From: sven.vermeulen@siphos.be (Sven Vermeulen)
Date: Wed, 25 Jul 2012 12:58:37 +0200
Subject: [refpolicy] [PATCH 1/2] Introducing interfaces for /run
	transitioning
In-Reply-To: <1343213918-3539-1-git-send-email-sven.vermeulen@siphos.be>
References: <1343213918-3539-1-git-send-email-sven.vermeulen@siphos.be>
Message-ID: <1343213918-3539-2-git-send-email-sven.vermeulen@siphos.be>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

To allow the dbus init scripts to, when they create the /run/dbus directory,
automatically transition towards the system_dbusd_var_run_t label, we need to
introduce two interfaces: one for the transitioning itself, and one to allow the
init script to create directories of system_dbusd_var_run_t type.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 dbus.if |   47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 47 insertions(+), 0 deletions(-)

diff --git a/dbus.if b/dbus.if
index fb4bf82..b0322b5 100644
--- a/dbus.if
+++ b/dbus.if
@@ -485,6 +485,53 @@ interface(`dbus_dontaudit_system_bus_rw_tcp_sockets',`
 
 ########################################
 ## <summary>
+##	Automatically transition towards the system_dbus_var_run_t for resources
+##	created in the generic var_run_t locations.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Classes supported for the transitioning
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Optional file name used for the resources
+##	</summary>
+## </param>
+#
+interface(`dbus_generic_pid_filetrans_system_dbusd_run',`
+	gen_require(`
+		type system_dbusd_var_run_t;
+	')
+
+	files_pid_filetrans($1, system_dbusd_var_run_t, $2, $3)
+')
+
+##########################################
+## <summary>
+##	Create directories with the system_dbusd_var_run_t label
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`dbus_create_system_dbusd_run_dirs',`
+	gen_require(`
+		type system_dbusd_var_run_t;
+	')
+
+	create_dirs_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t)
+')
+
+########################################
+## <summary>
 ##	Allow unconfined access to the system DBUS.
 ## </summary>
 ## <param name="domain">
-- 
1.7.8.6