From: pebenito@ieee.org (Chris PeBenito)
Date: Tue, 12 Sep 2017 19:53:40 -0400
Subject: [refpolicy] [PATCH] fakehwclock: update
In-Reply-To: <20170912095423.6154-1-cgzones@googlemail.com>
References: <20170912095423.6154-1-cgzones@googlemail.com>
Message-ID: <4b507232-c1e4-47cc-c483-53e63010d845@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 09/12/2017 05:54 AM, Christian G?ttsche via refpolicy wrote:
> - add initrc filecontext
> - deprecate domtrans/run interface in favor of new admin interface
> 
> v2:
> 
> - deprecate interfaces instead of dropping
> ---
>   fakehwclock.fc |  6 ++++--
>   fakehwclock.if | 34 ++++++++++++++++++++++++++++++++++
>   fakehwclock.te |  3 +++
>   3 files changed, 41 insertions(+), 2 deletions(-)
> 
> diff --git a/fakehwclock.fc b/fakehwclock.fc
> index 0ab3bd8..85ea931 100644
> --- a/fakehwclock.fc
> +++ b/fakehwclock.fc
> @@ -1,7 +1,9 @@
>   /etc/fake-hwclock\.data				--	gen_context(system_u:object_r:fakehwclock_backup_t,s0)
>   
> -/usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
> +/etc/rc\.d/init\.d/fake-hwclock			--	gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
>   
> -/usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
> +/usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
>   
>   /usr/lib/systemd/system/fake-hwclock\.service	--	gen_context(system_u:object_r:fakehwclock_unit_t,s0)
> +
> +/usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
> diff --git a/fakehwclock.if b/fakehwclock.if
> index 24cc7d1..3e5afb1 100644
> --- a/fakehwclock.if
> +++ b/fakehwclock.if
> @@ -11,6 +11,8 @@
>   ## </param>
>   #
>   interface(`fakehwclock_domtrans',`
> +	refpolicywarn(`$0($*) has been deprecated')
> +
>   	gen_require(`
>   		type fakehwclock_t, fakehwclock_exec_t;
>   	')
> @@ -37,6 +39,8 @@ interface(`fakehwclock_domtrans',`
>   ## </param>
>   #
>   interface(`fakehwclock_run',`
> +	refpolicywarn(`$0($*) has been deprecated')
> +
>   	gen_require(`
>   		attribute_role fakehwclock_roles;
>   	')
> @@ -44,3 +48,33 @@ interface(`fakehwclock_run',`
>   	fakehwclock_domtrans($1)
>   	roleattribute $2 fakehwclock_roles;
>   ')
> +
> +########################################
> +## <summary>
> +##	All the rules required to
> +##	administrate an fake-hwclock environment.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed to transition.
> +##	</summary>
> +## </param>
> +## <param name="role">
> +##	<summary>
> +##	Role allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`fakehwclock_admin',`
> +	gen_require(`
> +		type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
> +		type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
> +	')
> +
> +	admin_process_pattern($1, fakehwclock_t)
> +
> +	init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
> +
> +	files_search_etc($1)
> +	admin_pattern($1, fakehwclock_backup_t)
> +')
> diff --git a/fakehwclock.te b/fakehwclock.te
> index 0a896a3..20bc5a0 100644
> --- a/fakehwclock.te
> +++ b/fakehwclock.te
> @@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
>   type fakehwclock_backup_t;
>   files_type(fakehwclock_backup_t)
>   
> +type fakehwclock_initrc_exec_t;
> +init_script_file(fakehwclock_initrc_exec_t)
> +
>   type fakehwclock_unit_t;
>   init_unit_file(fakehwclock_unit_t)

Merged.

-- 
Chris PeBenito