From: jason@perfinion.com (Jason Zaman) Date: Fri, 15 May 2015 22:12:55 +0400 Subject: [refpolicy] [PATCH v2 2/2] use init_manage_service_template in _admin interfaces N-Z In-Reply-To: <1431713575-7261-1-git-send-email-jason@perfinion.com> References: <1431713575-7261-1-git-send-email-jason@perfinion.com> Message-ID: <1431713575-7261-2-git-send-email-jason@perfinion.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Most foo_admin interfaces have transitions on the foo_initrc_exec_t to system_r. These are only applicable for RedHat <6. This replaces them with a template which can easily be changed for other init systems. make validate passes for all combinations of distros, standard/mcs/mls, monolithic y/n and direct_initrc y/n This patch is for files starting with N-Z. --- Changes from v1: * Does not pass two _initrc_exec_t files together with { }. That did not work with other interfaces that were called later. If a module has multiple domains and initrc files, the template is called multiple times for each set. * v1 got stuck in the spam filter because it was too big, this is split in two. --- nagios.if | 5 +---- nessus.if | 5 +---- networkmanager.if | 5 +---- nis.if | 7 ++----- nscd.if | 5 +---- nsd.if | 5 +---- nslcd.if | 5 +---- ntop.if | 5 +---- ntp.if | 5 +---- numad.if | 5 +---- nut.if | 5 +---- oident.if | 5 +---- openct.if | 5 +---- openhpi.if | 5 +---- openvpn.if | 5 +---- openvswitch.if | 5 +---- pacemaker.if | 5 +---- pads.if | 5 +---- pcscd.if | 5 +---- pegasus.if | 5 +---- perdition.if | 5 +---- pingd.if | 5 +---- pkcs.if | 5 +---- polipo.if | 5 +---- portmap.if | 5 +---- portreserve.if | 5 +---- postfix.if | 5 +---- postfixpolicyd.if | 5 +---- postgrey.if | 5 +---- ppp.if | 5 +---- prelude.if | 5 +---- privoxy.if | 5 +---- psad.if | 5 +---- puppet.if | 6 ++---- pxe.if | 5 +---- pyicqt.if | 5 +---- pyzor.if | 5 +---- qpid.if | 5 +---- quantum.if | 5 +---- quota.if | 5 +---- rabbitmq.if | 5 +---- radius.if | 5 +---- radvd.if | 5 +---- raid.if | 5 +---- redis.if | 5 +---- resmgr.if | 5 +---- rgmanager.if | 5 +---- rhcs.if | 7 +++---- rhsmcertd.if | 5 +---- ricci.if | 5 +---- rngd.if | 5 +---- roundup.if | 5 +---- rpc.if | 7 +++---- rpcbind.if | 5 +---- rpm.if | 5 +---- rtkit.if | 5 +---- rwho.if | 5 +---- samba.if | 5 +---- samhain.if | 5 +---- sanlock.if | 5 +---- sasl.if | 5 +---- sblim.if | 5 +---- sendmail.if | 4 +--- sensord.if | 5 +---- shorewall.if | 5 +---- slpd.if | 5 +---- smartmon.if | 5 +---- smokeping.if | 5 +---- smstools.if | 5 +---- snmp.if | 5 +---- snort.if | 5 +---- soundserver.if | 5 +---- spamassassin.if | 5 +---- squid.if | 5 +---- sssd.if | 5 +---- svnserve.if | 5 +---- sysstat.if | 5 +---- systemtap.if | 5 +---- tcsd.if | 5 +---- tgtd.if | 5 +---- tor.if | 5 +---- transproxy.if | 5 +---- tuned.if | 5 +---- ulogd.if | 5 +---- uptime.if | 5 +---- uucp.if | 5 +---- uuidd.if | 5 +---- varnishd.if | 10 ++-------- vdagent.if | 5 +---- vhostmd.if | 5 +---- virt.if | 5 +---- vnstatd.if | 5 +---- watchdog.if | 5 +---- wdmd.if | 5 +---- xfs.if | 5 +---- zabbix.if | 6 ++---- zarafa.if | 5 +---- zebra.if | 5 +---- 98 files changed, 106 insertions(+), 396 deletions(-) diff --git a/nagios.if b/nagios.if index 0641e97..93f07fd 100644 --- a/nagios.if +++ b/nagios.if @@ -204,10 +204,7 @@ interface(`nagios_admin',` allow $1 { nagios_t nrpe_t nagios_plugin_domain }:process { ptrace signal_perms }; ps_process_pattern($1, { nagios_t nrpe_t nagios_plugin_domain }) - init_labeled_script_domtrans($1, nagios_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 nagios_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, nagios_t, nagios_initrc_exec_t) files_search_tmp($1) admin_pattern($1, { nagios_eventhandler_plugin_tmp_t nagios_tmp_t nagios_system_plugin_tmp_t }) diff --git a/nessus.if b/nessus.if index 42e9ed4..b1defe3 100644 --- a/nessus.if +++ b/nessus.if @@ -40,10 +40,7 @@ interface(`nessus_admin',` allow $1 nessusd_t:process { ptrace signal_perms }; ps_process_pattern($1, nessusd_t) - init_labeled_script_domtrans($1, nessusd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 nessusd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, nessusd_t, nessusd_initrc_exec_t) logging_search_logs($1) admin_pattern($1, nessusd_log_t) diff --git a/networkmanager.if b/networkmanager.if index baebe99..e15f18f 100644 --- a/networkmanager.if +++ b/networkmanager.if @@ -297,10 +297,7 @@ interface(`networkmanager_admin',` allow $1 { wpa_cli_t NetworkManager_t }:process { ptrace signal_perms }; ps_process_pattern($1, { wpa_cli_t NetworkManager_t }) - init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 NetworkManager_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, NetworkManager_t, NetworkManager_initrc_exec_t) files_search_etc($1) admin_pattern($1, { NetworkManager_etc_t NetworkManager_etc_rw_t }) diff --git a/nis.if b/nis.if index 46e55c3..f7cb0a6 100644 --- a/nis.if +++ b/nis.if @@ -381,11 +381,8 @@ interface(`nis_admin',` allow $1 { ypbind_t yppasswdd_t ypserv_t ypxfr_t }:process { ptrace signal_perms }; ps_process_pattern($1, { ypbind_t yppasswdd_t ypserv_t ypxfr_t }) - nis_initrc_domtrans($1) - nis_initrc_domtrans_ypbind($1) - domain_system_change_exemption($1) - role_transition $2 { nis_initrc_exec_t ypbind_initrc_exec_t } system_r; - allow $2 system_r; + init_manage_service_template($1, $2, ypbind_t, ypbind_initrc_exec_t) + init_manage_service_template($1, $2, ypserv_t, nis_initrc_exec_t) files_list_tmp($1) admin_pattern($1, { ypserv_tmp_t ypbind_tmp_t }) diff --git a/nscd.if b/nscd.if index 8f2ab09..e92e2d0 100644 --- a/nscd.if +++ b/nscd.if @@ -299,10 +299,7 @@ interface(`nscd_admin',` allow $1 nscd_t:process { ptrace signal_perms }; ps_process_pattern($1, nscd_t) - init_labeled_script_domtrans($1, nscd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 nscd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, nscd_t, nscd_initrc_exec_t) logging_list_logs($1) admin_pattern($1, nscd_log_t) diff --git a/nsd.if b/nsd.if index a9c60ff..208cc12 100644 --- a/nsd.if +++ b/nsd.if @@ -54,10 +54,7 @@ interface(`nsd_admin',` allow $1 nsd_t:process { ptrace signal_perms }; ps_process_pattern($1, nsd_t) - init_labeled_script_domtrans($1, nsd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 nsd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, nsd_t, nsd_initrc_exec_t) files_search_etc($1) admin_pattern($1, { nsd_conf_t nsd_db_t }) diff --git a/nslcd.if b/nslcd.if index bbd7cac..86bc919 100644 --- a/nslcd.if +++ b/nslcd.if @@ -102,10 +102,7 @@ interface(`nslcd_admin',` allow $1 nslcd_t:process { ptrace signal_perms }; ps_process_pattern($1, nslcd_t) - nslcd_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 nslcd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, nslcd_t, nslcd_initrc_exec_t) files_search_etc($1) admin_pattern($1, nslcd_conf_t) diff --git a/ntop.if b/ntop.if index beaee73..4ffb735 100644 --- a/ntop.if +++ b/ntop.if @@ -26,10 +26,7 @@ interface(`ntop_admin',` allow $1 ntop_t:process { ptrace signal_perms }; ps_process_pattern($1, ntop_t) - init_labeled_script_domtrans($1, ntop_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 ntop_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, ntop_t, ntop_initrc_exec_t) files_search_etc($1) admin_pattern($1, ntop_etc_t) diff --git a/ntp.if b/ntp.if index e96a309..299f85c 100644 --- a/ntp.if +++ b/ntp.if @@ -166,10 +166,7 @@ interface(`ntp_admin',` allow $1 ntpd_t:process { ptrace signal_perms }; ps_process_pattern($1, ntpd_t) - init_labeled_script_domtrans($1, ntpd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 ntpd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, ntpd_t, ntpd_initrc_exec_t) files_list_etc($1) admin_pattern($1, { ntpd_key_t ntp_conf_t }) diff --git a/numad.if b/numad.if index 0d3c270..77cd980 100644 --- a/numad.if +++ b/numad.if @@ -26,10 +26,7 @@ interface(`numad_admin',` allow $1 numad_t:process { ptrace signal_perms }; ps_process_pattern($1, numad_t) - init_labeled_script_domtrans($1, numad_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 numad_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, numad_t, numad_initrc_exec_t) logging_search_logs($1) admin_pattern($1, numad_log_t) diff --git a/nut.if b/nut.if index c606ae6..7e27efe 100644 --- a/nut.if +++ b/nut.if @@ -26,10 +26,7 @@ interface(`nut_admin',` allow $1 nut_domain:process { ptrace signal_perms }; ps_process_pattern($1, nut_domain) - init_labeled_script_domtrans($1, nut_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 nut_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, nut_domain, nut_initrc_exec_t) files_search_etc($1) admin_pattern($1, nut_conf_t) diff --git a/oident.if b/oident.if index 513f452..0bce8c7 100644 --- a/oident.if +++ b/oident.if @@ -131,10 +131,7 @@ interface(`oident_admin',` allow $1 oidentd_t:process { ptrace signal_perms }; ps_process_pattern($1, oidentd_t) - init_labeled_script_domtrans($1, oidentd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 oidentd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, oidentd_t, oidentd_initrc_exec_t) files_list_etc($1) admin_pattern($1, oidentd_config_t) diff --git a/openct.if b/openct.if index a55238b..fbb910f 100644 --- a/openct.if +++ b/openct.if @@ -120,10 +120,7 @@ interface(`openct_admin',` allow $1 openct_t:process { ptrace signal_perms }; ps_process_pattern($1, openct_t) - init_labeled_script_domtrans($1, openct_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 openct_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, openct_t, openct_initrc_exec_t) files_search_pids($1) admin_pattern($1, openct_var_run_t) diff --git a/openhpi.if b/openhpi.if index 3c86958..a167d25 100644 --- a/openhpi.if +++ b/openhpi.if @@ -26,10 +26,7 @@ interface(`openhpi_admin',` allow $1 openhpid_t:process { ptrace signal_perms }; ps_process_pattern($1, openhpid_t) - init_labeled_script_domtrans($1, openhpid_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 openhpid_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, openhpid_t, openhpid_initrc_exec_t) files_search_var_lib($1) admin_pattern($1, openhpid_var_lib_t) diff --git a/openvpn.if b/openvpn.if index 6837e9a..ca3e2f2 100644 --- a/openvpn.if +++ b/openvpn.if @@ -150,10 +150,7 @@ interface(`openvpn_admin',` allow $1 openvpn_t:process { ptrace signal_perms }; ps_process_pattern($1, openvpn_t) - init_labeled_script_domtrans($1, openvpn_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 openvpn_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, openvpn_t, openvpn_initrc_exec_t) files_list_etc($1) admin_pattern($1, { openvpn_etc_t openvpn_etc_rw_t }) diff --git a/openvswitch.if b/openvswitch.if index 9b15730..cf9e657 100644 --- a/openvswitch.if +++ b/openvswitch.if @@ -64,10 +64,7 @@ interface(`openvswitch_admin',` allow $1 openvswitch_t:process { ptrace signal_perms }; ps_process_pattern($1, openvswitch_t) - init_labeled_script_domtrans($1, openvswitch_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 openvswitch_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, openvswitch_t, openvswitch_initrc_exec_t) files_search_etc($1) admin_pattern($1, openvswitch_conf_t) diff --git a/pacemaker.if b/pacemaker.if index 9682d9a..2202234 100644 --- a/pacemaker.if +++ b/pacemaker.if @@ -26,10 +26,7 @@ interface(`pacemaker_admin',` allow $1 pacemaker_t:process { ptrace signal_perms }; ps_process_pattern($1, pacemaker_t) - init_labeled_script_domtrans($1, pacemaker_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pacemaker_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pacemaker_t, pacemaker_initrc_exec_t) files_search_var_lib($1) admin_pattern($1, pacemaker_var_lib_t) diff --git a/pads.if b/pads.if index 6e097c9..544169e 100644 --- a/pads.if +++ b/pads.if @@ -26,10 +26,7 @@ interface(`pads_admin', ` allow $1 pads_t:process { ptrace signal_perms }; ps_process_pattern($1, pads_t) - init_labeled_script_domtrans($1, pads_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pads_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pads_t, pads_initrc_exec_t) files_search_pids($1) admin_pattern($1, pads_var_run_t) diff --git a/pcscd.if b/pcscd.if index 7f77d32..e858008 100644 --- a/pcscd.if +++ b/pcscd.if @@ -128,10 +128,7 @@ interface(`pcscd_admin',` allow $1 pcscd_t:process { ptrace signal_perms }; ps_process_pattern($1, pcscd_t) - init_labeled_script_domtrans($1, pcscd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pcscd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pcscd_t, pcscd_initrc_exec_t) files_search_pids($1) admin_pattern($1, pcscd_var_run_t) diff --git a/pegasus.if b/pegasus.if index d2fc677..ed2f077 100644 --- a/pegasus.if +++ b/pegasus.if @@ -27,10 +27,7 @@ interface(`pegasus_admin',` allow $1 pegasus_t:process { ptrace signal_perms }; ps_process_pattern($1, pegasus_t) - init_labeled_script_domtrans($1, pegasus_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pegasus_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pegasus_t, pegasus_initrc_exec_t) files_search_etc($1) admin_pattern($1, pegasus_conf_t) diff --git a/perdition.if b/perdition.if index 47e09e1..debfd38 100644 --- a/perdition.if +++ b/perdition.if @@ -40,10 +40,7 @@ interface(`perdition_admin',` allow $1 perdition_t:process { ptrace signal_perms }; ps_process_pattern($1, perdition_t) - init_labeled_script_domtrans($1, perdition_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 perdition_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, perdition_t, perdition_initrc_exec_t) files_search_etc($1) admin_pattern($1, perdition_etc_t) diff --git a/pingd.if b/pingd.if index 21a6ecb..30d36fe 100644 --- a/pingd.if +++ b/pingd.if @@ -84,10 +84,7 @@ interface(`pingd_admin',` allow $1 pingd_t:process { ptrace signal_perms }; ps_process_pattern($1, pingd_t) - init_labeled_script_domtrans($1, pingd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pingd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pingd_t, pingd_initrc_exec_t) files_list_etc($1) admin_pattern($1, pingd_etc_t) diff --git a/pkcs.if b/pkcs.if index 69be2aa..d21ba76 100644 --- a/pkcs.if +++ b/pkcs.if @@ -26,10 +26,7 @@ interface(`pkcs_admin_slotd',` allow $1 pkcs_slotd_t:process { ptrace signal_perms }; ps_process_pattern($1, pkcs_slotd_t) - init_labeled_script_domtrans($1, pkcs_slotd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pkcs_slotd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pkcs_slotd_t, pkcs_slotd_initrc_exec_t) files_search_var_lib($1) admin_pattern($1, pkcs_slotd_var_lib_t) diff --git a/polipo.if b/polipo.if index ae27bb7..b523ccc 100644 --- a/polipo.if +++ b/polipo.if @@ -125,10 +125,7 @@ interface(`polipo_admin',` allow $1 polipo_system_t:process { ptrace signal_perms }; ps_process_pattern($1, polipo_system_t) - polipo_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 polipo_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, polipo_t, polipo_initrc_exec_t) files_search_var($1) admin_pattern($1, polipo_cache_t) diff --git a/portmap.if b/portmap.if index 9f982b5..ee8cd17 100644 --- a/portmap.if +++ b/portmap.if @@ -114,10 +114,7 @@ interface(`portmap_admin',` allow $1 { portmap_t portmap_helper_t }:process { ptrace signal_perms }; ps_process_pattern($1, { portmap_t portmap_helper_t }) - init_labeled_script_domtrans($1, portmap_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 portmap_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, portmap_t, portmap_initrc_exec_t) files_search_pids($1) admin_pattern($1, portmap_var_run_t) diff --git a/portreserve.if b/portreserve.if index 5ad5291..0401fd2 100644 --- a/portreserve.if +++ b/portreserve.if @@ -108,10 +108,7 @@ interface(`portreserve_admin',` allow $1 portreserve_t:process { ptrace signal_perms }; ps_process_pattern($1, portreserve_t) - portreserve_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 portreserve_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, portreserve_t, portreserve_initrc_exec_t) files_list_etc($1) admin_pattern($1, portreserve_etc_t) diff --git a/postfix.if b/postfix.if index ded95ec..d54fa51 100644 --- a/postfix.if +++ b/postfix.if @@ -720,10 +720,7 @@ interface(`postfix_admin',` allow $1 postfix_domain:process { ptrace signal_perms }; ps_process_pattern($1, postfix_domain) - init_labeled_script_domtrans($1, postfix_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 postfix_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, postfix_t, postfix_initrc_exec_t) files_search_etc($1) admin_pattern($1, { postfix_prng_t postfix_etc_t postfix_exec_t postfix_keytab_t }) diff --git a/postfixpolicyd.if b/postfixpolicyd.if index 5de8173..3d925b7 100644 --- a/postfixpolicyd.if +++ b/postfixpolicyd.if @@ -26,10 +26,7 @@ interface(`postfixpolicyd_admin',` allow $1 postfix_policyd_t:process { ptrace signal_perms }; ps_process_pattern($1, postfix_policyd_t) - init_labeled_script_domtrans($1, postfix_policyd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 postfix_policyd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, postfix_policyd_t, postfix_policyd_initrc_exec_t) files_list_etc($1) admin_pattern($1, postfix_policyd_conf_t) diff --git a/postgrey.if b/postgrey.if index b9e71b5..50b620d 100644 --- a/postgrey.if +++ b/postgrey.if @@ -67,10 +67,7 @@ interface(`postgrey_admin',` allow $1 postgrey_t:process { ptrace signal_perms }; ps_process_pattern($1, postgrey_t) - init_labeled_script_domtrans($1, postgrey_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 postgrey_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, postgrey_t, postgrey_initrc_exec_t) files_list_etc($1) admin_pattern($1, postgrey_etc_t) diff --git a/ppp.if b/ppp.if index cd8b8b9..52c2acf 100644 --- a/ppp.if +++ b/ppp.if @@ -487,10 +487,7 @@ interface(`ppp_admin',` allow $1 { pptp_t pppd_t }:process { ptrace signal_perms }; ps_process_pattern($1, { pptp_t pppd_t }) - ppp_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 pppd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pppd_t, pppd_initrc_exec_t) files_list_tmp($1) admin_pattern($1, pppd_tmp_t) diff --git a/prelude.if b/prelude.if index db8f510..406d8ac 100644 --- a/prelude.if +++ b/prelude.if @@ -126,10 +126,7 @@ interface(`prelude_admin',` allow $1 { prelude_t prelude_audisp_t prelude_lml_t prelude_correlator_t }:process { ptrace signal_perms }; ps_process_pattern($1, { prelude_t prelude_audisp_t prelude_lml_t prelude_correlator_t }) - init_labeled_script_domtrans($1, prelude_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 prelude_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, prelude_t, prelude_initrc_exec_t) files_search_spool($1) admin_pattern($1, prelude_spool_t) diff --git a/privoxy.if b/privoxy.if index bdcee30..30a6e1f 100644 --- a/privoxy.if +++ b/privoxy.if @@ -26,10 +26,7 @@ interface(`privoxy_admin',` allow $1 privoxy_t:process { ptrace signal_perms }; ps_process_pattern($1, privoxy_t) - init_labeled_script_domtrans($1, privoxy_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 privoxy_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, privoxy_t, privoxy_initrc_exec_t) logging_list_logs($1) admin_pattern($1, privoxy_log_t) diff --git a/psad.if b/psad.if index cdc83d2..645dca6 100644 --- a/psad.if +++ b/psad.if @@ -242,10 +242,7 @@ interface(`psad_admin',` allow $1 psad_t:process { ptrace signal_perms }; ps_process_pattern($1, psad_t) - init_labeled_script_domtrans($1, psad_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 psad_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, psad_t, psad_initrc_exec_t) files_search_etc($1) admin_pattern($1, psad_etc_t) diff --git a/puppet.if b/puppet.if index 7cb8b1f..79ef096 100644 --- a/puppet.if +++ b/puppet.if @@ -211,10 +211,8 @@ interface(`puppet_admin',` allow $1 { puppet_t puppetca_t puppetmaster_t }:process { ptrace signal_perms }; ps_process_pattern($1, { puppet_t puppetca_t puppetmaster_t }) - init_labeled_script_domtrans($1, { puppet_initrc_exec_t puppetmaster_initrc_exec_t }) - domain_system_change_exemption($1) - role_transition $2 { puppet_initrc_exec_t puppetmaster_initrc_exec_t } system_r; - allow $2 system_r; + init_manage_service_template($1, $2, puppet_t, puppet_initrc_exec_t) + init_manage_service_template($1, $2, puppetmaster_t, puppetmaster_initrc_exec_t) files_search_etc($1) admin_pattern($1, puppet_etc_t) diff --git a/pxe.if b/pxe.if index 7da286f..7924c86 100644 --- a/pxe.if +++ b/pxe.if @@ -26,10 +26,7 @@ interface(`pxe_admin',` allow $1 pxe_t:process { ptrace signal_perms }; ps_process_pattern($1, pxe_t) - init_labeled_script_domtrans($1, pxe_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pxe_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pxe_t, pxe_initrc_exec_t) logging_search_logs($1) admin_pattern($1, pxe_log_t) diff --git a/pyicqt.if b/pyicqt.if index 0ccea82..89fcf94 100644 --- a/pyicqt.if +++ b/pyicqt.if @@ -26,10 +26,7 @@ interface(`pyicqt_admin',` allow $1 pyicqt_t:process { ptrace signal_perms }; ps_process_pattern($1, pyicqt_t) - init_labeled_script_domtrans($1, pyicqt_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pyicqt_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pyicqt_t, pyicqt_initrc_exec_t) files_search_etc($1) admin_pattern($1, pyicqt_conf_t) diff --git a/pyzor.if b/pyzor.if index c05a504..127cfb8 100644 --- a/pyzor.if +++ b/pyzor.if @@ -118,10 +118,7 @@ interface(`pyzor_admin',` allow $1 pyzord_t:process { ptrace signal_perms }; ps_process_pattern($1, pyzord_t) - init_labeled_script_domtrans($1, pyzord_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 pyzord_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, pyzord_t, pyzord_initrc_exec_t) files_search_etc($1) admin_pattern($1, pyzor_etc_t) diff --git a/qpid.if b/qpid.if index fe2adf8..457b143 100644 --- a/qpid.if +++ b/qpid.if @@ -177,10 +177,7 @@ interface(`qpidd_admin',` allow $1 qpidd_t:process { ptrace signal_perms }; ps_process_pattern($1, qpidd_t) - qpidd_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 qpidd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, qpidd_t, qpidd_initrc_exec_t) files_search_var_lib($1) admin_pattern($1, qpidd_var_lib_t) diff --git a/quantum.if b/quantum.if index afc0068..b158c7e 100644 --- a/quantum.if +++ b/quantum.if @@ -26,10 +26,7 @@ interface(`quantum_admin',` allow $1 quantum_t:process { ptrace signal_perms }; ps_process_pattern($1, quantum_t) - init_labeled_script_domtrans($1, quantum_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 quantum_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, quantum_t, quantum_initrc_exec_t) logging_search_logs($1) admin_pattern($1, quantum_log_t) diff --git a/quota.if b/quota.if index 68611e3..3fbb18e 100644 --- a/quota.if +++ b/quota.if @@ -184,10 +184,7 @@ interface(`quota_admin',` allow $1 { quota_nld_t quota_t }:process { ptrace signal_perms }; ps_process_pattern($1, { quota_nld_t quota_t }) - init_labeled_script_domtrans($1, quota_nld_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 quota_nld_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, quota_nld_t, quota_nld_initrc_exec_t) files_list_all($1) admin_pattern($1, { quota_db_t quota_flag_t quota_nld_var_run_t }) diff --git a/rabbitmq.if b/rabbitmq.if index 2c3d338..71f30bb 100644 --- a/rabbitmq.if +++ b/rabbitmq.if @@ -45,10 +45,7 @@ interface(`rabbitmq_admin',` allow $1 { rabbitmq_epmd_t rabbitmq_beam_t }:process { ptrace signal_perms }; ps_process_pattern($1, { rabbitmq_epmd_t rabbitmq_beam_t }) - init_labeled_script_domtrans($1, rabbitmq_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 rabbitmq_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, { rabbitmq_epmd_t rabbitmq_beam_t }, rabbitmq_initrc_exec_t) logging_search_logs($1) admin_pattern($1, rabbitmq_var_log_t) diff --git a/radius.if b/radius.if index 4460582..b0a7db0 100644 --- a/radius.if +++ b/radius.if @@ -41,10 +41,7 @@ interface(`radius_admin',` allow $1 radiusd_t:process { ptrace signal_perms }; ps_process_pattern($1, radiusd_t) - init_labeled_script_domtrans($1, radiusd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 radiusd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, radiusd_t, radiusd_initrc_exec_t) files_list_etc($1) admin_pattern($1, { radiusd_etc_t radiusd_etc_rw_t }) diff --git a/radvd.if b/radvd.if index ac7058d..a9a77f5 100644 --- a/radvd.if +++ b/radvd.if @@ -26,10 +26,7 @@ interface(`radvd_admin',` allow $1 radvd_t:process { ptrace signal_perms }; ps_process_pattern($1, radvd_t) - init_labeled_script_domtrans($1, radvd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 radvd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, radvd_t, radvd_initrc_exec_t) files_list_etc($1) admin_pattern($1, radvd_etc_t) diff --git a/raid.if b/raid.if index 951db7f..60198cf 100644 --- a/raid.if +++ b/raid.if @@ -91,10 +91,7 @@ interface(`raid_admin_mdadm',` allow $1 mdadm_t:process { ptrace signal_perms }; ps_process_pattern($1, mdadm_t) - init_labeled_script_domtrans($1, mdadm_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 mdadm_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, mdadm_t, mdadm_initrc_exec_t) files_search_pids($1) admin_pattern($1, mdadm_var_run_t) diff --git a/redis.if b/redis.if index 3969450..0c0d62d 100644 --- a/redis.if +++ b/redis.if @@ -26,10 +26,7 @@ interface(`redis_admin',` allow $1 redis_t:process { ptrace signal_perms }; ps_process_pattern($1, redis_t) - init_labeled_script_domtrans($1, redis_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 redis_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, redis_t, redis_initrc_exec_t) logging_search_logs($1) admin_pattern($1, redis_log_t) diff --git a/resmgr.if b/resmgr.if index 0d93db6..30312f5 100644 --- a/resmgr.if +++ b/resmgr.if @@ -46,10 +46,7 @@ interface(`resmgr_admin',` allow $1 resmgrd_t:process { ptrace signal_perms }; ps_process_pattern($1, resmgrd_t) - init_labeled_script_domtrans($1, resmgrd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 resmgrd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, resmgrd_t, resmgrd_initrc_exec_t) files_search_etc($1) admin_pattern($1, resmgrd_etc_t) diff --git a/rgmanager.if b/rgmanager.if index 1c2f9aa..a1be103 100644 --- a/rgmanager.if +++ b/rgmanager.if @@ -105,10 +105,7 @@ interface(`rgmanager_admin',` allow $1 rgmanager_t:process { ptrace signal_perms }; ps_process_pattern($1, rgmanager_t) - init_labeled_script_domtrans($1, rgmanager_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 rgmanager_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, rgmanager_t, rgmanager_initrc_exec_t) files_list_tmp($1) admin_pattern($1, rgmanager_tmp_t) diff --git a/rhcs.if b/rhcs.if index c8bdea2..fa4c5d9 100644 --- a/rhcs.if +++ b/rhcs.if @@ -467,15 +467,14 @@ interface(`rhcs_admin',` attribute cluster_log; type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t; type fenced_tmp_t, qdiskd_var_lib_t; + type dlm_controld_t, foghorn_t; ') allow $1 cluster_domain:process { ptrace signal_perms }; ps_process_pattern($1, cluster_domain) - init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t }) - domain_system_change_exemption($1) - role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r; - allow $2 system_r; + init_manage_service_template($1, $2, dlm_controld_t, dlm_controld_initrc_exec_t) + init_manage_service_template($1, $2, foghorn_t, foghorn_initrc_exec_t) files_search_pids($1) admin_pattern($1, cluster_pid) diff --git a/rhsmcertd.if b/rhsmcertd.if index 6dbc905..019f668 100644 --- a/rhsmcertd.if +++ b/rhsmcertd.if @@ -285,10 +285,7 @@ interface(`rhsmcertd_admin',` allow $1 rhsmcertd_t:process { ptrace signal_perms }; ps_process_pattern($1, rhsmcertd_t) - rhsmcertd_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 rhsmcertd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, rhsmcertd_t, rhsmcertd_initrc_exec_t) logging_search_logs($1) admin_pattern($1, rhsmcertd_log_t) diff --git a/ricci.if b/ricci.if index 2ab3ed1..05015c8 100644 --- a/ricci.if +++ b/ricci.if @@ -203,10 +203,7 @@ interface(`ricci_admin',` allow $1 ricci_t:process { ptrace signal_perms }; ps_process_pattern($1, ricci_t) - init_labeled_script_domtrans($1, ricci_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 ricci_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, ricci_t, ricci_initrc_exec_t) files_list_tmp($1) admin_pattern($1, ricci_tmp_t) diff --git a/rngd.if b/rngd.if index 13f788f..51397eb 100644 --- a/rngd.if +++ b/rngd.if @@ -25,10 +25,7 @@ interface(`rngd_admin',` allow $1 rngd_t:process { ptrace signal_perms }; ps_process_pattern($1, rngd_t) - init_labeled_script_domtrans($1, rngd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 rngd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, rngd_t, rngd_initrc_exec_t) files_search_pids($1) admin_pattern($1, rngd_var_run_t) diff --git a/roundup.if b/roundup.if index 975bb6a..0a351b5 100644 --- a/roundup.if +++ b/roundup.if @@ -26,10 +26,7 @@ interface(`roundup_admin',` allow $1 roundup_t:process { ptrace signal_perms }; ps_process_pattern($1, roundup_t) - init_labeled_script_domtrans($1, roundup_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 roundup_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, roundup_t, roundup_initrc_exec_t) files_list_var_lib($1) admin_pattern($1, roundup_var_lib_t) diff --git a/rpc.if b/rpc.if index 0bf13c2..70c986a 100644 --- a/rpc.if +++ b/rpc.if @@ -391,15 +391,14 @@ interface(`rpc_admin',` type nfsd_initrc_exec_t, rpcd_initrc_exec_t, exports_t; type var_lib_nfs_t, rpcd_var_run_t, gssd_tmp_t; type nfsd_ro_t, nfsd_rw_t, gssd_keytab_t; + type nfsd_t, rpcd_t; ') allow $1 rpc_domain:process { ptrace signal_perms }; ps_process_pattern($1, rpc_domain) - init_labeled_script_domtrans($1, { nfsd_initrc_exec_t rpcd_initrc_exec_t }) - domain_system_change_exemption($1) - role_transition $2 { nfsd_initrc_exec_t rpcd_initrc_exec_t } system_r; - allow $2 system_r; + init_manage_service_template($1, $2, nfsd_t, nfsd_initrc_exec_t) + init_manage_service_template($1, $2, rpcd_t, rpcd_initrc_exec_t) files_list_etc($1) admin_pattern($1, { gssd_keytab_t exports_t }) diff --git a/rpcbind.if b/rpcbind.if index f78fef0..da34256 100644 --- a/rpcbind.if +++ b/rpcbind.if @@ -160,10 +160,7 @@ interface(`rpcbind_admin',` allow $1 rpcbind_t:process { ptrace signal_perms }; ps_process_pattern($1, rpcbind_t) - init_labeled_script_domtrans($1, rpcbind_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 rpcbind_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, rpcbind_t, rpcbind_initrc_exec_t) files_search_pids($1) admin_pattern($1, rpcbind_var_run_t) diff --git a/rpm.if b/rpm.if index fc9c8d8..554536f 100644 --- a/rpm.if +++ b/rpm.if @@ -634,10 +634,7 @@ interface(`rpm_admin',` allow $1 { rpm_t rpm_script_t }:process { ptrace signal_perms }; ps_process_pattern($1, { rpm_t rpm_script_t }) - init_labeled_script_domtrans($1, rpm_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 rpm_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, rpm_t, rpm_initrc_exec_t) admin_pattern($1, rpm_file_t) diff --git a/rtkit.if b/rtkit.if index e904ec4..39e82ad 100644 --- a/rtkit.if +++ b/rtkit.if @@ -90,8 +90,5 @@ interface(`rtkit_admin',` allow $1 rtkit_daemon_t:process { ptrace signal_perms }; ps_process_pattern($1, rtkit_daemon_t) - init_labeled_script_domtrans($1, rtkit_daemon_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 rtkit_daemon_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, rtkit_daemon_t, rtkit_daemon_initrc_exec_t) ') diff --git a/rwho.if b/rwho.if index 0360ff0..b07754b 100644 --- a/rwho.if +++ b/rwho.if @@ -142,10 +142,7 @@ interface(`rwho_admin',` allow $1 rwho_t:process { ptrace signal_perms }; ps_process_pattern($1, rwho_t) - init_labeled_script_domtrans($1, rwho_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 rwho_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, rwho_t, rwho_initrc_exec_t) logging_list_logs($1) admin_pattern($1, rwho_log_t) diff --git a/samba.if b/samba.if index 50d07fb..a9b0c3a 100644 --- a/samba.if +++ b/samba.if @@ -695,10 +695,7 @@ interface(`samba_admin',` allow $1 { nmbd_t smbd_t }:process { ptrace signal_perms }; ps_process_pattern($1, { nmbd_t smbd_t }) - init_labeled_script_domtrans($1, samba_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 samba_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, samba_t, samba_initrc_exec_t) files_list_etc($1) admin_pattern($1, { samba_etc_t smbd_keytab_t }) diff --git a/samhain.if b/samhain.if index b1ebcee..053e454 100644 --- a/samhain.if +++ b/samhain.if @@ -221,10 +221,7 @@ interface(`samhain_admin',` ps_process_pattern($1, samhain_domain) # duplicate role transition: remove samhain_admin(sysadm_t, sysadm_r) first - # init_labeled_script_domtrans($1, samhain_initrc_exec_t) - # domain_system_change_exemption($1) - # role_transition $2 samhain_initrc_exec_t system_r; - # allow $2 system_r; + # init_manage_service_template($1, $2, samhain_domain, samhain_initrc_exec_t) files_list_var_lib($1) admin_pattern($1, samhain_db_t) diff --git a/sanlock.if b/sanlock.if index cd6c213..2c4feed 100644 --- a/sanlock.if +++ b/sanlock.if @@ -104,10 +104,7 @@ interface(`sanlock_admin',` allow $1 sanlock_t:process { ptrace signal_perms }; ps_process_pattern($1, sanlock_t) - sanlock_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 sanlock_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, sanlock_t, sanlock_initrc_exec_t) files_search_pids($1) admin_pattern($1, sanlock_var_run_t) diff --git a/sasl.if b/sasl.if index 8c3c151..3bbf29b 100644 --- a/sasl.if +++ b/sasl.if @@ -45,10 +45,7 @@ interface(`sasl_admin',` allow $1 saslauthd_t:process { ptrace signal_perms }; ps_process_pattern($1, saslauthd_t) - init_labeled_script_domtrans($1, saslauthd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 saslauthd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, saslauthd_t, saslauthd_initrc_exec_t) files_list_etc($1) admin_pattern($1, saslauthd_keytab_t) diff --git a/sblim.if b/sblim.if index 98c9e0a..f3c6717 100644 --- a/sblim.if +++ b/sblim.if @@ -64,10 +64,7 @@ interface(`sblim_admin',` allow $1 sblim_domain:process { ptrace signal_perms }; ps_process_pattern($1, sblim_domain) - init_labeled_script_domtrans($1, sblim_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 sblim_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, sblim_domain, sblim_initrc_exec_t) files_search_pids($1) admin_pattern($1, sblim_var_run_t) diff --git a/sendmail.if b/sendmail.if index 35ad2a7..761fd1c 100644 --- a/sendmail.if +++ b/sendmail.if @@ -360,9 +360,7 @@ interface(`sendmail_admin',` allow $1 { unconfined_sendmail_t sendmail_t }:process { ptrace signal_perms }; ps_process_pattern($1, { unconfined_sendmail_t sendmail_t }) - init_labeled_script_domtrans($1, sendmail_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 sendmail_initrc_exec_t system_r; + init_manage_service_template($1, $2, sendmail_t, sendmail_initrc_exec_t) files_list_etc($1) admin_pattern($1, sendmail_keytab_t) diff --git a/sensord.if b/sensord.if index d204752..a1d174b 100644 --- a/sensord.if +++ b/sensord.if @@ -25,10 +25,7 @@ interface(`sensord_admin',` allow $1 sensord_t:process { ptrace signal_perms }; ps_process_pattern($1, sensord_t) - init_labeled_script_domtrans($1, sensord_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 sensord_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, sensord_t, sensord_initrc_exec_t) files_search_pids($1) admin_pattern($1, sensord_var_run_t) diff --git a/shorewall.if b/shorewall.if index 1aeef8a..5eaff00 100644 --- a/shorewall.if +++ b/shorewall.if @@ -179,10 +179,7 @@ interface(`shorewall_admin',` allow $1 shorewall_t:process { ptrace signal_perms }; ps_process_pattern($1, shorewall_t) - init_labeled_script_domtrans($1, shorewall_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 shorewall_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, shorewall_t, shorewall_initrc_exec_t) can_exec($1, shorewall_exec_t) diff --git a/slpd.if b/slpd.if index ca32e89..25b1386 100644 --- a/slpd.if +++ b/slpd.if @@ -26,10 +26,7 @@ interface(`slpd_admin',` allow $1 slpd_t:process { ptrace signal_perms }; ps_process_pattern($1, slpd_t) - init_labeled_script_domtrans($1, slpd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 slpd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, slpd_t, slpd_initrc_exec_t) logging_search_logs($1) admin_pattern($1, slpd_log_t) diff --git a/smartmon.if b/smartmon.if index e0644b5..1b80197 100644 --- a/smartmon.if +++ b/smartmon.if @@ -45,10 +45,7 @@ interface(`smartmon_admin',` allow $1 fsdaemon_t:process { ptrace signal_perms }; ps_process_pattern($1, fsdaemon_t) - init_labeled_script_domtrans($1, fsdaemon_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 fsdaemon_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, fsdaemon_t, fsdaemon_initrc_exec_t) files_list_tmp($1) admin_pattern($1, fsdaemon_tmp_t) diff --git a/smokeping.if b/smokeping.if index 1fa51c1..fe1459e 100644 --- a/smokeping.if +++ b/smokeping.if @@ -161,10 +161,7 @@ interface(`smokeping_admin',` allow $1 smokeping_t:process { ptrace signal_perms }; ps_process_pattern($1, smokeping_t) - smokeping_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 smokeping_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, smokeping_t, smokeping_initrc_exec_t) files_search_var_lib($1) admin_pattern($1, smokeping_var_lib_t) diff --git a/smstools.if b/smstools.if index 81136f0..7253219 100644 --- a/smstools.if +++ b/smstools.if @@ -27,10 +27,7 @@ interface(`smstools_admin',` allow $1 smsd_t:process { ptrace signal_perms }; ps_process_pattern($1, smsd_t) - init_labeled_script_domtrans($1, smsd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 smsd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, smsd_t, smsd_initrc_exec_t) files_search_etc($1) admin_pattern($1, smsd_conf_t) diff --git a/snmp.if b/snmp.if index 7a9cc9d..867fbb8 100644 --- a/snmp.if +++ b/snmp.if @@ -182,10 +182,7 @@ interface(`snmp_admin',` allow $1 snmpd_t:process { ptrace signal_perms }; ps_process_pattern($1, snmpd_t) - init_labeled_script_domtrans($1, snmpd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 snmpd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, snmpd_t, snmpd_initrc_exec_t) logging_list_logs($1) admin_pattern($1, snmpd_log_t) diff --git a/snort.if b/snort.if index 7d86b34..3ac3e94 100644 --- a/snort.if +++ b/snort.if @@ -45,10 +45,7 @@ interface(`snort_admin',` allow $1 snort_t:process { ptrace signal_perms }; ps_process_pattern($1, snort_t) - init_labeled_script_domtrans($1, snort_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 snort_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, snort_t, snort_initrc_exec_t) admin_pattern($1, snort_etc_t) files_search_etc($1) diff --git a/soundserver.if b/soundserver.if index a5abc5a..622083e 100644 --- a/soundserver.if +++ b/soundserver.if @@ -41,10 +41,7 @@ interface(`soundserver_admin',` allow $1 soundd_t:process { ptrace signal_perms }; ps_process_pattern($1, soundd_t) - init_labeled_script_domtrans($1, soundd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 soundd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, soundd_t, soundd_initrc_exec_t) files_list_etc($1) admin_pattern($1, soundd_etc_t) diff --git a/spamassassin.if b/spamassassin.if index 7f5a1cc..9505db9 100644 --- a/spamassassin.if +++ b/spamassassin.if @@ -384,10 +384,7 @@ interface(`spamassassin_admin',` allow $1 spamd_t:process { ptrace signal_perms }; ps_process_pattern($1, spamd_t) - init_labeled_script_domtrans($1, spamd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 spamd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, spamd_t, spamd_initrc_exec_t) files_list_tmp($1) admin_pattern($1, spamd_tmp_t) diff --git a/squid.if b/squid.if index 5e1f053..22a9cf4 100644 --- a/squid.if +++ b/squid.if @@ -216,10 +216,7 @@ interface(`squid_admin',` allow $1 squid_t:process { ptrace signal_perms }; ps_process_pattern($1, squid_t) - init_labeled_script_domtrans($1, squid_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 squid_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, squid_t, squid_initrc_exec_t) files_list_var($1) admin_pattern($1, squid_cache_t) diff --git a/sssd.if b/sssd.if index a240455..33a8245 100644 --- a/sssd.if +++ b/sssd.if @@ -342,10 +342,7 @@ interface(`sssd_admin',` allow $1 sssd_t:process { ptrace signal_perms }; ps_process_pattern($1, sssd_t) - sssd_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 sssd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, sssd_t, sssd_initrc_exec_t) files_search_etc($1) admin_pattern($1, sssd_conf_t) diff --git a/svnserve.if b/svnserve.if index 5cd46e9..c1deaa4 100644 --- a/svnserve.if +++ b/svnserve.if @@ -25,10 +25,7 @@ interface(`svnserve_admin',` allow $1 svnserve_t:process { ptrace signal_perms }; ps_process_pattern($1, svnserve_t) - init_labeled_script_domtrans($1, svnserve_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 svnserve_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, svnserve_t, svnserve_initrc_exec_t) files_search_pids($1) admin_pattern($1, svnserve_var_run_t) diff --git a/sysstat.if b/sysstat.if index 14ae3f2..ab84adf 100644 --- a/sysstat.if +++ b/sysstat.if @@ -46,10 +46,7 @@ interface(`sysstat_admin',` allow $1 sysstat_t:process { ptrace signal_perms }; ps_process_pattern($1, sysstat_t) - init_labeled_script_domtrans($1, sysstat_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 sysstat_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, sysstat_t, sysstat_initrc_exec_t) logging_search_logs($1) admin_pattern($1, sysstat_log_t) diff --git a/systemtap.if b/systemtap.if index d60a21e..417ab39 100644 --- a/systemtap.if +++ b/systemtap.if @@ -26,10 +26,7 @@ interface(`stapserver_admin',` allow $1 stapserver_t:process { ptrace signal_perms }; ps_process_pattern($1, stapserver_t) - init_labeled_script_domtrans($1, stapserver_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 stapserver_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, stapserver_t, stapserver_initrc_exec_t) files_search_etc($1) admin_pattern($1, stapserver_conf_t) diff --git a/tcsd.if b/tcsd.if index b42ec1d..bbcfe28 100644 --- a/tcsd.if +++ b/tcsd.if @@ -141,10 +141,7 @@ interface(`tcsd_admin',` allow $1 tcsd_t:process { ptrace signal_perms }; ps_process_pattern($1, tcsd_t) - tcsd_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 tcsd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, tcsd_t, tcsd_initrc_exec_t) files_search_var_lib($1) admin_pattern($1, tcsd_var_lib_t) diff --git a/tgtd.if b/tgtd.if index dc5b46e..348ba3c 100644 --- a/tgtd.if +++ b/tgtd.if @@ -83,10 +83,7 @@ interface(`tgtd_admin',` allow $1 tgtd_t:process { ptrace signal_perms }; ps_process_pattern($1, tgtd_t) - init_labeled_script_domtrans($1, tgtd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 tgtd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, tgtd_t, tgtd_initrc_exec_t) files_search_var_lib($1) admin_pattern($1, tgtd_var_lib_t) diff --git a/tor.if b/tor.if index 61c2e07..0e937e3 100644 --- a/tor.if +++ b/tor.if @@ -45,10 +45,7 @@ interface(`tor_admin',` allow $1 tor_t:process { ptrace signal_perms }; ps_process_pattern($1, tor_t) - init_labeled_script_domtrans($1, tor_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 tor_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, tor_t, tor_initrc_exec_t) files_list_etc($1) admin_pattern($1, tor_etc_t) diff --git a/transproxy.if b/transproxy.if index 81a8351..da66c3e 100644 --- a/transproxy.if +++ b/transproxy.if @@ -25,10 +25,7 @@ interface(`transproxy_admin',` allow $1 transproxy_t:process { ptrace signal_perms }; ps_process_pattern($1, transproxy_t) - init_labeled_script_domtrans($1, transproxy_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 transproxy_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, transproxy_t, transproxy_initrc_exec_t) files_search_pids($1) admin_pattern($1, transproxy_var_run_t) diff --git a/tuned.if b/tuned.if index e29db63..8bff06c 100644 --- a/tuned.if +++ b/tuned.if @@ -122,10 +122,7 @@ interface(`tuned_admin',` allow $1 tuned_t:process { ptrace signal_perms }; ps_process_pattern($1, tuned_t) - tuned_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 tuned_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, tuned_t, tuned_initrc_exec_t) files_search_etc($1) admin_pattern($1, { tuned_etc_t tuned_rw_etc_t }) diff --git a/ulogd.if b/ulogd.if index 9b95c3e..66f375b 100644 --- a/ulogd.if +++ b/ulogd.if @@ -126,10 +126,7 @@ interface(`ulogd_admin',` allow $1 ulogd_t:process { ptrace signal_perms }; ps_process_pattern($1, ulogd_t) - init_labeled_script_domtrans($1, ulogd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 ulogd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, ulogd_t, ulogd_initrc_exec_t) files_list_etc($1) admin_pattern($1, ulogd_etc_t) diff --git a/uptime.if b/uptime.if index 19f4724..b5afd2a 100644 --- a/uptime.if +++ b/uptime.if @@ -26,10 +26,7 @@ interface(`uptime_admin',` allow $1 uptimed_t:process { ptrace signal_perms }; ps_process_pattern($1, uptimed_t) - init_labeled_script_domtrans($1, uptimed_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 uptimed_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, uptimed_t, uptimed_initrc_exec_t) files_search_etc($1) admin_pattern($1, uptimed_etc_t) diff --git a/uucp.if b/uucp.if index af9acc0..dc16612 100644 --- a/uucp.if +++ b/uucp.if @@ -104,10 +104,7 @@ interface(`uucp_admin',` type uucpd_var_run_t, uucpd_initrc_exec_t; ') - init_labeled_script_domtrans($1, uucpd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 uucpd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, uucpd_t, uucpd_initrc_exec_t) allow $1 uucpd_t:process { ptrace signal_perms }; ps_process_pattern($1, uucpd_t) diff --git a/uuidd.if b/uuidd.if index 6e48653..a576a6e 100644 --- a/uuidd.if +++ b/uuidd.if @@ -181,10 +181,7 @@ interface(`uuidd_admin',` allow $1 uuidd_t:process signal_perms; ps_process_pattern($1, uuidd_t) - uuidd_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 uuidd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, uuidd_t, uuidd_initrc_exec_t) files_search_var_lib($1) admin_pattern($1, uuidd_var_lib_t) diff --git a/varnishd.if b/varnishd.if index 1c35171..fa2ccbf 100644 --- a/varnishd.if +++ b/varnishd.if @@ -160,10 +160,7 @@ interface(`varnishd_admin_varnishlog',` allow $1 varnishlog_t:process { ptrace signal_perms }; ps_process_pattern($1, varnishlog_t) - init_labeled_script_domtrans($1, varnishlog_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 varnishlog_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, varnishlog_t, varnishlog_initrc_exec_t) files_list_pids($1) admin_pattern($1, varnishlog_var_run_t) @@ -199,10 +196,7 @@ interface(`varnishd_admin',` allow $1 varnishd_t:process { ptrace signal_perms }; ps_process_pattern($1, varnishd_t) - init_labeled_script_domtrans($1, varnishd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 varnishd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, varnishd_t, varnishd_initrc_exec_t) files_list_var_lib($1) admin_pattern($1, varnishd_var_lib_t) diff --git a/vdagent.if b/vdagent.if index 31c752e..6957e8a 100644 --- a/vdagent.if +++ b/vdagent.if @@ -121,10 +121,7 @@ interface(`vdagent_admin',` allow $1 vdagent_t:process signal_perms; ps_process_pattern($1, vdagent_t) - init_labeled_script_domtrans($1, vdagentd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 vdagentd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, vdagentd_t, vdagentd_initrc_exec_t) logging_search_logs($1) admin_pattern($1, vdagent_log_t) diff --git a/vhostmd.if b/vhostmd.if index 22edd58..d7cff66 100644 --- a/vhostmd.if +++ b/vhostmd.if @@ -219,10 +219,7 @@ interface(`vhostmd_admin',` allow $1 vhostmd_t:process { ptrace signal_perms }; ps_process_pattern($1, vhostmd_t) - vhostmd_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 vhostmd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, vhostmd_t, vhostmd_initrc_exec_t) fs_search_tmpfs($1) admin_pattern($1, vhostmd_tmpfs_t) diff --git a/virt.if b/virt.if index fd087b9..a606d9d 100644 --- a/virt.if +++ b/virt.if @@ -1171,10 +1171,7 @@ interface(`virt_admin',` ps_process_pattern($1, { virt_domain svirt_lxc_domain virtd_t }) ps_process_pattern($1, { virtd_lxc_t virsh_t virt_bridgehelper_t virt_qmf_t }) - init_labeled_script_domtrans($1, virtd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 virtd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, virtd_t, virtd_initrc_exec_t) fs_search_tmpfs($1) admin_pattern($1, virt_tmpfs_type) diff --git a/vnstatd.if b/vnstatd.if index 137ac44..2a711fa 100644 --- a/vnstatd.if +++ b/vnstatd.if @@ -168,10 +168,7 @@ interface(`vnstatd_admin',` allow $1 vnstatd_t:process { ptrace signal_perms }; ps_process_pattern($1, vnstatd_t) - init_labeled_script_domtrans($1, vnstatd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 vnstatd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, vnstatd_t, vnstatd_initrc_exec_t) files_search_pids($1) admin_pattern($1, vnstatd_var_run_t) diff --git a/watchdog.if b/watchdog.if index 6461a77..c2b2dd4 100644 --- a/watchdog.if +++ b/watchdog.if @@ -26,10 +26,7 @@ interface(`watchdog_admin',` allow $1 watchdog_t:process { ptrace signal_perms }; ps_process_pattern($1, watchdog_t) - init_labeled_script_domtrans($1, watchdog_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 watchdog_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, watchdog_t, watchdog_initrc_exec_t) logging_search_logs($1) admin_pattern($1, watchdog_log_t) diff --git a/wdmd.if b/wdmd.if index 1e3aec0..f76d6e6 100644 --- a/wdmd.if +++ b/wdmd.if @@ -45,10 +45,7 @@ interface(`wdmd_admin',` allow $1 wdmd_t:process { ptrace signal_perms }; ps_process_pattern($1, wdmd_t) - init_labeled_script_domtrans($1, wdmd_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 wdmd_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, wdmd_t, wdmd_initrc_exec_t) files_search_pids($1) admin_pattern($1, wdmd_var_run_t) diff --git a/xfs.if b/xfs.if index 4570b86..609b464 100644 --- a/xfs.if +++ b/xfs.if @@ -84,10 +84,7 @@ interface(`xfs_admin',` allow $1 xfs_t:process { ptrace signal_perms }; ps_process_pattern($1, xfs_t) - init_labeled_script_domtrans($1, xfs_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 xfs_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, xfs_t, xfs_initrc_exec_t) files_search_pids($1) admin_pattern($1, xfs_var_run_t) diff --git a/zabbix.if b/zabbix.if index 29d87d7..5932ce4 100644 --- a/zabbix.if +++ b/zabbix.if @@ -146,10 +146,8 @@ interface(`zabbix_admin',` allow $1 { zabbix_t zabbix_agent_t }:process { ptrace signal_perms }; ps_process_pattern($1, { zabbix_t zabbix_agent_t }) - init_labeled_script_domtrans($1, { zabbix_agent_initrc_exec_t zabbix_initrc_exec_t }) - domain_system_change_exemption($1) - role_transition $2 { zabbix_agent_initrc_exec_t zabbix_initrc_exec_t } system_r; - allow $2 system_r; + init_manage_service_template($1, $2, zabbix_t, zabbix_initrc_exec_t) + init_manage_service_template($1, $2, zabbix_agent_t, zabbix_agent_initrc_exec_t) logging_list_logs($1) admin_pattern($1, zabbix_log_t) diff --git a/zarafa.if b/zarafa.if index 83b4ca5..240d160 100644 --- a/zarafa.if +++ b/zarafa.if @@ -152,10 +152,7 @@ interface(`zarafa_admin',` allow $1 zarafa_domain:process { ptrace signal_perms }; ps_process_pattern($1, zarafa_domain) - init_labeled_script_domtrans($1, zarafa_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 zarafa_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, zarafa_t, zarafa_initrc_exec_t) files_search_etc($1) admin_pattern($1, zarafa_etc_t) diff --git a/zebra.if b/zebra.if index 3416401..a011864 100644 --- a/zebra.if +++ b/zebra.if @@ -69,10 +69,7 @@ interface(`zebra_admin',` allow $1 zebra_t:process { ptrace signal_perms }; ps_process_pattern($1, zebra_t) - init_labeled_script_domtrans($1, zebra_initrc_exec_t) - domain_system_change_exemption($1) - role_transition $2 zebra_initrc_exec_t system_r; - allow $2 system_r; + init_manage_service_template($1, $2, zebra_t, zebra_initrc_exec_t) files_list_etc($1) admin_pattern($1, zebra_conf_t) -- 2.3.6