From: cgzones@googlemail.com (=?UTF-8?q?Christian=20G=C3=B6ttsche?=)
Date: Tue, 12 Sep 2017 11:54:23 +0200
Subject: [refpolicy] [PATCH] fakehwclock: update
Message-ID: <20170912095423.6154-1-cgzones@googlemail.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

- add initrc filecontext
- deprecate domtrans/run interface in favor of new admin interface

v2:

- deprecate interfaces instead of dropping
---
 fakehwclock.fc |  6 ++++--
 fakehwclock.if | 34 ++++++++++++++++++++++++++++++++++
 fakehwclock.te |  3 +++
 3 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/fakehwclock.fc b/fakehwclock.fc
index 0ab3bd8..85ea931 100644
--- a/fakehwclock.fc
+++ b/fakehwclock.fc
@@ -1,7 +1,9 @@
 /etc/fake-hwclock\.data				--	gen_context(system_u:object_r:fakehwclock_backup_t,s0)
 
-/usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
+/etc/rc\.d/init\.d/fake-hwclock			--	gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
 
-/usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
+/usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
 
 /usr/lib/systemd/system/fake-hwclock\.service	--	gen_context(system_u:object_r:fakehwclock_unit_t,s0)
+
+/usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
diff --git a/fakehwclock.if b/fakehwclock.if
index 24cc7d1..3e5afb1 100644
--- a/fakehwclock.if
+++ b/fakehwclock.if
@@ -11,6 +11,8 @@
 ## </param>
 #
 interface(`fakehwclock_domtrans',`
+	refpolicywarn(`$0($*) has been deprecated')
+
 	gen_require(`
 		type fakehwclock_t, fakehwclock_exec_t;
 	')
@@ -37,6 +39,8 @@ interface(`fakehwclock_domtrans',`
 ## </param>
 #
 interface(`fakehwclock_run',`
+	refpolicywarn(`$0($*) has been deprecated')
+
 	gen_require(`
 		attribute_role fakehwclock_roles;
 	')
@@ -44,3 +48,33 @@ interface(`fakehwclock_run',`
 	fakehwclock_domtrans($1)
 	roleattribute $2 fakehwclock_roles;
 ')
+
+########################################
+## <summary>
+##	All the rules required to
+##	administrate an fake-hwclock environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`fakehwclock_admin',`
+	gen_require(`
+		type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
+		type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
+	')
+
+	admin_process_pattern($1, fakehwclock_t)
+
+	init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
+
+	files_search_etc($1)
+	admin_pattern($1, fakehwclock_backup_t)
+')
diff --git a/fakehwclock.te b/fakehwclock.te
index 0a896a3..20bc5a0 100644
--- a/fakehwclock.te
+++ b/fakehwclock.te
@@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
 type fakehwclock_backup_t;
 files_type(fakehwclock_backup_t)
 
+type fakehwclock_initrc_exec_t;
+init_script_file(fakehwclock_initrc_exec_t)
+
 type fakehwclock_unit_t;
 init_unit_file(fakehwclock_unit_t)
 
-- 
2.14.1