Current File : //usr/share/selinux/devel/include/contrib/insights_client.if

## <summary>policy for insights_client</summary>

########################################
## <summary>
##	Execute insights_client_exec_t in the insights_client domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`insights_client_domtrans',`
	gen_require(`
		type insights_client_t, insights_client_exec_t;
	')

	corecmd_search_bin($1)
	domtrans_pattern($1, insights_client_exec_t, insights_client_t)
')

######################################
## <summary>
##	Execute insights_client in the caller domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_exec',`
	gen_require(`
		type insights_client_exec_t;
	')

	corecmd_search_bin($1)
	can_exec($1, insights_client_exec_t)
')

########################################
## <summary>
##	Read and write a insights_client unnamed pipe.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_rw_pipes',`
	gen_require(`
		type insights_client_t;
	')

	allow $1 insights_client_t:fifo_file rw_inherited_fifo_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to search
##	insights configuration dirs.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_search_config',`
	gen_require(`
		type insights_client_etc_t;
	')

	files_search_etc($1)
	allow $1 insights_client_etc_t:dir search_dir_perms;
')

########################################
## <summary>
##	Transition to insights_client named content
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_filetrans_named_content',`
	gen_require(`
		type insights_client_etc_t, insights_client_etc_rw_t;
		type insights_client_tmp_t;
		type insights_client_var_run_t;
	')

	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, ".cache.json")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, ".cache.json.asc")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, ".insights-core.etag")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, ".insights-core-gpg-sig.etag")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, ".lastupload")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, ".last-upload.results")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, ".registered")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, ".unregistered")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, "insights-client-egg-release")
	filetrans_pattern($1, insights_client_etc_t, insights_client_etc_rw_t, file, "machine-id")

	files_pid_filetrans($1, insights_client_var_run_t, file, "insights-client.pid")

	files_tmp_filetrans($1, insights_client_tmp_t, dir, "insights-client")
	files_tmp_filetrans($1, insights_client_tmp_t, file, "insights-client.ppid")
')

########################################
## <summary>
##	Transition to insights_client named content in /tmp
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_filetrans_tmp',`
	gen_require(`
		type insights_client_tmp_t;
	')

	files_tmp_filetrans($1, insights_client_tmp_t, dir, "insights-client")
	files_tmp_filetrans($1, insights_client_tmp_t, file, "insights-client.ppid")
')

########################################
## <summary>
##	Transition to insights_client named content in /var/run
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_filetrans_run',`
	gen_require(`
		type insights_client_var_run_t;
	')

	files_pid_filetrans($1, insights_client_var_run_t, file, "insights-client.pid")
')

########################################
## <summary>
##	Read insights_client config files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_read_config',`
	gen_require(`
		type insights_client_etc_t, insights_client_etc_rw_t;
	')

	files_search_etc($1)
	read_files_pattern($1, insights_client_etc_t, insights_client_etc_t)
	read_files_pattern($1, insights_client_etc_rw_t, insights_client_etc_rw_t)
')

########################################
## <summary>
##	Read insights_client lib files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_read_lib_files',`
	gen_require(`
		type insights_client_var_lib_t;
	')

	files_search_var_lib($1)
	read_files_pattern($1, insights_client_var_lib_t, insights_client_var_lib_t)
	allow $1 insights_client_var_lib_t:file map;
')

########################################
## <summary>
##	Manage insights_client lib directories..
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_manage_lib_dirs',`
	gen_require(`
		type insights_client_var_lib_t;
	')

	files_search_var_lib($1)
	manage_dirs_pattern($1, insights_client_var_lib_t, insights_client_var_lib_t)
')

########################################
## <summary>
##	Watch insights_client lib directories..
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_watch_lib_dirs',`
	gen_require(`
		type insights_client_var_lib_t;
	')

	files_search_var_lib($1)
	watch_dirs_pattern($1, insights_client_var_lib_t, insights_client_var_lib_t)
')

########################################
## <summary>
##	Manage insights_client lib files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_manage_lib_files',`
	gen_require(`
		type insights_client_var_lib_t;
	')

	files_search_var_lib($1)
	manage_files_pattern($1, insights_client_var_lib_t, insights_client_var_lib_t)
	allow $1 insights_client_var_lib_t:file map;
')

########################################
## <summary>
##	Write to insights_client lib socket files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_write_lib_sock_files',`
	gen_require(`
		type insights_client_var_lib_t;
	')

	files_search_var_lib($1)
	write_sock_files_pattern($1, insights_client_var_lib_t, insights_client_var_lib_t)
')

########################################
## <summary>
##	Manage insights_client lib socket files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_manage_lib_sock_files',`
	gen_require(`
		type insights_client_var_lib_t;
	')

	files_search_var_lib($1)
	manage_sock_files_pattern($1, insights_client_var_lib_t, insights_client_var_lib_t)
')

########################################
## <summary>
##	Read insights_client temporary files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_read_tmp',`
	gen_require(`
		type insights_client_tmp_t;
	')

	files_search_tmp($1)
	read_files_pattern($1, insights_client_tmp_t, insights_client_tmp_t)
')

########################################
## <summary>
##	Write/append insights_client temporary files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`insights_client_write_tmp',`
	gen_require(`
		type insights_client_tmp_t;
	')

	files_search_tmp($1)
	write_files_pattern($1, insights_client_tmp_t, insights_client_tmp_t)
')