From: dominick.grift@gmail.com (grift)
Date: Sun, 09 Dec 2012 15:03:19 +0100
Subject: [refpolicy] [PATCH 10/11] Support stunnel_read_config for
 startup
In-Reply-To: <1355000222-7297-11-git-send-email-sven.vermeulen@siphos.be>
References: <1355000222-7297-1-git-send-email-sven.vermeulen@siphos.be>
	<1355000222-7297-11-git-send-email-sven.vermeulen@siphos.be>
Message-ID: <1355061799.1797.75.camel@localhost>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Sat, 2012-12-08 at 21:57 +0100, Sven Vermeulen wrote:
> When stunnel starts up, the init script reads in the configuration file to find
> the location of the PID file. As such, we need to provide initrc_t with read
> access to the stunnel configuration.

This was merged thanks

I made changes to it though to include listing of stunnel config dirs
and reading of stunnel config symlinks additionally for consistency

> Create a stunnel_read_config() interface for this purpose.
> 
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
>  stunnel.if |   19 +++++++++++++++++++
>  1 files changed, 19 insertions(+), 0 deletions(-)
> 
> diff --git a/stunnel.if b/stunnel.if
> index 47fea00..882db16 100644
> --- a/stunnel.if
> +++ b/stunnel.if
> @@ -23,3 +23,22 @@ interface(`stunnel_service_domain',`
>  	domtrans_pattern(stunnel_t, $2, $1)
>  	allow $1 stunnel_t:tcp_socket rw_socket_perms;
>  ')
> +
> +########################################
> +## <summary>
> +##	Read the stunnel configuration
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`stunnel_read_config',`
> +	gen_require(`
> +		type stunnel_etc_t;
> +	')
> +
> +	files_search_etc($1)
> +	read_files_pattern($1, stunnel_etc_t, stunnel_etc_t)
> +')