389-ds-base/selinux/dirsrv.if

## <summary>policy for dirsrv</summary>

########################################
## <summary>
##	Execute a domain transition to run dirsrv.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`dirsrv_domtrans',`
	gen_require(`
		type dirsrv_t, dirsrv_exec_t;
	')

	domain_auto_trans($1,dirsrv_exec_t,dirsrv_t)

	allow dirsrv_t $1:fd use;
	allow dirsrv_t $1:fifo_file rw_file_perms;
	allow dirsrv_t $1:process sigchld;
')


########################################
## <summary>
##  Allow caller to signal dirsrv.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_signal',`
	gen_require(`
		type dirsrv_t;
	')

	allow $1 dirsrv_t:process signal;
')


########################################
## <summary>
##      Send a null signal to dirsrv.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_signull',`
	gen_require(`
		type dirsrv_t;
	')

	allow $1 dirsrv_t:process signull;
')

#######################################
## <summary>
##      Allow a domain to manage dirsrv logs.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed access.
## </summary>
## </param>
#
interface(`dirsrv_manage_log',`
	gen_require(`
		type dirsrv_var_log_t;
	')

	allow $1 dirsrv_var_log_t:dir manage_dir_perms;
	allow $1 dirsrv_var_log_t:file manage_file_perms;
	allow $1 dirsrv_var_log_t:fifo_file manage_fifo_file_perms;
')

#######################################
## <summary>
##      Allow a domain to manage dirsrv /var/lib files.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed access.
## </summary>
## </param>
#
interface(`dirsrv_manage_var_lib',`
        gen_require(`
                type dirsrv_var_lib_t;
        ')
        allow $1 dirsrv_var_lib_t:dir manage_dir_perms;
        allow $1 dirsrv_var_lib_t:file manage_file_perms;
')

#######################################
## <summary>
##      Allow a domain to manage dirsrv /var/run files.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed access.
## </summary>
## </param>
#
interface(`dirsrv_manage_var_run',`
	gen_require(`
		type dirsrv_var_run_t;
	')
	allow $1 dirsrv_var_run_t:dir manage_dir_perms;
	allow $1 dirsrv_var_run_t:file manage_file_perms;
	allow $1 dirsrv_var_run_t:sock_file manage_file_perms;
	# Allow creating a dir in /var/run with this type
	files_pid_filetrans($1, dirsrv_var_run_t, dir)
')

#######################################
## <summary>
##      Allow a domain to read dirsrv /var/run files.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed access.
## </summary>
## </param>
#
interface(`dirsrv_read_var_run',`
        gen_require(`
                type dirsrv_var_run_t;
        ')
        allow $1 dirsrv_var_run_t:dir list_dir_perms;
        allow $1 dirsrv_var_run_t:file read_file_perms;
')

########################################
## <summary>
##      Manage dirsrv configuration files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_manage_config',`
	gen_require(`
		type dirsrv_config_t;
	')

	allow $1 dirsrv_config_t:dir manage_dir_perms;
	allow $1 dirsrv_config_t:file manage_file_perms;
')

########################################
## <summary>
##      Read and exec dirsrv lib files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_exec_lib',`
	gen_require(`
		type dirsrv_lib_t;
	')

	allow $1 dirsrv_lib_t:dir search_dir_perms;
	allow $1 dirsrv_lib_t:file exec_file_perms;
	# Not all platforms include ioctl in exec_file_perms
	allow $1 dirsrv_lib_t:file ioctl;
')

########################################
## <summary>
##      Read dirsrv share files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_read_share',`
	gen_require(`
		type dirsrv_share_t;
	')

	allow $1 dirsrv_share_t:dir list_dir_perms;
	allow $1 dirsrv_share_t:file read_file_perms;
	allow $1 dirsrv_share_t:lnk_file read;
')