eucalyptus.if.in

# Copyright (c) 2016 Hewlett Packard Enterprise Development LP
#
# Permission to use, copy, modify, and/or distribute this software for
# any purpose with or without fee is hereby granted, provided that the
# above copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

## <summary>Eucalyptus cloud services.</summary>

#######################################
## <summary>
##	The template to define a eucalyptus domain.
## </summary>
## <param name="domain_prefix">
##	<summary>
##	Domain prefix to be used.
##	</summary>
## </param>
#
template(`eucalyptus_domain_template',`
    gen_require(`
        attribute eucalyptus_domain;
    ')

    ########################################
    #
    # Declarations
    #

    type eucalyptus_$1_t, eucalyptus_domain;
    type eucalyptus_$1_exec_t;
    init_daemon_domain(eucalyptus_$1_t, eucalyptus_$1_exec_t)

    type eucalyptus_$1_unit_file_t, eucalyptus_unit_file;
    systemd_unit_file(eucalyptus_$1_unit_file_t)
')

########################################
## <summary>
##	Send generic signals to all eucalyptus processes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_signal',`
    gen_require(`
        attribute eucalyptus_domain;
    ')

    allow $1 eucalyptus_domain:process signal;
')

########################################
## <summary>
##	Send a null signal to all eucalyptus processes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_signull',`
    gen_require(`
        attribute eucalyptus_domain;
    ')

    allow $1 eucalyptus_domain:process signull;
')

########################################
## <summary>
##	Send SIGKILL to all eucalyptus processes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_kill',`
    gen_require(`
        attribute eucalyptus_domain;
    ')

    allow $1 eucalyptus_domain:process sigkill;
')

########################################
## <summary>
##	Allow the specified domain to read eucalyptus config files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_read_config',`
    gen_require(`
        type eucalyptus_conf_t;
    ')

    read_files_pattern($1, eucalyptus_conf_t, eucalyptus_conf_t)
    read_lnk_files_pattern($1, eucalyptus_conf_t, eucalyptus_conf_t)

    files_search_etc($1)
')

########################################
## <summary>
##	Allow the specified domain to manage eucalyptus config files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_config',`
    gen_require(`
        type eucalyptus_conf_t;
    ')

    manage_dirs_pattern($1, eucalyptus_conf_t, eucalyptus_conf_t)
    manage_files_pattern($1, eucalyptus_conf_t, eucalyptus_conf_t)
    manage_lnk_files_pattern($1, eucalyptus_conf_t, eucalyptus_conf_t)

    files_search_etc($1)
')

########################################
## <summary>
##	Allow the specified domain to read eucalyptus log files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_read_log',`
    gen_require(`
        type eucalyptus_log_t;
    ')

    read_files_pattern($1, eucalyptus_log_t, eucalyptus_log_t)

    logging_search_logs($1)
')

########################################
## <summary>
##	Append to eucalyptus log files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_append_log',`
    gen_require(`
        type eucalyptus_log_t;
    ')

    append_files_pattern($1, eucalyptus_log_t, eucalyptus_log_t)

    logging_search_logs($1)
')

########################################
## <summary>
##	Allow the specified domain to manage eucalyptus log files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_log',`
    gen_require(`
        type eucalyptus_log_t;
    ')

    manage_dirs_pattern($1, eucalyptus_log_t, eucalyptus_log_t)
    manage_files_pattern($1, eucalyptus_log_t, eucalyptus_log_t)
    manage_lnk_files_pattern($1, eucalyptus_log_t, eucalyptus_log_t)

    logging_search_logs($1)
')

########################################
## <summary>
##	Read eucalyptus tmp files
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_read_tmp_files',`
    gen_require(`
        type eucalyptus_tmp_t;
    ')

    files_search_tmp($1)
    read_files_pattern($1, eucalyptus_tmp_t, eucalyptus_tmp_t)
')

########################################
## <summary>
##	Do not audit attempts to read
##	eucalyptus tmp files
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`eucalyptus_dontaudit_read_tmp_files',`
    gen_require(`
        type eucalyptus_tmp_t;
    ')

    dontaudit $1 eucalyptus_tmp_t:file read_file_perms;
')

########################################
## <summary>
##	Manage eucalyptus tmp files
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_tmp_files',`
    gen_require(`
        type eucalyptus_tmp_t;
    ')

    files_search_tmp($1)
    manage_dirs_pattern($1, eucalyptus_tmp_t, eucalyptus_tmp_t)
    manage_files_pattern($1, eucalyptus_tmp_t, eucalyptus_tmp_t)
    manage_lnk_files_pattern($1, eucalyptus_tmp_t, eucalyptus_tmp_t)
')

######################################
## <summary>
##	Read eucalyptus tmpfs files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_read_tmpfs_files',`
    gen_require(`
        type eucalyptus_tmpfs_t;
    ')

    fs_search_tmpfs($1)
    read_files_pattern($1, eucalyptus_tmpfs_t, eucalyptus_tmpfs_t)
')

######################################
## <summary>
##	Read/write eucalyptus tmpfs files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_rw_tmpfs_files',`
    gen_require(`
        type eucalyptus_tmpfs_t;
    ')

    fs_search_tmpfs($1)
    rw_files_pattern($1, eucalyptus_tmpfs_t, eucalyptus_tmpfs_t)
')

########################################
## <summary>
##	Manage eucalyptus tmpfs files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_tmpfs_files',`
    gen_require(`
        type eucalyptus_tmpfs_t;
    ')

    fs_search_tmpfs($1)
    manage_files_pattern($1, eucalyptus_tmpfs_t, eucalyptus_tmpfs_t)
')

########################################
## <summary>
##	Manage eucalyptus /var/lib directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_var_lib_dirs',`
    gen_require(`
        type eucalyptus_var_lib_t;
    ')

    manage_dirs_pattern($1, eucalyptus_var_lib_t, eucalyptus_var_lib_t)

    files_search_var_lib($1)
')

########################################
## <summary>
##	Read eucalyptus /var/lib files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_read_var_lib_files',`
    gen_require(`
        type eucalyptus_var_lib_t;
    ')

    read_files_pattern($1, eucalyptus_var_lib_t, eucalyptus_var_lib_t)

    files_search_var_lib($1)
')

########################################
## <summary>
##	Manage eucalyptus /var/lib files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_var_lib_files',`
    gen_require(`
        type eucalyptus_var_lib_t;
    ')

    manage_files_pattern($1, eucalyptus_var_lib_t, eucalyptus_var_lib_t)

    files_search_var_lib($1)
')

########################################
## <summary>
##	Manage eucalyptus sock_files files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_var_lib_sock_files',`
    gen_require(`
        type eucalyptus_var_lib_t;
    ')

    manage_sock_files_pattern($1, eucalyptus_var_lib_t, eucalyptus_var_lib_t)

    files_search_var_lib($1)
')

########################################
## <summary>
##	Create eucalyptus /var/run directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_create_pid_dirs',`
    gen_require(`
        type eucalyptus_var_run_t;
    ')

    allow $1 eucalyptus_var_run_t:dir create_dir_perms;

    files_search_pids($1)
')

########################################
## <summary>
##	Manage eucalyptus /var/run directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_pid_dirs',`
    gen_require(`
        type eucalyptus_var_run_t;
    ')

    manage_dirs_pattern($1, eucalyptus_var_run_t, eucalyptus_var_run_t)

    files_search_pids($1)
')

########################################
## <summary>
##	Read eucalyptus /var/run files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_read_pid_files',`
    gen_require(`
        type eucalyptus_var_run_t;
    ')

    read_files_pattern($1, eucalyptus_var_run_t, eucalyptus_var_run_t)

    files_search_pids($1)
')

########################################
## <summary>
##	Write eucalyptus /var/run files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_write_pid_files',`
    gen_require(`
        type eucalyptus_var_run_t;
    ')

    write_files_pattern($1, eucalyptus_var_run_t, eucalyptus_var_run_t)

    files_search_pids($1)
')

########################################
## <summary>
##	Read/write eucalyptus /var/run files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_rw_pid_files',`
    gen_require(`
        type eucalyptus_var_run_t;
    ')

    rw_files_pattern($1, eucalyptus_var_run_t, eucalyptus_var_run_t)

    files_search_pids($1)
')

########################################
## <summary>
##	Create eucalyptus /var/run files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_create_pid_files',`
    gen_require(`
        type eucalyptus_var_run_t;
    ')

    create_files_pattern($1, eucalyptus_var_run_t, eucalyptus_var_run_t)

    files_search_pids($1)
')

########################################
## <summary>
##	Delete eucalyptus /var/run files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_delete_pid_files',`
    gen_require(`
        type eucalyptus_var_run_t;
    ')

    delete_files_pattern($1, eucalyptus_var_run_t, eucalyptus_var_run_t)

    files_search_pids($1)
')

########################################
## <summary>
##	Manage eucalyptus /var/run files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`eucalyptus_manage_pid_files',`
    gen_require(`
        type eucalyptus_var_run_t;
    ')

    manage_files_pattern($1, eucalyptus_var_run_t, eucalyptus_var_run_t)

    files_search_pids($1)
')

########################################
## <summary>
##	Execute all eucalyptus services in their respective domains.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`eucalyptus_systemctl',`
    gen_require(`
        attribute eucalyptus_domain;
        attribute eucalyptus_unit_file;
    ')

    allow $1 eucalyptus_unit_file:file read_file_perms;
    allow $1 eucalyptus_unit_file:service manage_service_perms;

    ps_process_pattern($1, eucalyptus_domain)

    init_reload_services($1)

    systemd_exec_systemctl($1)
    systemd_search_unit_dirs($1)
')

########################################
## <summary>
##	Dontaudit reads and writes on leaked file descriptors.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`eucalyptus_dontaudit_leaks',`
    gen_require(`
        type eucalyptus_log_t;
    ')

    dontaudit $1 eucalyptus_log_t:file { read write };
')

#######################################
## <summary>
##	All of the rules required to
##	administrate a eucalyptus environment.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`eucalyptus_admin',`
    gen_require(`
        attribute eucalyptus_domain;
        type eucalyptus_conf_t;
        type eucalyptus_log_t;
        type eucalyptus_tmpfs_t;
        type eucalyptus_tmp_t;
        type eucalyptus_var_lib_t;
        type eucalyptus_var_run_t;
    ')

    allow $1 eucalyptus_domain:process signal_perms;

    ps_process_pattern($1, eucalyptus_domain)

    files_search_etc($1)
    admin_pattern($1, eucalyptus_conf_t)

    logging_search_logs($1)
    admin_pattern($1, eucalyptus_log_t)

    files_list_tmp($1)
    admin_pattern($1, eucalyptus_tmp_t)

    fs_list_tmpfs($1)
    admin_pattern($1, eucalyptus_tmpfs_t)

    files_search_var_lib($1)
    admin_pattern($1, eucalyptus_var_lib_t)

    files_list_pids($1)
    admin_pattern($1, eucalyptus_var_run_t)

    eucalyptus_systemctl($1)
    admin_pattern($1, eucalyptus_unit_file)
    allow $1 eucalyptus_unit_file:service all_service_perms;

    tunable_policy(`deny_ptrace',`',`
        allow $1 eucalyptus_domain:process ptrace;
    ')
')