Skip to contentSkip to conversation

fakehwclock: update

PATCH New Christian Göttsche 2 participants 2 messages Sep 12, 2017

lore
Share & tools
lore

Christian Göttsche

author
#0 lore raw

PATCH 1/1 fakehwclock: update

- add initrc filecontext
- deprecate domtrans/run interface in favor of new admin interface

v2:

- deprecate interfaces instead of dropping

---
 fakehwclock.fc |  6 ++++--
 fakehwclock.if | 34 ++++++++++++++++++++++++++++++++++
 fakehwclock.te |  3 +++
 3 files changed, 41 insertions(+), 2 deletions(-)
fakehwclock.fc +4 -2
index 0ab3bd8..85ea931 100644
@@ -1,7 +1,9 @@
 /etc/fake-hwclock\.data				--	gen_context(system_u:object_r:fakehwclock_backup_t,s0)
 
-/usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
+/etc/rc\.d/init\.d/fake-hwclock			--	gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
 
-/usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
+/usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
 
 /usr/lib/systemd/system/fake-hwclock\.service	--	gen_context(system_u:object_r:fakehwclock_unit_t,s0)
+
+/usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
fakehwclock.if +34 -0
index 24cc7d1..3e5afb1 100644
@@ -11,6 +11,8 @@
 ## </param>
 #
 interface(`fakehwclock_domtrans',`
+	refpolicywarn(`$0($*) has been deprecated')
+
 	gen_require(`
 		type fakehwclock_t, fakehwclock_exec_t;
 	')

@@ -37,6 +39,8 @@ interface(`fakehwclock_domtrans',`
 ## </param>
 #
 interface(`fakehwclock_run',`
+	refpolicywarn(`$0($*) has been deprecated')
+
 	gen_require(`
 		attribute_role fakehwclock_roles;
 	')

@@ -44,3 +48,33 @@ interface(`fakehwclock_run',`
 	fakehwclock_domtrans($1)
 	roleattribute $2 fakehwclock_roles;
 ')
+
+########################################
+## <summary>
+##	All the rules required to
+##	administrate an fake-hwclock environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`fakehwclock_admin',`
+	gen_require(`
+		type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
+		type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
+	')
+
+	admin_process_pattern($1, fakehwclock_t)
+
+	init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
+
+	files_search_etc($1)
+	admin_pattern($1, fakehwclock_backup_t)
+')
fakehwclock.te +3 -0
index 0a896a3..20bc5a0 100644
@@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
 type fakehwclock_backup_t;
 files_type(fakehwclock_backup_t)
 
+type fakehwclock_initrc_exec_t;
+init_script_file(fakehwclock_initrc_exec_t)
+
 type fakehwclock_unit_t;
 init_unit_file(fakehwclock_unit_t)
Signature · 1 line
2.14.1
#1 lore raw

PATCH 1/1 fakehwclock: update

Quoted 89 lines · Christian G?ttsche via refpolicy

- add initrc filecontext
- deprecate domtrans/run interface in favor of new admin interface

v2:

- deprecate interfaces instead of dropping

---
  fakehwclock.fc |  6 ++++--
  fakehwclock.if | 34 ++++++++++++++++++++++++++++++++++
  fakehwclock.te |  3 +++
  3 files changed, 41 insertions(+), 2 deletions(-)
fakehwclock.fc +4 -2
index 0ab3bd8..85ea931 100644
@@ -1,7 +1,9 @@
  /etc/fake-hwclock\.data				--	gen_context(system_u:object_r:fakehwclock_backup_t,s0)
 
-/usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
+/etc/rc\.d/init\.d/fake-hwclock			--	gen_context(system_u:object_r:fakehwclock_initrc_exec_t,s0)
 
-/usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
+/usr/bin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
 
  /usr/lib/systemd/system/fake-hwclock\.service	--	gen_context(system_u:object_r:fakehwclock_unit_t,s0)
+
+/usr/sbin/fake-hwclock				--	gen_context(system_u:object_r:fakehwclock_exec_t,s0)
fakehwclock.if +34 -0
index 24cc7d1..3e5afb1 100644
@@ -11,6 +11,8 @@
  ## </param>
  #
  interface(`fakehwclock_domtrans',`
+	refpolicywarn(`$0($*) has been deprecated')
+
  	gen_require(`
  		type fakehwclock_t, fakehwclock_exec_t;
  	')

@@ -37,6 +39,8 @@ interface(`fakehwclock_domtrans',`
  ## </param>
  #
  interface(`fakehwclock_run',`
+	refpolicywarn(`$0($*) has been deprecated')
+
  	gen_require(`
  		attribute_role fakehwclock_roles;
  	')

@@ -44,3 +48,33 @@ interface(`fakehwclock_run',`
  	fakehwclock_domtrans($1)
  	roleattribute $2 fakehwclock_roles;
  ')
+
+########################################
+## <summary>
+##	All the rules required to
+##	administrate an fake-hwclock environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`fakehwclock_admin',`
+	gen_require(`
+		type fakehwclock_t, fakehwclock_exec_t, fakehwclock_backup_t;
+		type fakehwclock_initrc_exec_t, fakehwclock_unit_t;
+	')
+
+	admin_process_pattern($1, fakehwclock_t)
+
+	init_startstop_service($1, $2, fakehwclock_t, fakehwclock_initrc_exec_t, fakehwclock_unit_t)
+
+	files_search_etc($1)
+	admin_pattern($1, fakehwclock_backup_t)
+')
fakehwclock.te +0 -0
index 0a896a3..20bc5a0 100644

fakehwclock.te role fakehwclock_roles types fakehwclock_t; · line 22

Quoted 8 lines
fakehwclock.te +3 -0
@@ -15,6 +15,9 @@ role fakehwclock_roles types fakehwclock_t;
  type fakehwclock_backup_t;
  files_type(fakehwclock_backup_t)
 
+type fakehwclock_initrc_exec_t;
+init_script_file(fakehwclock_initrc_exec_t)
+
  type fakehwclock_unit_t;
  init_unit_file(fakehwclock_unit_t)

Merged.

Signature · 1 line
Chris PeBenito