15513@siphos.be>
	<20110926195713.GB15513@siphos.be> <4E81C982.7000507@redhat.com>
Message-ID: <20110927163503.GA17946@siphos.be>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Tue, Sep 27, 2011 at 09:02:58AM -0400, Daniel J Walsh wrote:
> An asterisk admin should not be running the application in his his own
> context, he should be allowed to restart it in the asterisk_t domain
> which is why we have asterisk_initrc_exec_t. And are moving towards
> using asterisk_systemctl() for systemd controls.

Having stream_connect rights doesn't allow him to run the application in his
own domain. What this patch offers is to allow the asterisk admin to run
"asterisk -r" so he can get the CLI open. The CLI doesn't work if asterisk
isn't running, and restarting it doesn't refresh the process (so it remains
running in asterisk_t), it is more of a reload.

The use of "asterisk -r" is often done by asterisk admins. We've asked a few
of them to check if this is really necessary and they all agreed that having
"asterisk -r" possible is a major requirement for asterisk administration. 

The use of the init script is indeed still necessary for stop and start
operations as well as some general management activities, but administering
asterisk is more than just those operational activities.

Also, to reply to Dominick's suggestion to only have the
asterisk_stream_connect for the asterisk admin, that won't work since he
would still need can_exec rights on the asterisk_exec_t. Also, since he is
asterisk admin, he'll need asterisk_admin() anyhow.

Wkr,
	Sven Vermeulen