[refpolicy] [PATCHv2 6/8] Introduce gpg_exec interface

[sven.vermeulen@siphos.be (Sven Vermeulen)]

Some applications might want to execute gpg without requiring a
transition. A possible use case is to allow applications to validate
signatures (made by GnuPG). As long as the application doesn't need to
generate signatures itself and its trustdb is not marked as
gpg_secret_t, it suffices to grant it gpg_exec().

Note that it does require the application to have read/write rights in
the directory where the trustdb is stored (as gpg tries to generate lock
files where the trustdb file is located).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/apps/gpg.if |   18 ++++++++++++++++++
 1 files changed, 18 insertions(+), 0 deletions(-)

diff --git a/policy/modules/apps/gpg.if b/policy/modules/apps/gpg.if
index 40e0a2a..6d50300 100644
--- a/policy/modules/apps/gpg.if
+++ b/policy/modules/apps/gpg.if
@@ -87,6 +87,24 @@ interface(`gpg_domtrans',`
 
 ########################################
 ## <summary>
+##	Execute the gpg application without transitioning
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to execute gpg
+##	</summary>
+## </param>
+#
+interface(`gpg_exec',`
+	gen_require(`
+		type gpg_exec_t;
+	')
+
+	can_exec($1, gpg_exec_t)
+')
+
+########################################
+## <summary>
 ##	Send generic signals to user gpg processes.
 ## </summary>
 ## <param name="domain">
-- 
1.7.3.4