[refpolicy] [PATCH 1/2] logging: use init_startstop_service in _admin interface

[refpolicy] [PATCH 1/2] logging: use init_startstop_service in _admin interface

[Jason Zaman]

The logging_admin interfaces had rules for RedHat sysvinit. This
replaces them with the interface init_startstop_service which can
easily be changed for other init systems.
---
 policy/modules/system/logging.if | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index a40714e..7fd0c41 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -1003,10 +1003,7 @@ interface(`logging_admin_audit',`
 
 	logging_run_auditctl($1, $2)
 
-	init_labeled_script_domtrans($1, auditd_initrc_exec_t)
-	domain_system_change_exemption($1)
-	role_transition $2 auditd_initrc_exec_t system_r;
-	allow $2 system_r;
+	init_startstop_service($1, $2, auditd_t, auditd_initrc_exec_t)
 ')
 
 ########################################
@@ -1061,10 +1058,7 @@ interface(`logging_admin_syslog',`
 
 	logging_manage_all_logs($1)
 
-	init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
-	domain_system_change_exemption($1)
-	role_transition $2 syslogd_initrc_exec_t system_r;
-	allow $2 system_r;
+	init_startstop_service($1, $2, syslogd_t, syslogd_initrc_exec_t)
 ')
 
 ########################################
-- 
2.3.6

[refpolicy] [PATCH 2/2] postgresql: use init_startstop_service in _admin interface

[Jason Zaman]

The postgresql_admin interfaces had rules for RedHat sysvinit. This
replaces them with the interface init_startstop_service which can
easily be changed for other init systems.
---
 policy/modules/services/postgresql.if | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
index 9d2f311..60395e7 100644
--- a/policy/modules/services/postgresql.if
+++ b/policy/modules/services/postgresql.if
@@ -577,10 +577,7 @@ interface(`postgresql_admin',`
 	allow $1 postgresql_t:process { ptrace signal_perms };
 	ps_process_pattern($1, postgresql_t)
 
-	init_labeled_script_domtrans($1, postgresql_initrc_exec_t)
-	domain_system_change_exemption($1)
-	role_transition $2 postgresql_initrc_exec_t system_r;
-	allow $2 system_r;
+	init_startstop_service($1, $2, postgresql_t, postgresql_initrc_exec_t)
 
 	admin_pattern($1, postgresql_var_run_t)
 
-- 
2.3.6

[refpolicy] [PATCH 1/2] logging: use init_startstop_service in _admin interface

[Christopher J. PeBenito]

On 5/25/2015 5:33 AM, Jason Zaman wrote:
> The logging_admin interfaces had rules for RedHat sysvinit. This
> replaces them with the interface init_startstop_service which can
> easily be changed for other init systems.

Merged.


> ---
>  policy/modules/system/logging.if | 10 ++--------
>  1 file changed, 2 insertions(+), 8 deletions(-)
> 
> diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
> index a40714e..7fd0c41 100644
> --- a/policy/modules/system/logging.if
> +++ b/policy/modules/system/logging.if
> @@ -1003,10 +1003,7 @@ interface(`logging_admin_audit',`
>  
>  	logging_run_auditctl($1, $2)
>  
> -	init_labeled_script_domtrans($1, auditd_initrc_exec_t)
> -	domain_system_change_exemption($1)
> -	role_transition $2 auditd_initrc_exec_t system_r;
> -	allow $2 system_r;
> +	init_startstop_service($1, $2, auditd_t, auditd_initrc_exec_t)
>  ')
>  
>  ########################################
> @@ -1061,10 +1058,7 @@ interface(`logging_admin_syslog',`
>  
>  	logging_manage_all_logs($1)
>  
> -	init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
> -	domain_system_change_exemption($1)
> -	role_transition $2 syslogd_initrc_exec_t system_r;
> -	allow $2 system_r;
> +	init_startstop_service($1, $2, syslogd_t, syslogd_initrc_exec_t)
>  ')
>  
>  ########################################
> 


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] [PATCH 2/2] postgresql: use init_startstop_service in _admin interface

[Christopher J. PeBenito]

On 5/25/2015 5:33 AM, Jason Zaman wrote:
> The postgresql_admin interfaces had rules for RedHat sysvinit. This
> replaces them with the interface init_startstop_service which can
> easily be changed for other init systems.

Merged.


> ---
>  policy/modules/services/postgresql.if | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
> index 9d2f311..60395e7 100644
> --- a/policy/modules/services/postgresql.if
> +++ b/policy/modules/services/postgresql.if
> @@ -577,10 +577,7 @@ interface(`postgresql_admin',`
>  	allow $1 postgresql_t:process { ptrace signal_perms };
>  	ps_process_pattern($1, postgresql_t)
>  
> -	init_labeled_script_domtrans($1, postgresql_initrc_exec_t)
> -	domain_system_change_exemption($1)
> -	role_transition $2 postgresql_initrc_exec_t system_r;
> -	allow $2 system_r;
> +	init_startstop_service($1, $2, postgresql_t, postgresql_initrc_exec_t)
>  
>  	admin_pattern($1, postgresql_var_run_t)
>  
> 


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com