From: cgzones@googlemail.com (=?UTF-8?q?Christian=20G=C3=B6ttsche?=)
Date: Sun, 10 Sep 2017 17:33:20 +0200
Subject: [refpolicy] [PATCH] fakehwclock: update
Message-ID: <20170910153320.8127-1-cgzones@googlemail.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

- add initrc filecontext
- drop domtrans/run interface in favor of new admin interface
---
 fakehwclock.fc |  2 ++
 fakehwclock.if | 37 +++++++++++--------------------------
 fakehwclock.te |  3 +++
 3 files changed, 16 insertions(+), 26 deletions(-)

diff --git a/fakehwclock.fc b/fakehwclock.fc
index 0ab3bd8..459bd5c 100644
--- a/fakehwclock.fc
+++ b/fakehwclock.fc
@@ -1,5 +1,7 @@
 /etc/fake-hwclock\.data				--	gen_context(system_u:object_r:fakehwclock_backup_t,s0)
 
+/etc/rc\.d/init\.d/fake-hwclock			--	gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
+
 /usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
 
 /usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
diff --git a/fakehwclock.if b/fakehwclock.if
index 24cc7d1..63afb52 100644
--- a/fakehwclock.if
+++ b/fakehwclock.if
@@ -2,28 +2,8 @@
 
 ########################################
 ## <summary>
-##	Execute a domain transition to run fake-hwclock.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed to transition.
-##	</summary>
-## </param>
-#
-interface(`fakehwclock_domtrans',`
-	gen_require(`
-		type fakehwclock_t, fakehwclock_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, fakehwclock_exec_t, fakehwclock_t)
-')
-
-########################################
-## <summary>
-##	Execute fake-hwclock in the fake-hwclock domain,
-##	and allow the specified role
-##	the fake-hwclock domain.
+##	All the rules required to
+##	administrate an fake-hwclock environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -36,11 +16,16 @@ interface(`fakehwclock_domtrans',`
 ##	</summary>
 ## </param>
 #
-interface(`fakehwclock_run',`
+interface(`fakehwclock_admin',`
 	gen_require(`
-		attribute_role fakehwclock_roles;
+		type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
+		type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
 	')
 
-	fakehwclock_domtrans($1)
-	roleattribute $2 fakehwclock_roles;
+	admin_process_pattern($1, fakehwclock_t)
+
+	init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
+
+	files_search_etc($1)
+	admin_pattern($1, fakehwclock_backup_t)
 ')
diff --git a/fakehwclock.te b/fakehwclock.te
index 0a896a3..20bc5a0 100644
--- a/fakehwclock.te
+++ b/fakehwclock.te
@@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
 type fakehwclock_backup_t;
 files_type(fakehwclock_backup_t)
 
+type fakehwclock_initrc_exec_t;
+init_script_file(fakehwclock_initrc_exec_t)
+
 type fakehwclock_unit_t;
 init_unit_file(fakehwclock_unit_t)
 
-- 
2.14.1