policy/modules/services/varnishd.if

   1 ## <summary>Varnishd http accelerator daemon</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      Execute varnishd in the varnishd domain.
   6 ## </summary>
   7 ## <param name="domain">
   8 ##      <summary>
   9 ##      Domain allowed to transition.
  10 ##      </summary>
  11 ## </param>
  12 #
  13 interface(`varnishd_domtrans',`
  14         gen_require(`
  15                 type varnishd_t, varnishd_exec_t;
  16         ')
  17
  18         corecmd_search_bin($1)
  19         domtrans_pattern($1, varnishd_exec_t, varnishd_t)
  20 ')
  21
  22 #######################################
  23 ## <summary>
  24 ##      Execute varnishd
  25 ## </summary>
  26 ## <param name="domain">
  27 ##      <summary>
  28 ##      Domain allowed access.
  29 ##      </summary>
  30 ## </param>
  31 #
  32 interface(`varnishd_exec',`
  33         gen_require(`
  34                 type varnishd_exec_t;
  35         ')
  36
  37         can_exec($1, varnishd_exec_t)
  38 ')
  39
  40 ######################################
  41 ## <summary>
  42 ##      Read varnishd configuration file.
  43 ## </summary>
  44 ## <param name="domain">
  45 ##      <summary>
  46 ##      Domain allowed access.
  47 ##      </summary>
  48 ## </param>
  49 #
  50 interface(`varnishd_read_config',`
  51         gen_require(`
  52                 type varnishd_etc_t;
  53         ')
  54
  55         files_search_etc($1)
  56         read_files_pattern($1, varnishd_etc_t, varnishd_etc_t)
  57 ')
  58
  59 #####################################
  60 ## <summary>
  61 ##  Read varnish lib files.
  62 ## </summary>
  63 ## <param name="domain">
  64 ##      <summary>
  65 ##      Domain allowed access.
  66 ##      </summary>
  67 ## </param>
  68 #
  69 interface(`varnishd_read_lib_files',`
  70         gen_require(`
  71                 type varnishd_var_lib_t;
  72         ')
  73
  74         files_search_var_lib($1)
  75         read_files_pattern($1, varnishd_var_lib_t, varnishd_var_lib_t)
  76 ')
  77
  78 #######################################
  79 ## <summary>
  80 ##      Read varnish logs.
  81 ## </summary>
  82 ## <param name="domain">
  83 ##      <summary>
  84 ##      Domain allowed access.
  85 ##      </summary>
  86 ## </param>
  87 #
  88 interface(`varnishd_read_log',`
  89         gen_require(`
  90                 type varnishlog_log_t;
  91         ')
  92
  93         logging_search_logs($1)
  94         read_files_pattern($1, varnishlog_log_t, varnishlog_log_t)
  95 ')
  96
  97 ######################################
  98 ## <summary>
  99 ##      Append varnish logs.
 100 ## </summary>
 101 ## <param name="domain">
 102 ##      <summary>
 103 ##      Domain allowed access.
 104 ##      </summary>
 105 ## </param>
 106 #
 107 interface(`varnishd_append_log',`
 108         gen_require(`
 109                 type varnishlog_log_t;
 110         ')
 111
 112         logging_search_logs($1)
 113         append_files_pattern($1, varnishlog_log_t, varnishlog_log_t)
 114 ')
 115
 116 #####################################
 117 ## <summary>
 118 ##      Manage varnish logs.
 119 ## </summary>
 120 ## <param name="domain">
 121 ##      <summary>
 122 ##      Domain allowed access.
 123 ##      </summary>
 124 ## </param>
 125 #
 126 interface(`varnishd_manage_log',`
 127         gen_require(`
 128                 type varnishlog_log_t;
 129         ')
 130
 131         logging_search_logs($1)
 132         manage_files_pattern($1, varnishlog_log_t, varnishlog_log_t)
 133 ')
 134
 135 ######################################
 136 ## <summary>
 137 ##      All of the rules required to administrate
 138 ##      an varnishlog environment
 139 ## </summary>
 140 ## <param name="domain">
 141 ##      <summary>
 142 ##      Domain allowed access.
 143 ##      </summary>
 144 ## </param>
 145 ## <param name="role">
 146 ##      <summary>
 147 ##      The role to be allowed to manage the varnishlog domain.
 148 ##      </summary>
 149 ## </param>
 150 ## <rolecap/>
 151 #
 152 interface(`varnishd_admin_varnishlog',`
 153         gen_require(`
 154                 type varnishlog_t, varnishlog_initrc_exec_t;
 155                 type varnishlog_var_run_t, varnishlog_log_t;
 156         ')
 157
 158         allow $1 varnishlog_t:process { ptrace signal_perms };
 159         ps_process_pattern($1, varnishlog_t)
 160
 161         init_labeled_script_domtrans($1, varnishlog_initrc_exec_t)
 162         domain_system_change_exemption($1)
 163         role_transition $2 varnishlog_initrc_exec_t system_r;
 164         allow $2 system_r;
 165
 166         files_search_pids($1)
 167         admin_pattern($1, varnishlog_var_run_t)
 168
 169         logging_list_logs($1)
 170         admin_pattern($1, varnishlog_log_t)
 171 ')
 172
 173 #######################################
 174 ## <summary>
 175 ##      All of the rules required to administrate
 176 ##      an varnishd environment
 177 ## </summary>
 178 ## <param name="domain">
 179 ##      <summary>
 180 ##      Domain allowed access.
 181 ##      </summary>
 182 ## </param>
 183 ## <param name="role">
 184 ##      <summary>
 185 ##      The role to be allowed to manage the varnishd domain.
 186 ##      </summary>
 187 ## </param>
 188 ## <rolecap/>
 189 #
 190 interface(`varnishd_admin',`
 191         gen_require(`
 192                 type varnishd_t, varnishd_var_lib_t, varnishd_etc_t;
 193                 type varnishd_var_run_t, varnishd_tmp_t;
 194                 type varnishd_initrc_exec_t;
 195         ')
 196
 197         allow $1 varnishd_t:process { ptrace signal_perms };
 198         ps_process_pattern($1, varnishd_t)
 199
 200         init_labeled_script_domtrans($1, varnishd_initrc_exec_t)
 201         domain_system_change_exemption($1)
 202         role_transition $2 varnishd_initrc_exec_t system_r;
 203         allow $2 system_r;
 204
 205         files_search_var_lib($1)
 206         admin_pattern($1, varnishd_var_lib_t)
 207
 208         files_search_etc($1)
 209         admin_pattern($1, varnishd_etc_t)
 210
 211         files_search_pids($1)
 212         admin_pattern($1, varnishd_var_run_t)
 213
 214         files_search_tmp($1)
 215         admin_pattern($1, varnishd_tmp_t)
 216 ')