diff options
| author |   David Sugar <dsugar@tresys.com> | 2018-11-02 00:40:57 +0000 |
|---|---|---|
| committer |   Jason Zaman <jason@perfinion.com> | 2018-11-12 07:17:31 +0800 |
| commit | ab0f433384c8a532bcb8a75dac6117c2590403a6 (patch) | |
| tree | 8ec5246eac1548cabd8da224f5e5963001536158 | |
| parent | Interface to add domain allowed to be read by ClamAV for scanning. (diff) | |
| download | hardened-refpolicy-ab0f433384c8a532bcb8a75dac6117c2590403a6.tar.gz hardened-refpolicy-ab0f433384c8a532bcb8a75dac6117c2590403a6.tar.bz2 hardened-refpolicy-ab0f433384c8a532bcb8a75dac6117c2590403a6.zip | |
Add interfaces to control clamav_unit_t systemd services
Signed-off-by: Dave Sugar <dsugar@tresys.com>
Signed-off-by: Jason Zaman <jason@perfinion.com>
| -rw-r--r-- | policy/modules/services/clamav.if | 76 |
1 files changed, 76 insertions, 0 deletions
diff --git a/policy/modules/services/clamav.if b/policy/modules/services/clamav.if index d1296fcc..2adb1230 100644 --- a/policy/modules/services/clamav.if +++ b/policy/modules/services/clamav.if @@ -225,6 +225,82 @@ interface(`clamav_scannable_files',` ######################################## ## <summary> +## Allow specified domain to enable clamd units +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`clamav_enabledisable_clamd',` + gen_require(` + type clamav_unit_t; + class service { enable disable }; + ') + + allow $1 clamav_unit_t:service { enable disable }; +') + +######################################## +## <summary> +## Allow specified domain to start clamd units +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`clamav_startstop_clamd',` + gen_require(` + type clamd_unit_t; + class service { start stop }; + ') + + allow $1 clamd_unit_t:service { start stop }; +') + +######################################## +## <summary> +## Allow specified domain to get status of clamd +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`clamav_status_clamd',` + gen_require(` + type clamd_unit_t; + class service status; + ') + + allow $1 clamd_unit_t:service status; +') + +######################################## +## <summary> +## Allow specified domain reload of clamd +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`clamav_reload_clamd',` + gen_require(` + type clamd_unit_t; + class service reload; + ') + + allow $1 clamd_unit_t:service reload; +') + +######################################## +## <summary> ## All of the rules required to ## administrate an clamav environment. ## </summary> |