From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Sat, 8 Dec 2012 21:57:01 +0100 Subject: [refpolicy] [PATCH 10/11] Support stunnel_read_config for startup In-Reply-To: <1355000222-7297-1-git-send-email-sven.vermeulen@siphos.be> References: <1355000222-7297-1-git-send-email-sven.vermeulen@siphos.be> Message-ID: <1355000222-7297-11-git-send-email-sven.vermeulen@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com When stunnel starts up, the init script reads in the configuration file to find the location of the PID file. As such, we need to provide initrc_t with read access to the stunnel configuration. Create a stunnel_read_config() interface for this purpose. Signed-off-by: Sven Vermeulen --- stunnel.if | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-) diff --git a/stunnel.if b/stunnel.if index 47fea00..882db16 100644 --- a/stunnel.if +++ b/stunnel.if @@ -23,3 +23,22 @@ interface(`stunnel_service_domain',` domtrans_pattern(stunnel_t, $2, $1) allow $1 stunnel_t:tcp_socket rw_socket_perms; ') + +######################################## +## +## Read the stunnel configuration +## +## +## +## Domain allowed access. +## +## +# +interface(`stunnel_read_config',` + gen_require(` + type stunnel_etc_t; + ') + + files_search_etc($1) + read_files_pattern($1, stunnel_etc_t, stunnel_etc_t) +') -- 1.7.8.6