policy/modules/system/init.if

   1 ## <summary>System initialization programs (init and init scripts).</summary>
   2
   3 ########################################
   4 ## <summary>
   5 ##      Create a file type used for init scripts.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      Create a file type used for init scripts.  It can not be
  10 ##      used in conjunction with init_script_domain(). These
  11 ##      script files are typically stored in the /etc/init.d directory.
  12 ##      </p>
  13 ##      <p>
  14 ##      Typically this is used to constrain what services an
  15 ##      admin can start/stop.  For example, a policy writer may want
  16 ##      to constrain a web administrator to only being able to
  17 ##      restart the web server, not other services.  This special type
  18 ##      will help address that goal.
  19 ##      </p>
  20 ##      <p>
  21 ##      This also makes the type usable for files; thus an
  22 ##      explicit call to files_type() is redundant.
  23 ##      </p>
  24 ## </desc>
  25 ## <param name="script_file">
  26 ##      <summary>
  27 ##      Type to be used for a script file.
  28 ##      </summary>
  29 ## </param>
  30 ## <infoflow type="none"/>
  31 #
  32 interface(`init_script_file',`
  33         gen_require(`
  34                 type initrc_t;
  35                 attribute init_script_file_type, init_run_all_scripts_domain;
  36         ')
  37
  38         typeattribute $1 init_script_file_type;
  39
  40         domain_entry_file(initrc_t, $1)
  41
  42         domtrans_pattern(init_run_all_scripts_domain, $1, initrc_t)
  43 ')
  44
  45 ########################################
  46 ## <summary>
  47 ##      Create a domain used for init scripts.
  48 ## </summary>
  49 ## <desc>
  50 ##      <p>
  51 ##      Create a domain used for init scripts.
  52 ##      Can not be used in conjunction with
  53 ##      init_script_file().
  54 ##      </p>
  55 ## </desc>
  56 ## <param name="domain">
  57 ##      <summary>
  58 ##      Type to be used as an init script domain.
  59 ##      </summary>
  60 ## </param>
  61 ## <param name="script_file">
  62 ##      <summary>
  63 ##      Type of the script file used as an entry point to this domain.
  64 ##      </summary>
  65 ## </param>
  66 #
  67 interface(`init_script_domain',`
  68         gen_require(`
  69                 attribute init_script_domain_type, init_script_file_type;
  70                 attribute init_run_all_scripts_domain;
  71         ')
  72
  73         typeattribute $1 init_script_domain_type;
  74         typeattribute $2 init_script_file_type;
  75
  76         domain_type($1)
  77         domain_entry_file($1, $2)
  78
  79         domtrans_pattern(init_run_all_scripts_domain, $2, $1)
  80 ')
  81
  82
  83 #######################################
  84 ## <summary>
  85 ##  Create a domain which can be started by init.
  86 ## </summary>
  87 ## <param name="domain">
  88 ##  <summary>
  89 ##  Type to be used as a domain.
  90 ##  </summary>
  91 ## </param>
  92 ## <param name="entry_point">
  93 ##  <summary>
  94 ##  Type of the program to be used as an entry point to this domain.
  95 ##  </summary>
  96 ## </param>
  97 #
  98 interface(`init_systemd_domain',`
  99     gen_require(`
 100         type init_t;
 101         role system_r;
 102     ')
 103
 104     domain_type($1)
 105     domain_entry_file($1,$2)
 106
 107     role system_r types $1;
 108
 109     tunable_policy(`init_systemd',`
 110         domtrans_pattern(init_t,$2,$1)
 111         allow init_t $1:unix_stream_socket create_stream_socket_perms;
 112         allow init_t $1:unix_dgram_socket create_socket_perms;
 113                 allow $1 init_t:unix_stream_socket ioctl;
 114         allow $1 init_t:unix_dgram_socket sendto;
 115     ')
 116 ')
 117
 118 ########################################
 119 ## <summary>
 120 ##      Create a domain which can be started by init.
 121 ## </summary>
 122 ## <param name="domain">
 123 ##      <summary>
 124 ##      Type to be used as a domain.
 125 ##      </summary>
 126 ## </param>
 127 ## <param name="entry_point">
 128 ##      <summary>
 129 ##      Type of the program to be used as an entry point to this domain.
 130 ##      </summary>
 131 ## </param>
 132 #
 133 interface(`init_domain',`
 134         gen_require(`
 135                 type init_t;
 136                 role system_r;
 137         ')
 138
 139         domain_type($1)
 140         domain_entry_file($1, $2)
 141
 142         role system_r types $1;
 143
 144         tunable_policy(`init_systemd',`', `
 145                 domtrans_pattern(init_t, $2, $1)
 146                 allow init_t $1:unix_stream_socket create_stream_socket_perms;
 147                 allow $1 init_t:unix_dgram_socket sendto;
 148         ')
 149
 150         ifdef(`hide_broken_symptoms',`
 151                 # RHEL4 systems seem to have a stray
 152                 # fds open from the initrd
 153                 ifdef(`distro_rhel4',`
 154                         kernel_dontaudit_use_fds($1)
 155                 ')
 156         ')
 157 ')
 158
 159 ########################################
 160 ## <summary>
 161 ##      Create a domain which can be started by init,
 162 ##      with a range transition.
 163 ## </summary>
 164 ## <param name="domain">
 165 ##      <summary>
 166 ##      Type to be used as a domain.
 167 ##      </summary>
 168 ## </param>
 169 ## <param name="entry_point">
 170 ##      <summary>
 171 ##      Type of the program to be used as an entry point to this domain.
 172 ##      </summary>
 173 ## </param>
 174 ## <param name="range">
 175 ##      <summary>
 176 ##      Range for the domain.
 177 ##      </summary>
 178 ## </param>
 179 #
 180 interface(`init_ranged_domain',`
 181         gen_require(`
 182                 type init_t;
 183         ')
 184
 185         init_domain($1, $2)
 186
 187         ifdef(`enable_mcs',`
 188                 range_transition init_t $2:process $3;
 189         ')
 190
 191         ifdef(`enable_mls',`
 192                 range_transition init_t $2:process $3;
 193                 mls_rangetrans_target($1)
 194         ')
 195 ')
 196
 197 ########################################
 198 ## <summary>
 199 ##      Create a domain for long running processes
 200 ##      (daemons/services) which are started by init scripts.
 201 ## </summary>
 202 ## <desc>
 203 ##      <p>
 204 ##      Create a domain for long running processes (daemons/services)
 205 ##      which are started by init scripts. Short running processes
 206 ##      should use the init_system_domain() interface instead.
 207 ##      Typically all long running processes started by an init
 208 ##      script (usually in /etc/init.d) will need to use this
 209 ##      interface.
 210 ##      </p>
 211 ##      <p>
 212 ##      The types will be made usable as a domain and file, making
 213 ##      calls to domain_type() and files_type() redundant.
 214 ##      </p>
 215 ##      <p>
 216 ##      If the process must also run in a specific MLS/MCS level,
 217 ##      the init_ranged_daemon_domain() should be used instead.
 218 ##      </p>
 219 ## </desc>
 220 ## <param name="domain">
 221 ##      <summary>
 222 ##      Type to be used as a daemon domain.
 223 ##      </summary>
 224 ## </param>
 225 ## <param name="entry_point">
 226 ##      <summary>
 227 ##      Type of the program to be used as an entry point to this domain.
 228 ##      </summary>
 229 ## </param>
 230 ## <infoflow type="read" weight="10"/>
 231 #
 232 interface(`init_daemon_domain',`
 233         gen_require(`
 234                 attribute direct_run_init, direct_init, direct_init_entry;
 235                 type initrc_t;
 236                 type init_t;
 237                 role system_r;
 238                 attribute daemon;
 239                 attribute initrc_transition_domain;
 240         ')
 241
 242         typeattribute $1 daemon;
 243
 244         domain_type($1)
 245         domain_entry_file($1, $2)
 246
 247         domtrans_pattern(initrc_t,$2,$1)
 248
 249         ifdef(`direct_sysadm_daemon',`
 250                 domtrans_pattern(direct_run_init, $2, $1)
 251
 252                 typeattribute $1 direct_init;
 253                 typeattribute $2 direct_init_entry;
 254
 255 #               userdom_dontaudit_use_user_terminals($1)
 256         ')
 257
 258         tunable_policy(`init_upstart || init_systemd',`
 259              # Handle upstart direct transition to a executable
 260              domtrans_pattern(init_t,$2,$1)
 261         ')
 262 ')
 263
 264 ########################################
 265 ## <summary>
 266 ##      Create a domain for long running processes
 267 ##      (daemons/services) which are started by init scripts,
 268 ##      running at a specified MLS/MCS range.
 269 ## </summary>
 270 ## <desc>
 271 ##      <p>
 272 ##      Create a domain for long running processes (daemons/services)
 273 ##      which are started by init scripts, running at a specified
 274 ##      MLS/MCS range. Short running processes
 275 ##      should use the init_ranged_system_domain() interface instead.
 276 ##      Typically all long running processes started by an init
 277 ##      script (usually in /etc/init.d) will need to use this
 278 ##      interface if they need to run in a specific MLS/MCS range.
 279 ##      </p>
 280 ##      <p>
 281 ##      The types will be made usable as a domain and file, making
 282 ##      calls to domain_type() and files_type() redundant.
 283 ##      </p>
 284 ##      <p>
 285 ##      If the policy build option TYPE is standard (MLS and MCS disabled),
 286 ##      this interface has the same behavior as init_daemon_domain().
 287 ##      </p>
 288 ## </desc>
 289 ## <param name="domain">
 290 ##      <summary>
 291 ##      Type to be used as a daemon domain.
 292 ##      </summary>
 293 ## </param>
 294 ## <param name="entry_point">
 295 ##      <summary>
 296 ##      Type of the program to be used as an entry point to this domain.
 297 ##      </summary>
 298 ## </param>
 299 ## <param name="range">
 300 ##      <summary>
 301 ##      MLS/MCS range for the domain.
 302 ##      </summary>
 303 ## </param>
 304 ## <infoflow type="read" weight="10"/>
 305 #
 306 interface(`init_ranged_daemon_domain',`
 307         gen_require(`
 308                 type initrc_t;
 309                 type init_t;
 310         ')
 311
 312 #       init_daemon_domain($1, $2)
 313
 314         ifdef(`enable_mcs',`
 315                 range_transition initrc_t $2:process $3;
 316                 range_transition init_t $2:process $3;
 317         ')
 318
 319         ifdef(`enable_mls',`
 320                 range_transition initrc_t $2:process $3;
 321                 mls_rangetrans_target($1)
 322                 range_transition init_t $2:process $3;
 323         ')
 324 ')
 325
 326 ########################################
 327 ## <summary>
 328 ##      Create a domain for short running processes
 329 ##      which are started by init scripts.
 330 ## </summary>
 331 ## <desc>
 332 ##      <p>
 333 ##      Create a domain for short running processes
 334 ##      which are started by init scripts. These are generally applications that
 335 ##      are used to initialize the system during boot.
 336 ##      Long running processes, such as daemons/services
 337 ##      should use the init_daemon_domain() interface instead.
 338 ##      Typically all short running processes started by an init
 339 ##      script (usually in /etc/init.d) will need to use this
 340 ##      interface.
 341 ##      </p>
 342 ##      <p>
 343 ##      The types will be made usable as a domain and file, making
 344 ##      calls to domain_type() and files_type() redundant.
 345 ##      </p>
 346 ##      <p>
 347 ##      If the process must also run in a specific MLS/MCS level,
 348 ##      the init_ranged_system_domain() should be used instead.
 349 ##      </p>
 350 ## </desc>
 351 ## <param name="domain">
 352 ##      <summary>
 353 ##      Type to be used as a system domain.
 354 ##      </summary>
 355 ## </param>
 356 ## <param name="entry_point">
 357 ##      <summary>
 358 ##      Type of the program to be used as an entry point to this domain.
 359 ##      </summary>
 360 ## </param>
 361 ## <infoflow type="read" weight="10"/>
 362 #
 363 interface(`init_system_domain',`
 364         gen_require(`
 365                 type init_t;
 366                 type initrc_t;
 367                 role system_r;
 368                 attribute initrc_transition_domain;
 369                 attribute systemprocess;
 370         ')
 371
 372         typeattribute $1 systemprocess;
 373         application_domain($1, $2)
 374
 375         role system_r types $1;
 376
 377         domtrans_pattern(initrc_t,$2,$1)
 378
 379         tunable_policy(`init_systemd',`
 380                 # Handle upstart/systemd direct transition to a executable
 381                 domtrans_pattern(init_t,$2,$1)
 382         ')
 383 ')
 384
 385 ########################################
 386 ## <summary>
 387 ##      Create a domain for short running processes
 388 ##      which are started by init scripts.
 389 ## </summary>
 390 ## <desc>
 391 ##      <p>
 392 ##      Create a domain for long running processes (daemons/services)
 393 ##      which are started by init scripts.
 394 ##      These are generally applications that
 395 ##      are used to initialize the system during boot.
 396 ##      Long running processes
 397 ##      should use the init_ranged_system_domain() interface instead.
 398 ##      Typically all short running processes started by an init
 399 ##      script (usually in /etc/init.d) will need to use this
 400 ##      interface if they need to run in a specific MLS/MCS range.
 401 ##      </p>
 402 ##      <p>
 403 ##      The types will be made usable as a domain and file, making
 404 ##      calls to domain_type() and files_type() redundant.
 405 ##      </p>
 406 ##      <p>
 407 ##      If the policy build option TYPE is standard (MLS and MCS disabled),
 408 ##      this interface has the same behavior as init_system_domain().
 409 ##      </p>
 410 ## </desc>
 411 ## <param name="domain">
 412 ##      <summary>
 413 ##      Type to be used as a system domain.
 414 ##      </summary>
 415 ## </param>
 416 ## <param name="entry_point">
 417 ##      <summary>
 418 ##      Type of the program to be used as an entry point to this domain.
 419 ##      </summary>
 420 ## </param>
 421 ## <param name="range">
 422 ##      <summary>
 423 ##      Range for the domain.
 424 ##      </summary>
 425 ## </param>
 426 ## <infoflow type="read" weight="10"/>
 427 #
 428 interface(`init_ranged_system_domain',`
 429         gen_require(`
 430                 type initrc_t;
 431                 type init_t;
 432         ')
 433
 434         init_system_domain($1, $2)
 435
 436         ifdef(`enable_mcs',`
 437                 range_transition initrc_t $2:process $3;
 438                 range_transition init_t $2:process $3;
 439         ')
 440
 441         ifdef(`enable_mls',`
 442                 range_transition initrc_t $2:process $3;
 443                 range_transition init_t $2:process $3;
 444         ')
 445 ')
 446
 447 ########################################
 448 ## <summary>
 449 ##      Execute init (/sbin/init) with a domain transition.
 450 ## </summary>
 451 ## <param name="domain">
 452 ##      <summary>
 453 ##      Domain allowed to transition.
 454 ##      </summary>
 455 ## </param>
 456 #
 457 interface(`init_domtrans',`
 458         gen_require(`
 459                 type init_t, init_exec_t;
 460         ')
 461
 462         domtrans_pattern($1, init_exec_t, init_t)
 463 ')
 464
 465 ########################################
 466 ## <summary>
 467 ##      Execute the init program in the caller domain.
 468 ## </summary>
 469 ## <param name="domain">
 470 ##      <summary>
 471 ##      Domain allowed access.
 472 ##      </summary>
 473 ## </param>
 474 ## <rolecap/>
 475 #
 476 interface(`init_exec',`
 477         gen_require(`
 478                 type init_exec_t;
 479         ')
 480
 481         corecmd_search_bin($1)
 482         can_exec($1, init_exec_t)
 483
 484         tunable_policy(`init_systemd',`
 485                 systemd_exec_systemctl($1)
 486         ')
 487 ')
 488
 489 ########################################
 490 ## <summary>
 491 ##      Get the process group of init.
 492 ## </summary>
 493 ## <param name="domain">
 494 ##      <summary>
 495 ##      Domain allowed access.
 496 ##      </summary>
 497 ## </param>
 498 #
 499 interface(`init_getpgid',`
 500         gen_require(`
 501                 type init_t;
 502         ')
 503
 504         allow $1 init_t:process getpgid;
 505 ')
 506
 507 ########################################
 508 ## <summary>
 509 ##      Send init a null signal.
 510 ## </summary>
 511 ## <param name="domain">
 512 ##      <summary>
 513 ##      Domain allowed access.
 514 ##      </summary>
 515 ## </param>
 516 #
 517 interface(`init_signull',`
 518         gen_require(`
 519                 type init_t;
 520         ')
 521
 522         allow $1 init_t:process signull;
 523 ')
 524
 525 ########################################
 526 ## <summary>
 527 ##      Send init a SIGCHLD signal.
 528 ## </summary>
 529 ## <param name="domain">
 530 ##      <summary>
 531 ##      Domain allowed access.
 532 ##      </summary>
 533 ## </param>
 534 #
 535 interface(`init_sigchld',`
 536         gen_require(`
 537                 type init_t;
 538         ')
 539
 540         allow $1 init_t:process sigchld;
 541 ')
 542
 543 ########################################
 544 ## <summary>
 545 ##      Send generic signals to init.
 546 ## </summary>
 547 ## <param name="domain">
 548 ##      <summary>
 549 ##      Domain allowed access.
 550 ##      </summary>
 551 ## </param>
 552 #
 553 interface(`init_signal',`
 554         gen_require(`
 555                 type init_t;
 556         ')
 557
 558         allow $1 init_t:process signal;
 559 ')
 560
 561 ########################################
 562 ## <summary>
 563 ##      Connect to init with a unix socket.
 564 ## </summary>
 565 ## <param name="domain">
 566 ##      <summary>
 567 ##      Domain allowed access.
 568 ##      </summary>
 569 ## </param>
 570 #
 571 interface(`init_stream_connect',`
 572         gen_require(`
 573                 type init_t, init_var_run_t;
 574         ')
 575
 576         files_search_pids($1)
 577         stream_connect_pattern($1, init_var_run_t, init_var_run_t, init_t)
 578 ')
 579
 580 #######################################
 581 ## <summary>
 582 ##  Dontaudit Connect to init with a unix socket.
 583 ## </summary>
 584 ## <param name="domain">
 585 ##  <summary>
 586 ##      Domain to not audit.
 587 ##  </summary>
 588 ## </param>
 589 #
 590 interface(`init_dontaudit_stream_connect',`
 591     gen_require(`
 592         type init_t;
 593     ')
 594
 595     dontaudit $1 init_t:unix_stream_socket connectto;
 596 ')
 597
 598 ########################################
 599 ## <summary>
 600 ##      Inherit and use file descriptors from init.
 601 ## </summary>
 602 ## <desc>
 603 ##      <p>
 604 ##      Allow the specified domain to inherit file
 605 ##      descriptors from the init program (process ID 1).
 606 ##      Typically the only file descriptors to be
 607 ##      inherited from init are for the console.
 608 ##      This does not allow the domain any access to
 609 ##      the object to which the file descriptors references.
 610 ##      </p>
 611 ##      <p>
 612 ##      Related interfaces:
 613 ##      </p>
 614 ##      <ul>
 615 ##              <li>init_dontaudit_use_fds()</li>
 616 ##              <li>term_dontaudit_use_console()</li>
 617 ##              <li>term_use_console()</li>
 618 ##      </ul>
 619 ##      <p>
 620 ##      Example usage:
 621 ##      </p>
 622 ##      <p>
 623 ##      init_use_fds(mydomain_t)
 624 ##      term_use_console(mydomain_t)
 625 ##      </p>
 626 ##      <p>
 627 ##      Normally, processes that can inherit these file
 628 ##      descriptors (usually services) write messages to the
 629 ##      system log instead of writing to the console.
 630 ##      Therefore, in many cases, this access should
 631 ##      dontaudited instead.
 632 ##      </p>
 633 ##      <p>
 634 ##      Example dontaudit usage:
 635 ##      </p>
 636 ##      <p>
 637 ##      init_dontaudit_use_fds(mydomain_t)
 638 ##      term_dontaudit_use_console(mydomain_t)
 639 ##      </p>
 640 ## </desc>
 641 ## <param name="domain">
 642 ##      <summary>
 643 ##      Domain allowed access.
 644 ##      </summary>
 645 ## </param>
 646 ## <infoflow type="read" weight="1"/>
 647 #
 648 interface(`init_use_fds',`
 649         gen_require(`
 650                 type init_t;
 651         ')
 652
 653         allow $1 init_t:fd use;
 654 ')
 655
 656 ########################################
 657 ## <summary>
 658 ##      Do not audit attempts to inherit file
 659 ##      descriptors from init.
 660 ## </summary>
 661 ## <param name="domain">
 662 ##      <summary>
 663 ##      Domain to not audit.
 664 ##      </summary>
 665 ## </param>
 666 #
 667 interface(`init_dontaudit_use_fds',`
 668         gen_require(`
 669                 type init_t;
 670         ')
 671
 672         dontaudit $1 init_t:fd use;
 673 ')
 674
 675 ########################################
 676 ## <summary>
 677 ##      Send UDP network traffic to init.  (Deprecated)
 678 ## </summary>
 679 ## <param name="domain">
 680 ##      <summary>
 681 ##      Domain allowed access.
 682 ##      </summary>
 683 ## </param>
 684 #
 685 interface(`init_udp_send',`
 686         refpolicywarn(`$0($*) has been deprecated.')
 687 ')
 688
 689 ########################################
 690 ## <summary>
 691 ##      Get the attributes of initctl.
 692 ## </summary>
 693 ## <param name="domain">
 694 ##      <summary>
 695 ##      Domain allowed access.
 696 ##      </summary>
 697 ## </param>
 698 #
 699 interface(`init_getattr_initctl',`
 700         gen_require(`
 701                 type initctl_t;
 702         ')
 703
 704         allow $1 initctl_t:fifo_file getattr;
 705 ')
 706
 707 ########################################
 708 ## <summary>
 709 ##      Do not audit attempts to get the
 710 ##      attributes of initctl.
 711 ## </summary>
 712 ## <param name="domain">
 713 ##      <summary>
 714 ##      Domain to not audit.
 715 ##      </summary>
 716 ## </param>
 717 #
 718 interface(`init_dontaudit_getattr_initctl',`
 719         gen_require(`
 720                 type initctl_t;
 721         ')
 722
 723         dontaudit $1 initctl_t:fifo_file getattr;
 724 ')
 725
 726 ########################################
 727 ## <summary>
 728 ##      Write to initctl.
 729 ## </summary>
 730 ## <param name="domain">
 731 ##      <summary>
 732 ##      Domain allowed access.
 733 ##      </summary>
 734 ## </param>
 735 #
 736 interface(`init_write_initctl',`
 737         gen_require(`
 738                 type initctl_t;
 739         ')
 740
 741         dev_list_all_dev_nodes($1)
 742         allow $1 initctl_t:fifo_file write;
 743 ')
 744
 745 ########################################
 746 ## <summary>
 747 ##      Use telinit (Read and write initctl).
 748 ## </summary>
 749 ## <param name="domain">
 750 ##      <summary>
 751 ##      Domain allowed access.
 752 ##      </summary>
 753 ## </param>
 754 ## <rolecap/>
 755 #
 756 interface(`init_telinit',`
 757         gen_require(`
 758                 type initctl_t;
 759         ')
 760
 761         corecmd_exec_bin($1)
 762
 763         dev_list_all_dev_nodes($1)
 764         allow $1 initctl_t:fifo_file rw_fifo_file_perms;
 765
 766         init_exec($1)
 767
 768         tunable_policy(`init_upstart || init_systemd',`
 769                 gen_require(`
 770                         type init_t;
 771                 ')
 772
 773                 ps_process_pattern($1, init_t)
 774                 allow $1 init_t:process signal;
 775                 # upstart uses a datagram socket instead of initctl pipe
 776                 allow $1 self:unix_dgram_socket create_socket_perms;
 777                 allow $1 init_t:unix_dgram_socket sendto;
 778                 #576913
 779                 allow $1 init_t:unix_stream_socket connectto;
 780         ')
 781 ')
 782
 783 ########################################
 784 ## <summary>
 785 ##      Read and write initctl.
 786 ## </summary>
 787 ## <param name="domain">
 788 ##      <summary>
 789 ##      Domain allowed access.
 790 ##      </summary>
 791 ## </param>
 792 #
 793 interface(`init_rw_initctl',`
 794         gen_require(`
 795                 type initctl_t;
 796         ')
 797
 798         dev_list_all_dev_nodes($1)
 799         allow $1 initctl_t:fifo_file rw_fifo_file_perms;
 800 ')
 801
 802 ########################################
 803 ## <summary>
 804 ##      Do not audit attempts to read and
 805 ##      write initctl.
 806 ## </summary>
 807 ## <param name="domain">
 808 ##      <summary>
 809 ##      Domain to not audit.
 810 ##      </summary>
 811 ## </param>
 812 #
 813 interface(`init_dontaudit_rw_initctl',`
 814         gen_require(`
 815                 type initctl_t;
 816         ')
 817
 818         dontaudit $1 initctl_t:fifo_file { read write };
 819 ')
 820
 821 ########################################
 822 ## <summary>
 823 ##      Make init scripts an entry point for
 824 ##      the specified domain.
 825 ## </summary>
 826 ## <param name="domain">
 827 ##      <summary>
 828 ##      Domain allowed access.
 829 ##      </summary>
 830 ## </param>
 831 # cjp: added for gentoo integrated run_init
 832 interface(`init_script_file_entry_type',`
 833         gen_require(`
 834                 type initrc_exec_t;
 835         ')
 836
 837         domain_entry_file($1, initrc_exec_t)
 838 ')
 839
 840 ########################################
 841 ## <summary>
 842 ##      Execute init scripts with a specified domain transition.
 843 ## </summary>
 844 ## <param name="domain">
 845 ##      <summary>
 846 ##      Domain allowed to transition.
 847 ##      </summary>
 848 ## </param>
 849 #
 850 interface(`init_spec_domtrans_script',`
 851         gen_require(`
 852                 type initrc_t;
 853                 attribute init_script_file_type;
 854         ')
 855
 856         files_list_etc($1)
 857         spec_domtrans_pattern($1, init_script_file_type, initrc_t)
 858
 859         ifdef(`enable_mcs',`
 860                 range_transition $1 init_script_file_type:process s0;
 861         ')
 862
 863         ifdef(`enable_mls',`
 864                 range_transition $1 init_script_file_type:process s0 - mls_systemhigh;
 865         ')
 866 ')
 867
 868 ########################################
 869 ## <summary>
 870 ##      Execute init scripts with an automatic domain transition.
 871 ## </summary>
 872 ## <param name="domain">
 873 ##      <summary>
 874 ##      Domain allowed to transition.
 875 ##      </summary>
 876 ## </param>
 877 #
 878 interface(`init_domtrans_script',`
 879         gen_require(`
 880                 type initrc_t;
 881                 attribute init_script_file_type;
 882                 attribute initrc_transition_domain;
 883         ')
 884         typeattribute $1 initrc_transition_domain;
 885
 886         files_list_etc($1)
 887         domtrans_pattern($1, init_script_file_type, initrc_t)
 888
 889         ifdef(`enable_mcs',`
 890                 range_transition $1 init_script_file_type:process s0;
 891         ')
 892
 893         ifdef(`enable_mls',`
 894                 range_transition $1 init_script_file_type:process s0 - mls_systemhigh;
 895         ')
 896 ')
 897
 898 ########################################
 899 ## <summary>
 900 ##      Execute a file in a bin directory
 901 ##      in the initrc_t domain
 902 ## </summary>
 903 ## <param name="domain">
 904 ##      <summary>
 905 ##      Domain allowed access.
 906 ##      </summary>
 907 ## </param>
 908 #
 909 interface(`init_bin_domtrans_spec',`
 910         gen_require(`
 911                 type initrc_t;
 912         ')
 913
 914         corecmd_bin_domtrans($1, initrc_t)
 915 ')
 916
 917 ########################################
 918 ## <summary>
 919 ##      Execute a init script in a specified domain.
 920 ## </summary>
 921 ## <desc>
 922 ##      <p>
 923 ##      Execute a init script in a specified domain.
 924 ##      </p>
 925 ##      <p>
 926 ##      No interprocess communication (signals, pipes,
 927 ##      etc.) is provided by this interface since
 928 ##      the domains are not owned by this module.
 929 ##      </p>
 930 ## </desc>
 931 ## <param name="source_domain">
 932 ##      <summary>
 933 ##      Domain allowed to transition.
 934 ##      </summary>
 935 ## </param>
 936 ## <param name="target_domain">
 937 ##      <summary>
 938 ##      Domain to transition to.
 939 ##      </summary>
 940 ## </param>
 941 # cjp: added for gentoo integrated run_init
 942 interface(`init_script_file_domtrans',`
 943         gen_require(`
 944                 type initrc_exec_t;
 945         ')
 946
 947         files_list_etc($1)
 948         domain_auto_trans($1, initrc_exec_t, $2)
 949 ')
 950
 951 ########################################
 952 ## <summary>
 953 ##      Transition to the init script domain
 954 ##      on a specified labeled init script.
 955 ## </summary>
 956 ## <param name="domain">
 957 ##      <summary>
 958 ##      Domain allowed to transition.
 959 ##      </summary>
 960 ## </param>
 961 ## <param name="init_script_file">
 962 ##      <summary>
 963 ##      Labeled init script file.
 964 ##      </summary>
 965 ## </param>
 966 #
 967 interface(`init_labeled_script_domtrans',`
 968         gen_require(`
 969                 type initrc_t;
 970                 attribute initrc_transition_domain;
 971         ')
 972
 973         typeattribute $1 initrc_transition_domain;
 974         # service script searches all filesystems via mountpoint
 975         fs_search_all($1)
 976         domtrans_pattern($1, $2, initrc_t)
 977         allow $1 $2:file ioctl;
 978         files_search_etc($1)
 979 ')
 980
 981 #########################################
 982 ## <summary>
 983 ##      Transition to the init script domain
 984 ##      for all labeled init script types
 985 ## </summary>
 986 ## <param name="domain">
 987 ##      <summary>
 988 ##      Domain allowed to transition.
 989 ##      </summary>
 990 ## </param>
 991 #
 992 interface(`init_all_labeled_script_domtrans',`
 993         gen_require(`
 994                 attribute init_script_file_type;
 995         ')
 996
 997         init_labeled_script_domtrans($1, init_script_file_type)
 998 ')
 999
1000 ########################################
1001 ## <summary>
1002 ##      Start and stop daemon programs directly.
1003 ## </summary>
1004 ## <desc>
1005 ##      <p>
1006 ##      Start and stop daemon programs directly
1007 ##      in the traditional "/etc/init.d/daemon start"
1008 ##      style, and do not require run_init.
1009 ##      </p>
1010 ## </desc>
1011 ## <param name="domain">
1012 ##      <summary>
1013 ##      Domain allowed access.
1014 ##      </summary>
1015 ## </param>
1016 ## <param name="role">
1017 ##      <summary>
1018 ##      The role to be performing this action.
1019 ##      </summary>
1020 ## </param>
1021 #
1022 interface(`init_run_daemon',`
1023         gen_require(`
1024                 attribute direct_run_init, direct_init, direct_init_entry;
1025                 role system_r;
1026         ')
1027
1028         typeattribute $1 direct_run_init;
1029         role_transition $2 direct_init_entry system_r;
1030 ')
1031
1032 ########################################
1033 ## <summary>
1034 ##      Read the process state (/proc/pid) of init.
1035 ## </summary>
1036 ## <param name="domain">
1037 ##      <summary>
1038 ##      Domain allowed access.
1039 ##      </summary>
1040 ## </param>
1041 #
1042 interface(`init_read_state',`
1043         gen_require(`
1044                 type init_t;
1045         ')
1046
1047         allow $1 init_t:dir search_dir_perms;
1048         allow $1 init_t:file read_file_perms;
1049         allow $1 init_t:lnk_file read_lnk_file_perms;
1050 ')
1051
1052 ########################################
1053 ## <summary>
1054 ##      Ptrace init
1055 ## </summary>
1056 ## <param name="domain">
1057 ##      <summary>
1058 ##      Domain allowed access.
1059 ##      </summary>
1060 ## </param>
1061 ## <rolecap/>
1062 #
1063 interface(`init_ptrace',`
1064         gen_require(`
1065                 type init_t;
1066         ')
1067
1068         allow $1 init_t:process ptrace;
1069 ')
1070
1071 ########################################
1072 ## <summary>
1073 ##      Write an init script unnamed pipe.
1074 ## </summary>
1075 ## <param name="domain">
1076 ##      <summary>
1077 ##      Domain allowed access.
1078 ##      </summary>
1079 ## </param>
1080 #
1081 interface(`init_write_script_pipes',`
1082         gen_require(`
1083                 type initrc_t;
1084         ')
1085
1086         allow $1 initrc_t:fifo_file write;
1087 ')
1088
1089 ########################################
1090 ## <summary>
1091 ##      Get the attribute of init script entrypoint files.
1092 ## </summary>
1093 ## <param name="domain">
1094 ##      <summary>
1095 ##      Domain allowed access.
1096 ##      </summary>
1097 ## </param>
1098 #
1099 interface(`init_getattr_script_files',`
1100         gen_require(`
1101                 type initrc_exec_t;
1102         ')
1103
1104         files_list_etc($1)
1105         allow $1 initrc_exec_t:file getattr;
1106 ')
1107
1108 ########################################
1109 ## <summary>
1110 ##      Read init scripts.
1111 ## </summary>
1112 ## <param name="domain">
1113 ##      <summary>
1114 ##      Domain allowed access.
1115 ##      </summary>
1116 ## </param>
1117 #
1118 interface(`init_read_script_files',`
1119         gen_require(`
1120                 type initrc_exec_t;
1121         ')
1122
1123         files_search_etc($1)
1124         allow $1 initrc_exec_t:file read_file_perms;
1125 ')
1126
1127 ########################################
1128 ## <summary>
1129 ##      Execute init scripts in the caller domain.
1130 ## </summary>
1131 ## <param name="domain">
1132 ##      <summary>
1133 ##      Domain allowed access.
1134 ##      </summary>
1135 ## </param>
1136 #
1137 interface(`init_exec_script_files',`
1138         gen_require(`
1139                 type initrc_exec_t;
1140         ')
1141
1142         files_list_etc($1)
1143         can_exec($1, initrc_exec_t)
1144 ')
1145
1146 ########################################
1147 ## <summary>
1148 ##      Get the attribute of all init script entrypoint files.
1149 ## </summary>
1150 ## <param name="domain">
1151 ##      <summary>
1152 ##      Domain allowed access.
1153 ##      </summary>
1154 ## </param>
1155 #
1156 interface(`init_getattr_all_script_files',`
1157         gen_require(`
1158                 attribute init_script_file_type;
1159         ')
1160
1161         files_list_etc($1)
1162         allow $1 init_script_file_type:file getattr;
1163 ')
1164
1165 ########################################
1166 ## <summary>
1167 ##      Read all init script files.
1168 ## </summary>
1169 ## <param name="domain">
1170 ##      <summary>
1171 ##      Domain allowed access.
1172 ##      </summary>
1173 ## </param>
1174 #
1175 interface(`init_read_all_script_files',`
1176         gen_require(`
1177                 attribute init_script_file_type;
1178         ')
1179
1180         files_search_etc($1)
1181         allow $1 init_script_file_type:file read_file_perms;
1182 ')
1183
1184 #######################################
1185 ## <summary>
1186 ##      Dontaudit getattr all init script files.
1187 ## </summary>
1188 ## <param name="domain">
1189 ##      <summary>
1190 ##      Domain to not audit.
1191 ##      </summary>
1192 ## </param>
1193 #
1194 interface(`init_dontaudit_getattr_all_script_files',`
1195         gen_require(`
1196                 attribute init_script_file_type;
1197         ')
1198
1199         dontaudit $1 init_script_file_type:file getattr;
1200 ')
1201
1202 #######################################
1203 ## <summary>
1204 ##      Dontaudit read all init script files.
1205 ## </summary>
1206 ## <param name="domain">
1207 ##      <summary>
1208 ##      Domain to not audit.
1209 ##      </summary>
1210 ## </param>
1211 #
1212 interface(`init_dontaudit_read_all_script_files',`
1213         gen_require(`
1214                 attribute init_script_file_type;
1215         ')
1216
1217         dontaudit $1 init_script_file_type:file read_file_perms;
1218 ')
1219
1220 ########################################
1221 ## <summary>
1222 ##      Execute all init scripts in the caller domain.
1223 ## </summary>
1224 ## <param name="domain">
1225 ##      <summary>
1226 ##      Domain allowed access.
1227 ##      </summary>
1228 ## </param>
1229 #
1230 interface(`init_exec_all_script_files',`
1231         gen_require(`
1232                 attribute init_script_file_type;
1233         ')
1234
1235         files_list_etc($1)
1236         can_exec($1, init_script_file_type)
1237 ')
1238
1239 ########################################
1240 ## <summary>
1241 ##      Read the process state (/proc/pid) of the init scripts.
1242 ## </summary>
1243 ## <param name="domain">
1244 ##      <summary>
1245 ##      Domain allowed access.
1246 ##      </summary>
1247 ## </param>
1248 #
1249 interface(`init_read_script_state',`
1250         gen_require(`
1251                 type initrc_t;
1252         ')
1253
1254         kernel_search_proc($1)
1255         ps_process_pattern($1, initrc_t)
1256 ')
1257
1258 ########################################
1259 ## <summary>
1260 ##      Inherit and use init script file descriptors.
1261 ## </summary>
1262 ## <param name="domain">
1263 ##      <summary>
1264 ##      Domain allowed access.
1265 ##      </summary>
1266 ## </param>
1267 #
1268 interface(`init_use_script_fds',`
1269         gen_require(`
1270                 type initrc_t;
1271         ')
1272
1273         allow $1 initrc_t:fd use;
1274 ')
1275
1276 ########################################
1277 ## <summary>
1278 ##      Do not audit attempts to inherit
1279 ##      init script file descriptors.
1280 ## </summary>
1281 ## <param name="domain">
1282 ##      <summary>
1283 ##      Domain to not audit.
1284 ##      </summary>
1285 ## </param>
1286 #
1287 interface(`init_dontaudit_use_script_fds',`
1288         gen_require(`
1289                 type initrc_t;
1290         ')
1291
1292         dontaudit $1 initrc_t:fd use;
1293 ')
1294
1295 ########################################
1296 ## <summary>
1297 ##      Search init script keys.
1298 ## </summary>
1299 ## <param name="domain">
1300 ##      <summary>
1301 ##      Domain allowed access.
1302 ##      </summary>
1303 ## </param>
1304 #
1305 interface(`init_search_script_keys',`
1306         gen_require(`
1307                 type initrc_t;
1308         ')
1309
1310         allow $1 initrc_t:key search;
1311 ')
1312
1313 ########################################
1314 ## <summary>
1315 ##      Get the process group ID of init scripts.
1316 ## </summary>
1317 ## <param name="domain">
1318 ##      <summary>
1319 ##      Domain allowed access.
1320 ##      </summary>
1321 ## </param>
1322 #
1323 interface(`init_getpgid_script',`
1324         gen_require(`
1325                 type initrc_t;
1326         ')
1327
1328         allow $1 initrc_t:process getpgid;
1329 ')
1330
1331 ########################################
1332 ## <summary>
1333 ##      Send SIGCHLD signals to init scripts.
1334 ## </summary>
1335 ## <param name="domain">
1336 ##      <summary>
1337 ##      Domain allowed access.
1338 ##      </summary>
1339 ## </param>
1340 #
1341 interface(`init_sigchld_script',`
1342         gen_require(`
1343                 type initrc_t;
1344         ')
1345
1346         allow $1 initrc_t:process sigchld;
1347 ')
1348
1349 ########################################
1350 ## <summary>
1351 ##      Send generic signals to init scripts.
1352 ## </summary>
1353 ## <param name="domain">
1354 ##      <summary>
1355 ##      Domain allowed access.
1356 ##      </summary>
1357 ## </param>
1358 #
1359 interface(`init_signal_script',`
1360         gen_require(`
1361                 type initrc_t;
1362         ')
1363
1364         allow $1 initrc_t:process signal;
1365 ')
1366
1367 ########################################
1368 ## <summary>
1369 ##      Send null signals to init scripts.
1370 ## </summary>
1371 ## <param name="domain">
1372 ##      <summary>
1373 ##      Domain allowed access.
1374 ##      </summary>
1375 ## </param>
1376 #
1377 interface(`init_signull_script',`
1378         gen_require(`
1379                 type initrc_t;
1380         ')
1381
1382         allow $1 initrc_t:process signull;
1383 ')
1384
1385 ########################################
1386 ## <summary>
1387 ##      Read and write init script unnamed pipes.
1388 ## </summary>
1389 ## <param name="domain">
1390 ##      <summary>
1391 ##      Domain allowed access.
1392 ##      </summary>
1393 ## </param>
1394 #
1395 interface(`init_rw_script_pipes',`
1396         gen_require(`
1397                 type initrc_t;
1398         ')
1399
1400         allow $1 initrc_t:fifo_file { read write };
1401 ')
1402
1403 ########################################
1404 ## <summary>
1405 ##      Send UDP network traffic to init scripts.  (Deprecated)
1406 ## </summary>
1407 ## <param name="domain">
1408 ##      <summary>
1409 ##      Domain allowed access.
1410 ##      </summary>
1411 ## </param>
1412 #
1413 interface(`init_udp_send_script',`
1414         refpolicywarn(`$0($*) has been deprecated.')
1415 ')
1416
1417 ########################################
1418 ## <summary>
1419 ##      Allow the specified domain to connect to
1420 ##      init scripts with a unix socket.
1421 ## </summary>
1422 ## <param name="domain">
1423 ##      <summary>
1424 ##      Domain allowed access.
1425 ##      </summary>
1426 ## </param>
1427 #
1428 interface(`init_stream_connect_script',`
1429         gen_require(`
1430                 type initrc_t;
1431         ')
1432
1433         allow $1 initrc_t:unix_stream_socket connectto;
1434 ')
1435
1436 ########################################
1437 ## <summary>
1438 ##      Allow the specified domain to read/write to
1439 ##      init scripts with a unix domain stream sockets.
1440 ## </summary>
1441 ## <param name="domain">
1442 ##      <summary>
1443 ##      Domain allowed access.
1444 ##      </summary>
1445 ## </param>
1446 #
1447 interface(`init_rw_script_stream_sockets',`
1448         gen_require(`
1449                 type initrc_t;
1450         ')
1451
1452         allow $1 initrc_t:unix_stream_socket rw_socket_perms;
1453 ')
1454
1455 ########################################
1456 ## <summary>
1457 ##      Dont audit the specified domain connecting to
1458 ##      init scripts with a unix domain stream socket.
1459 ## </summary>
1460 ## <param name="domain">
1461 ##      <summary>
1462 ##      Domain to not audit.
1463 ##      </summary>
1464 ## </param>
1465 #
1466 interface(`init_dontaudit_stream_connect_script',`
1467         gen_require(`
1468                 type initrc_t;
1469         ')
1470
1471         dontaudit $1 initrc_t:unix_stream_socket connectto;
1472 ')
1473 ########################################
1474 ## <summary>
1475 ##      Send messages to init scripts over dbus.
1476 ## </summary>
1477 ## <param name="domain">
1478 ##      <summary>
1479 ##      Domain allowed access.
1480 ##      </summary>
1481 ## </param>
1482 #
1483 interface(`init_dbus_send_script',`
1484         gen_require(`
1485                 type initrc_t;
1486                 class dbus send_msg;
1487         ')
1488
1489         allow $1 initrc_t:dbus send_msg;
1490 ')
1491
1492 ########################################
1493 ## <summary>
1494 ##      Send and receive messages from
1495 ##      init over dbus.
1496 ## </summary>
1497 ## <param name="domain">
1498 ##      <summary>
1499 ##      Domain allowed access.
1500 ##      </summary>
1501 ## </param>
1502 #
1503 interface(`init_dbus_chat',`
1504         gen_require(`
1505                 type init_t;
1506                 class dbus send_msg;
1507         ')
1508
1509         allow $1 init_t:dbus send_msg;
1510         allow init_t $1:dbus send_msg;
1511 ')
1512
1513 ########################################
1514 ## <summary>
1515 ##      Send and receive messages from
1516 ##      init scripts over dbus.
1517 ## </summary>
1518 ## <param name="domain">
1519 ##      <summary>
1520 ##      Domain allowed access.
1521 ##      </summary>
1522 ## </param>
1523 #
1524 interface(`init_dbus_chat_script',`
1525         gen_require(`
1526                 type initrc_t;
1527                 class dbus send_msg;
1528         ')
1529
1530         allow $1 initrc_t:dbus send_msg;
1531         allow initrc_t $1:dbus send_msg;
1532 ')
1533
1534 ########################################
1535 ## <summary>
1536 ##      Read and write the init script pty.
1537 ## </summary>
1538 ## <desc>
1539 ##      <p>
1540 ##      Read and write the init script pty.  This
1541 ##      pty is generally opened by the open_init_pty
1542 ##      portion of the run_init program so that the
1543 ##      daemon does not require direct access to
1544 ##      the administrator terminal.
1545 ##      </p>
1546 ## </desc>
1547 ## <param name="domain">
1548 ##      <summary>
1549 ##      Domain allowed access.
1550 ##      </summary>
1551 ## </param>
1552 #
1553 interface(`init_use_script_ptys',`
1554         gen_require(`
1555                 type initrc_devpts_t;
1556         ')
1557
1558         term_list_ptys($1)
1559         allow $1 initrc_devpts_t:chr_file { rw_term_perms lock append };
1560 ')
1561
1562 ########################################
1563 ## <summary>
1564 ##      Do not audit attempts to read and
1565 ##      write the init script pty.
1566 ## </summary>
1567 ## <param name="domain">
1568 ##      <summary>
1569 ##      Domain to not audit.
1570 ##      </summary>
1571 ## </param>
1572 #
1573 interface(`init_dontaudit_use_script_ptys',`
1574         gen_require(`
1575                 type initrc_devpts_t;
1576         ')
1577
1578         dontaudit $1 initrc_devpts_t:chr_file { rw_term_perms lock append };
1579 ')
1580
1581 ########################################
1582 ## <summary>
1583 ##      Get the attributes of init script
1584 ##      status files.
1585 ## </summary>
1586 ## <param name="domain">
1587 ##      <summary>
1588 ##      Domain allowed access.
1589 ##      </summary>
1590 ## </param>
1591 #
1592 interface(`init_getattr_script_status_files',`
1593         gen_require(`
1594                 type initrc_state_t;
1595         ')
1596
1597         getattr_files_pattern($1, initrc_state_t, initrc_state_t)
1598 ')
1599
1600 ########################################
1601 ## <summary>
1602 ##      Manage init script
1603 ##      status files.
1604 ## </summary>
1605 ## <param name="domain">
1606 ##      <summary>
1607 ##      Domain allowed access.
1608 ##      </summary>
1609 ## </param>
1610 #
1611 interface(`init_manage_script_status_files',`
1612         gen_require(`
1613                 type initrc_state_t;
1614         ')
1615
1616         manage_files_pattern($1, initrc_state_t, initrc_state_t)
1617 ')
1618
1619 ########################################
1620 ## <summary>
1621 ##      Do not audit attempts to read init script
1622 ##      status files.
1623 ## </summary>
1624 ## <param name="domain">
1625 ##      <summary>
1626 ##      Domain to not audit.
1627 ##      </summary>
1628 ## </param>
1629 #
1630 interface(`init_dontaudit_read_script_status_files',`
1631         gen_require(`
1632                 type initrc_state_t;
1633         ')
1634
1635         dontaudit $1 initrc_state_t:dir search_dir_perms;
1636         dontaudit $1 initrc_state_t:file read_file_perms;
1637 ')
1638
1639 ########################################
1640 ## <summary>
1641 ##      Read init script temporary data.
1642 ## </summary>
1643 ## <param name="domain">
1644 ##      <summary>
1645 ##      Domain allowed access.
1646 ##      </summary>
1647 ## </param>
1648 #
1649 interface(`init_read_script_tmp_files',`
1650         gen_require(`
1651                 type initrc_tmp_t;
1652         ')
1653
1654         files_search_tmp($1)
1655         read_files_pattern($1, initrc_tmp_t, initrc_tmp_t)
1656 ')
1657
1658 ########################################
1659 ## <summary>
1660 ##      Read and write init script temporary data.
1661 ## </summary>
1662 ## <param name="domain">
1663 ##      <summary>
1664 ##      Domain allowed access.
1665 ##      </summary>
1666 ## </param>
1667 #
1668 interface(`init_rw_script_tmp_files',`
1669         gen_require(`
1670                 type initrc_tmp_t;
1671         ')
1672
1673         files_search_tmp($1)
1674         rw_files_pattern($1, initrc_tmp_t, initrc_tmp_t)
1675 ')
1676
1677 ########################################
1678 ## <summary>
1679 ##      Read and write init script inherited temporary data.
1680 ## </summary>
1681 ## <param name="domain">
1682 ##      <summary>
1683 ##      Domain allowed access.
1684 ##      </summary>
1685 ## </param>
1686 #
1687 interface(`init_rw_inherited_script_tmp_files',`
1688         gen_require(`
1689                 type initrc_tmp_t;
1690         ')
1691
1692         allow $1 initrc_tmp_t:file rw_inherited_file_perms;
1693 ')
1694
1695 ########################################
1696 ## <summary>
1697 ##      Create files in a init script
1698 ##      temporary data directory.
1699 ## </summary>
1700 ## <param name="domain">
1701 ##      <summary>
1702 ##      Domain allowed access.
1703 ##      </summary>
1704 ## </param>
1705 ## <param name="file_type">
1706 ##      <summary>
1707 ##      The type of the object to be created
1708 ##      </summary>
1709 ## </param>
1710 ## <param name="object_class">
1711 ##      <summary>
1712 ##      The object class.
1713 ##      </summary>
1714 ## </param>
1715 #
1716 interface(`init_script_tmp_filetrans',`
1717         gen_require(`
1718                 type initrc_tmp_t;
1719         ')
1720
1721         files_search_tmp($1)
1722         filetrans_pattern($1, initrc_tmp_t, $2, $3)
1723 ')
1724
1725 ########################################
1726 ## <summary>
1727 ##      Get the attributes of init script process id files.
1728 ## </summary>
1729 ## <param name="domain">
1730 ##      <summary>
1731 ##      Domain allowed access.
1732 ##      </summary>
1733 ## </param>
1734 #
1735 interface(`init_getattr_utmp',`
1736         gen_require(`
1737                 type initrc_var_run_t;
1738         ')
1739
1740         allow $1 initrc_var_run_t:file getattr;
1741 ')
1742
1743 ########################################
1744 ## <summary>
1745 ##      Read utmp.
1746 ## </summary>
1747 ## <param name="domain">
1748 ##      <summary>
1749 ##      Domain allowed access.
1750 ##      </summary>
1751 ## </param>
1752 #
1753 interface(`init_read_utmp',`
1754         gen_require(`
1755                 type initrc_var_run_t;
1756         ')
1757
1758         files_list_pids($1)
1759         allow $1 initrc_var_run_t:file read_file_perms;
1760 ')
1761
1762 ########################################
1763 ## <summary>
1764 ##      Do not audit attempts to write utmp.
1765 ## </summary>
1766 ## <param name="domain">
1767 ##      <summary>
1768 ##      Domain to not audit.
1769 ##      </summary>
1770 ## </param>
1771 #
1772 interface(`init_dontaudit_write_utmp',`
1773         gen_require(`
1774                 type initrc_var_run_t;
1775         ')
1776
1777         dontaudit $1 initrc_var_run_t:file { write lock };
1778 ')
1779
1780 ########################################
1781 ## <summary>
1782 ##      Write to utmp.
1783 ## </summary>
1784 ## <param name="domain">
1785 ##      <summary>
1786 ##      Domain allowed access.
1787 ##      </summary>
1788 ## </param>
1789 #
1790 interface(`init_write_utmp',`
1791         gen_require(`
1792                 type initrc_var_run_t;
1793         ')
1794
1795         files_list_pids($1)
1796         allow $1 initrc_var_run_t:file { getattr open write };
1797 ')
1798
1799 ########################################
1800 ## <summary>
1801 ##      Do not audit attempts to lock
1802 ##      init script pid files.
1803 ## </summary>
1804 ## <param name="domain">
1805 ##      <summary>
1806 ##      Domain to not audit.
1807 ##      </summary>
1808 ## </param>
1809 #
1810 interface(`init_dontaudit_lock_utmp',`
1811         gen_require(`
1812                 type initrc_var_run_t;
1813         ')
1814
1815         dontaudit $1 initrc_var_run_t:file lock;
1816 ')
1817
1818 ########################################
1819 ## <summary>
1820 ##      Read and write utmp.
1821 ## </summary>
1822 ## <param name="domain">
1823 ##      <summary>
1824 ##      Domain allowed access.
1825 ##      </summary>
1826 ## </param>
1827 #
1828 interface(`init_rw_utmp',`
1829         gen_require(`
1830                 type initrc_var_run_t;
1831         ')
1832
1833         files_list_pids($1)
1834         allow $1 initrc_var_run_t:file rw_file_perms;
1835 ')
1836
1837 ########################################
1838 ## <summary>
1839 ##      Do not audit attempts to read and write utmp.
1840 ## </summary>
1841 ## <param name="domain">
1842 ##      <summary>
1843 ##      Domain to not audit.
1844 ##      </summary>
1845 ## </param>
1846 #
1847 interface(`init_dontaudit_rw_utmp',`
1848         gen_require(`
1849                 type initrc_var_run_t;
1850         ')
1851
1852         dontaudit $1 initrc_var_run_t:file rw_file_perms;
1853 ')
1854
1855 ########################################
1856 ## <summary>
1857 ##      Create, read, write, and delete utmp.
1858 ## </summary>
1859 ## <param name="domain">
1860 ##      <summary>
1861 ##      Domain allowed access.
1862 ##      </summary>
1863 ## </param>
1864 #
1865 interface(`init_manage_utmp',`
1866         gen_require(`
1867                 type initrc_var_run_t;
1868         ')
1869
1870         files_search_pids($1)
1871         allow $1 initrc_var_run_t:file manage_file_perms;
1872 ')
1873
1874 ########################################
1875 ## <summary>
1876 ##      Create files in /var/run with the
1877 ##      utmp file type.
1878 ## </summary>
1879 ## <param name="domain">
1880 ##      <summary>
1881 ##      Domain allowed access.
1882 ##      </summary>
1883 ## </param>
1884 #
1885 interface(`init_pid_filetrans_utmp',`
1886         gen_require(`
1887                 type initrc_var_run_t;
1888         ')
1889
1890         files_pid_filetrans($1, initrc_var_run_t, file)
1891 ')
1892
1893 ######################################
1894 ## <summary>
1895 ##  Allow search  directory in the /run/systemd directory.
1896 ## </summary>
1897 ## <param name="domain">
1898 ##  <summary>
1899 ##  Domain allowed access.
1900 ##  </summary>
1901 ## </param>
1902 #
1903 interface(`init_search_pid_dirs',`
1904     gen_require(`
1905         type init_var_run_t;
1906     ')
1907
1908     allow $1 init_var_run_t:dir search_dir_perms;
1909 ')
1910
1911 ######################################
1912 ## <summary>
1913 ##  Allow listing of the /run/systemd directory.
1914 ## </summary>
1915 ## <param name="domain">
1916 ##  <summary>
1917 ##  Domain allowed access.
1918 ##  </summary>
1919 ## </param>
1920 #
1921 interface(`init_list_pid_dirs',`
1922     gen_require(`
1923         type init_var_run_t;
1924     ')
1925
1926     allow $1 init_var_run_t:dir list_dir_perms;
1927 ')
1928
1929 #######################################
1930 ## <summary>
1931 ##  Create a directory in the /run/systemd directory.
1932 ## </summary>
1933 ## <param name="domain">
1934 ##  <summary>
1935 ##  Domain allowed access.
1936 ##  </summary>
1937 ## </param>
1938 #
1939 interface(`init_create_pid_dirs',`
1940     gen_require(`
1941         type init_var_run_t;
1942     ')
1943
1944     allow $1 init_var_run_t:dir list_dir_perms;
1945     create_dirs_pattern($1, init_var_run_t, init_var_run_t)
1946 ')
1947
1948 #######################################
1949 ## <summary>
1950 ##  Create objects in /run/systemd directory
1951 ##  with an automatic type transition to
1952 ##  a specified private type.
1953 ## </summary>
1954 ## <param name="domain">
1955 ##  <summary>
1956 ##  Domain allowed access.
1957 ##  </summary>
1958 ## </param>
1959 ## <param name="private_type">
1960 ##  <summary>
1961 ##  The type of the object to create.
1962 ##  </summary>
1963 ## </param>
1964 ## <param name="object_class">
1965 ##  <summary>
1966 ##  The class of the object to be created.
1967 ##  </summary>
1968 ## </param>
1969 #
1970 interface(`init_pid_filetrans',`
1971     gen_require(`
1972         type init_var_run_t;
1973     ')
1974
1975         files_search_pids($1)
1976     filetrans_pattern($1, init_var_run_t, $2, $3)
1977 ')
1978
1979 #######################################
1980 ## <summary>
1981 ##      Create objects in /run/systemd directory
1982 ##      with an automatic type transition to
1983 ##      a specified private type.
1984 ## </summary>
1985 ## <param name="domain">
1986 ##      <summary>
1987 ##      Domain allowed access.
1988 ##      </summary>
1989 ## </param>
1990 ## <param name="private_type">
1991 ##      <summary>
1992 ##      The type of the object to create.
1993 ##      </summary>
1994 ## </param>
1995 ## <param name="object_class">
1996 ##      <summary>
1997 ##      The class of the object to be created.
1998 ##      </summary>
1999 ## </param>
2000 ## <param name="object_name">
2001 ##      <summary>
2002 ##      The name of the object to be created.
2003 ##      </summary>
2004 ## </param>
2005 #
2006 interface(`init_named_pid_filetrans',`
2007         gen_require(`
2008                 type init_var_run_t;
2009         ')
2010
2011         files_search_pids($1)
2012         filetrans_pattern($1, init_var_run_t, $2, $3, $4)
2013 ')
2014
2015 ########################################
2016 ## <summary>
2017 ##      Allow the specified domain to connect to daemon with a tcp socket
2018 ## </summary>
2019 ## <param name="domain">
2020 ##      <summary>
2021 ##      Domain allowed access.
2022 ##      </summary>
2023 ## </param>
2024 #
2025 interface(`init_tcp_recvfrom_all_daemons',`
2026         gen_require(`
2027                 attribute daemon;
2028         ')
2029
2030         corenet_tcp_recvfrom_labeled($1, daemon)
2031 ')
2032
2033 ########################################
2034 ## <summary>
2035 ##      Allow the specified domain to connect to daemon with a udp socket
2036 ## </summary>
2037 ## <param name="domain">
2038 ##      <summary>
2039 ##      Domain allowed access.
2040 ##      </summary>
2041 ## </param>
2042 #
2043 interface(`init_udp_recvfrom_all_daemons',`
2044         gen_require(`
2045                 attribute daemon;
2046         ')
2047         corenet_udp_recvfrom_labeled($1, daemon)
2048 ')
2049
2050 ########################################
2051 ## <summary>
2052 ##      Transition to system_r when execute an init script
2053 ## </summary>
2054 ## <desc>
2055 ##      <p>
2056 ##      Execute a init script in a specified role
2057 ##      </p>
2058 ##      <p>
2059 ##      No interprocess communication (signals, pipes,
2060 ##      etc.) is provided by this interface since
2061 ##      the domains are not owned by this module.
2062 ##      </p>
2063 ## </desc>
2064 ## <param name="source_role">
2065 ##      <summary>
2066 ##      Role to transition from.
2067 ##      </summary>
2068 ## </param>
2069 #
2070 interface(`init_script_role_transition',`
2071         gen_require(`
2072                 attribute init_script_file_type;
2073         ')
2074
2075         role_transition $1 init_script_file_type system_r;
2076 ')
2077
2078 ########################################
2079 ## <summary>
2080 ##      dontaudit read and write an leaked init scrip file descriptors
2081 ## </summary>
2082 ## <param name="domain">
2083 ##      <summary>
2084 ##      Domain to not audit.
2085 ##      </summary>
2086 ## </param>
2087 #
2088 interface(`init_dontaudit_script_leaks',`
2089         gen_require(`
2090                 type initrc_t;
2091         ')
2092
2093         dontaudit $1 initrc_t:tcp_socket { read write };
2094         dontaudit $1 initrc_t:udp_socket { read write };
2095         dontaudit $1 initrc_t:unix_dgram_socket { read write };
2096         dontaudit $1 initrc_t:unix_stream_socket { read write };
2097         dontaudit $1 initrc_t:shm rw_shm_perms;
2098         init_dontaudit_use_script_ptys($1)
2099         init_dontaudit_use_script_fds($1)
2100 ')
2101
2102 ########################################
2103 ## <summary>
2104 ##      Allow the specified domain to read/write to
2105 ##      init with a unix domain stream sockets.
2106 ## </summary>
2107 ## <param name="domain">
2108 ##      <summary>
2109 ##      Domain allowed access.
2110 ##      </summary>
2111 ## </param>
2112 #
2113 interface(`init_rw_stream_sockets',`
2114         gen_require(`
2115                 type init_t;
2116         ')
2117
2118         allow $1 init_t:unix_stream_socket rw_stream_socket_perms;
2119 ')
2120
2121 #######################################
2122 ## <summary>
2123 ##  Allow the specified domain to write to
2124 ##  init sock file.
2125 ## </summary>
2126 ## <param name="domain">
2127 ##  <summary>
2128 ##  Domain allowed access.
2129 ##  </summary>
2130 ## </param>
2131 #
2132 interface(`init_write_pid_socket',`
2133     gen_require(`
2134         type init_var_run_t;
2135     ')
2136
2137     allow $1 init_var_run_t:sock_file write;
2138 ')
2139
2140 ########################################
2141 ## <summary>
2142 ##      Send a message to init over a unix domain
2143 ##      datagram socket.
2144 ## </summary>
2145 ## <param name="domain">
2146 ##      <summary>
2147 ##      Domain allowed access.
2148 ##      </summary>
2149 ## </param>
2150 #
2151 interface(`init_dgram_send',`
2152         gen_require(`
2153                 type init_t;
2154         ')
2155
2156         allow $1 init_t:unix_dgram_socket sendto;
2157 ')
2158
2159 ########################################
2160 ## <summary>
2161 ##      Create a file type used for init socket files.
2162 ## </summary>
2163 ## <desc>
2164 ##      <p>
2165 ##      This defines a type that init can create sock_file within for
2166 ##      impersonation purposes
2167 ##      </p>
2168 ## </desc>
2169 ## <param name="script_file">
2170 ##      <summary>
2171 ##      Type to be used for a sock file.
2172 ##      </summary>
2173 ## </param>
2174 ## <infoflow type="none"/>
2175 #
2176 interface(`init_sock_file',`
2177         gen_require(`
2178                 attribute init_sock_file_type;
2179         ')
2180
2181         typeattribute $1 init_sock_file_type;
2182
2183 ')
2184
2185 ########################################
2186 ## <summary>
2187 ##      Read init unnamed pipes.
2188 ## </summary>
2189 ## <param name="domain">
2190 ##      <summary>
2191 ##      Domain allowed access.
2192 ##      </summary>
2193 ## </param>
2194 #
2195 interface(`init_read_pipes',`
2196         gen_require(`
2197                 type init_var_run_t;
2198         ')
2199
2200         read_fifo_files_pattern($1, init_var_run_t, init_var_run_t)
2201 ')