policy/modules/services/radius.if

   1 ## <summary>RADIUS authentication and accounting server.</summary>
   2
   3 ########################################
   4 ## <summary>
   5 ##      Use radius over a UDP connection.  (Deprecated)
   6 ## </summary>
   7 ## <param name="domain">
   8 ##      <summary>
   9 ##      Domain allowed access.
  10 ##      </summary>
  11 ## </param>
  12 #
  13 interface(`radius_use',`
  14         refpolicywarn(`$0($*) has been deprecated.')
  15 ')
  16
  17 ########################################
  18 ## <summary>
  19 ##      All of the rules required to administrate
  20 ##      an radius environment
  21 ## </summary>
  22 ## <param name="domain">
  23 ##      <summary>
  24 ##      Domain allowed access.
  25 ##      </summary>
  26 ## </param>
  27 ## <param name="role">
  28 ##      <summary>
  29 ##      Role allowed access.
  30 ##      </summary>
  31 ## </param>
  32 ## <rolecap/>
  33 #
  34 interface(`radius_admin',`
  35         gen_require(`
  36                 type radiusd_t, radiusd_etc_t, radiusd_log_t;
  37                 type radiusd_etc_rw_t, radiusd_var_lib_t, radiusd_var_run_t;
  38                 type radiusd_initrc_exec_t;
  39         ')
  40
  41         allow $1 radiusd_t:process signal_perms;
  42         ps_process_pattern($1, radiusd_t)
  43         tunable_policy(`deny_ptrace',`',`
  44                 allow $1 radiusd_t:process ptrace;
  45         ')
  46
  47         init_labeled_script_domtrans($1, radiusd_initrc_exec_t)
  48         domain_system_change_exemption($1)
  49         role_transition $2 radiusd_initrc_exec_t system_r;
  50         allow $2 system_r;
  51
  52         files_list_etc($1)
  53         admin_pattern($1, radiusd_etc_t)
  54
  55         logging_list_logs($1)
  56         admin_pattern($1, radiusd_log_t)
  57
  58         admin_pattern($1, radiusd_etc_rw_t)
  59
  60         files_list_var_lib($1)
  61         admin_pattern($1, radiusd_var_lib_t)
  62
  63         files_list_pids($1)
  64         admin_pattern($1, radiusd_var_run_t)
  65 ')