From: dsugar@tresys.com (Dave Sugar)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] [PATCH 2/5-v4] Add interface to start/stop/enable/disable/status of chronyd service
Date: Mon, 5 Mar 2018 09:02:59 -0500 [thread overview]
Message-ID: <20180305140302.31341-3-dsugar@tresys.com> (raw)
In-Reply-To: <20180305140302.31341-1-dsugar@tresys.com>
Add interfaces to allow process to systemctl start, stop, enable, disable, and status of chronyd.service
Fix summary for chronyd_startstop from previous submission
Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
chronyd.if | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 57 insertions(+)
diff --git a/chronyd.if b/chronyd.if
index e0a751a..a42bc4f 100644
--- a/chronyd.if
+++ b/chronyd.if
@@ -195,6 +195,63 @@ interface(`chronyd_read_key_files',`
read_files_pattern($1, chronyd_keys_t, chronyd_keys_t)
')
+########################################
+## <summary>
+## Allow specified domain to enable and disable chronyd unit
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`chronyd_enabledisable',`
+ gen_require(`
+ type chronyd_unit_t;
+ class service { enable disable };
+ ')
+
+ allow $1 chronyd_unit_t:service { enable disable };
+')
+
+########################################
+## <summary>
+## Allow specified domain to start and stop chronyd unit
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`chronyd_startstop',`
+ gen_require(`
+ type chronyd_unit_t;
+ class service { start stop };
+ ')
+
+ allow $1 chronyd_unit_t:service { start stop };
+')
+
+########################################
+## <summary>
+## Allow specified domain to get status of chronyd unit
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`chronyd_status',`
+ gen_require(`
+ type chronyd_unit_t;
+ class service status;
+ ')
+
+ allow $1 chronyd_unit_t:service status;
+')
+
####################################
## <summary>
## All of the rules required to
--
2.14.3
next prev parent reply other threads:[~2018-03-05 14:02 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-05 14:02 [refpolicy] [PATCH 0/5-v4] Updates for chronyd Dave Sugar
2018-03-05 14:02 ` [refpolicy] [PATCH 1/5-v4] Separate type for chronyd config file Dave Sugar
2018-03-05 14:02 ` Dave Sugar [this message]
2018-03-05 14:03 ` [refpolicy] [PATCH 3/5-v4] Chronyd talks ntp client packets to get time from server Dave Sugar
2018-03-05 14:03 ` [refpolicy] [PATCH 4/5-v4] Policy for chronyc - it was running in init_t domain Dave Sugar
2018-03-05 14:03 ` [refpolicy] [PATCH 5/5-v4] Allow execution of chronyc from commandline Dave Sugar
2018-03-07 21:57 ` [refpolicy] [PATCH 0/5-v4] Updates for chronyd Chris PeBenito
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180305140302.31341-3-dsugar@tresys.com \
--to=dsugar@tresys.com \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).