* [refpolicy] [PATCH 2/5-v3] Add interface to start/stop/enable/disable/status of chronyd service
@ 2018-02-24 14:41 David Sugar
0 siblings, 0 replies; only message in thread
From: David Sugar @ 2018-02-24 14:41 UTC (permalink / raw)
To: refpolicy
Add interfaces to allow process to systemctl start, stop, enable, disable, and status of chronyd.service
Fix summary for chronyd_startstop from previous submission
Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
chronyd.if | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 57 insertions(+)
diff --git a/chronyd.if b/chronyd.if
index e0a751a..a42bc4f 100644
--- a/chronyd.if
+++ b/chronyd.if
@@ -195,6 +195,63 @@ interface(`chronyd_read_key_files',`
read_files_pattern($1, chronyd_keys_t, chronyd_keys_t)
')
+########################################
+## <summary>
+## Allow specified domain to enable and disable chronyd unit
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`chronyd_enabledisable',`
+ gen_require(`
+ type chronyd_unit_t;
+ class service { enable disable };
+ ')
+
+ allow $1 chronyd_unit_t:service { enable disable };
+')
+
+########################################
+## <summary>
+## Allow specified domain to start and stop chronyd unit
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`chronyd_startstop',`
+ gen_require(`
+ type chronyd_unit_t;
+ class service { start stop };
+ ')
+
+ allow $1 chronyd_unit_t:service { start stop };
+')
+
+########################################
+## <summary>
+## Allow specified domain to get status of chronyd unit
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`chronyd_status',`
+ gen_require(`
+ type chronyd_unit_t;
+ class service status;
+ ')
+
+ allow $1 chronyd_unit_t:service status;
+')
+
####################################
## <summary>
## All of the rules required to
--
2.14.3
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2018-02-24 14:41 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-02-24 14:41 [refpolicy] [PATCH 2/5-v3] Add interface to start/stop/enable/disable/status of chronyd service David Sugar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).