gravity.if

## <summary>policy for gravity</summary>

interface(`gravity_home_content_filetrans',`
  gen_require(`
    type gravity_home_t;
  ')

  filetrans_pattern($1, gravity_home_t, $2, $3, $4)
  allow $1 gravity_home_t:dir { search_dir_perms };
  files_search_home($1)
')

########################################
## <summary>
##	Transition the specified type/role to gravity role.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## 	Role allowed access.
## </summary>
## </param>
#
interface(`gravity_roletrans_gravity',`
  gen_require(`
    role gravity_roles;
    attribute gravity_domain;
  ')
  allow $2 gravity_roles;
  role_transition $2 gravity_domain gravity_roles;
  gravity_domtrans($1)
  gravity_installer_domtrans($1)
')

########################################
## <summary>
##	Execute gravity in the gravity domain and allow
## the specified role access to the gravity domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## 	Role allowed access.
## </summary>
## </param>
#
interface(`gravity_run',`
  gen_require(`
    attribute_role gravity_roles;
  ')

  gravity_domtrans($1)
  roleattribute $2 gravity_roles;
')

########################################
## <summary>
##	Enable the specified type/role to use gravity.
##  Does not allow the role automatic transition to gravity domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## 	Role allowed access.
## </summary>
## </param>
#
interface(`gravity_exec_to',`
  gen_require(`
    role system_r;
    attribute gravity_domain;
    attribute gravity_container_domain;
  ')

  can_exec($1, gravity_executable_domain)
  role $2 types gravity_domain;
  role $2 types gravity_container_domain;
')

########################################
## <summary>
##	Enable the specified type/role to use gravity.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## 	Role allowed access.
## </summary>
## </param>
#
interface(`gravity_run_to',`
  gen_require(`
    attribute gravity_domain;
    attribute gravity_container_domain;
  ')

  can_exec($1, gravity_executable_domain)
  gravity_domtrans($1)
  gravity_installer_domtrans($1)
  role $2 types gravity_domain;
  role $2 types gravity_container_domain;
')

########################################
## <summary>
##	Enable user role access to gravity domain
## </summary>
## <param name="role">
## <summary>
##	User role to allow access to gravity domain.
## </summary>
## </param>
## <param name="domain">
## <summary>
##	User domain to allow access to gravity domain.
## </summary>
## </param>
#
interface(`gravity_role',`
  gen_require(`
    attribute_role gravity_roles;
    attribute gravity_domain;
    type gravity_t;
    type gravity_exec_t;
    type gravity_container_runtime_t;
    type gravity_container_runtime_exec_t;
    type gravity_home_t;
    type gravity_log_t;
    type gravity_unit_file_t;
  ')

  # Allow gravity domain to use the user role
  roleattribute $1 gravity_roles;

  # Allow domain transition for user domain to gravity/planet
  domtrans_pattern($2, gravity_exec_t, gravity_t)
  domtrans_pattern($2, gravity_container_runtime_exec_t, gravity_container_runtime_t)

  # Interact with gravity process
  ps_process_pattern($2, gravity_domain)
  allow $2 gravity_domain:process { ptrace signal_perms };

  admin_pattern($2, gravity_home_t)
  admin_pattern($2, gravity_log_t)
  admin_pattern($2, gravity_container_home_t)
  admin_pattern($2, gravity_kubelet_home_t)
  allow $2 gravity_unit_file_t:service manage_service_perms;
')

########################################
## <summary>
##	Execute gravity_exec_t in the specified domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`gravity_domtrans',`
  gen_require(`
    type gravity_t, gravity_exec_t;
  ')

  corecmd_search_bin($1)
  domtrans_pattern($1, gravity_exec_t, gravity_t)
')

########################################
## <summary>
##	Execute gravity installer in the specified domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`gravity_installer_domtrans',`
  gen_require(`
    type gravity_installer_t, gravity_installer_exec_t;
  ')

  corecmd_search_bin($1)
  domtrans_pattern($1, gravity_installer_exec_t, gravity_installer_t)
')

########################################
## <summary>
##	Execute kubernetes tools in the specified domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`gravity_kubernetes_domtrans',`
  gen_require(`
    type gravity_kubernetes_t, gravity_kubernetes_exec_t;
  ')

  corecmd_search_bin($1)
  domtrans_pattern($1, gravity_kubernetes_exec_t, gravity_kubernetes_t)
')

######################################
## <summary>
##	Execute gravity in the caller domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`gravity_exec',`
  gen_require(`
    type gravity_exec_t;
  ')

  corecmd_search_bin($1)
  can_exec($1, gravity_exec_t)
')

########################################
## <summary>
##	Search gravity state directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`gravity_search_state',`
  gen_require(`
    type gravity_home_t;
  ')

  allow $1 gravity_home_t:dir { search_dir_perms };
  files_search_var_lib($1)
')

########################################
## <summary>
##	Read gravity state files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`gravity_read_state_files',`
  gen_require(`
    type gravity_home_t;
  ')

  gravity_search_state($1)
  list_dirs_pattern($1, gravity_home_t, gravity_home_t)
  read_files_pattern($1, gravity_home_t, gravity_home_t)
  read_lnk_files_pattern($1, gravity_home_t, gravity_home_t)
')

########################################
## <summary>
##	Manage gravity state files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`gravity_manage_state_files',`
  gen_require(`
    type gravity_home_t;
  ')

  files_search_var_lib($1)
  manage_files_pattern($1, gravity_home_t, gravity_home_t)
  manage_lnk_files_pattern($1, gravity_home_t, gravity_home_t)
')

########################################
## <summary>
##	Manage gravity state directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`gravity_manage_state_dirs',`
  gen_require(`
    type gravity_home_t;
  ')

  files_search_var_lib($1)
  manage_dirs_pattern($1, gravity_home_t, gravity_home_t)
')

interface(`gravity_container_home_content_filetrans',`
  gen_require(`
    type gravity_container_home_t;
  ')

  filetrans_pattern($1, gravity_container_home_t, $2, $3, $4)
  allow $1 gravity_container_home_t:dir { search_dir_perms };
  allow $1 gravity_container_home_t:lnk_file { read_lnk_file_perms };
')

interface(`gravity_kubelet_home_content_filetrans',`
  gen_require(`
    type gravity_kubelet_home_t;
  ')

  filetrans_pattern($1, gravity_kubelet_home_t, $2, $3, $4)
  allow $1 gravity_kubelet_home_t:dir { search_dir_perms };
  allow $1 gravity_kubelet_home_t:lnk_file { read_lnk_file_perms };
')

########################################
## <summary>
##	Read gravity container state files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`gravity_container_read_state_files',`
  gen_require(`
    type gravity_container_home_t;
  ')

  files_search_var_lib($1)
  list_dirs_pattern($1, gravity_container_home_t, gravity_container_home_t)
  read_files_pattern($1, gravity_container_home_t, gravity_container_home_t)
  read_lnk_files_pattern($1, gravity_container_home_t, gravity_container_home_t)
  list_dirs_pattern($1, gravity_kubelet_home_t, gravity_kubelet_home_t)
  read_files_pattern($1, gravity_kubelet_home_t, gravity_kubelet_home_t)
')

########################################
## <summary>
##	Read gravity container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`gravity_container_read_files',`
  gen_require(`
    type gravity_container_home_t;
    type gravity_container_file_t;
  ')

  gravity_container_read_state_files($1)
  search_dirs_pattern($1, gravity_container_home_t, gravity_container_file_t)
')

########################################
## <summary>
##	Manage gravity container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`gravity_container_manage_files',`
  gen_require(`
    type gravity_container_home_t;
    type gravity_container_file_t;
    type gravity_kubelet_home_t;
  ')

  files_search_var_lib($1)
  manage_dirs_pattern($1, gravity_container_home_t, gravity_container_home_t)
  manage_files_pattern($1, gravity_container_home_t, gravity_container_home_t)
  manage_chr_files_pattern($1, gravity_container_home_t, gravity_container_home_t)
  manage_blk_files_pattern($1, gravity_container_home_t, gravity_container_home_t)
  manage_lnk_files_pattern($1, gravity_container_home_t, gravity_container_home_t)
  manage_sock_files_pattern($1, gravity_container_home_t, gravity_container_home_t)
  manage_fifo_files_pattern($1, gravity_container_home_t, gravity_container_home_t)
  manage_dirs_pattern($1, gravity_kubelet_home_t, gravity_kubelet_home_t)
  manage_files_pattern($1, gravity_kubelet_home_t, gravity_kubelet_home_t)
  manage_chr_files_pattern($1, gravity_container_file_t, gravity_container_file_t)
  manage_blk_files_pattern($1, gravity_container_file_t, gravity_container_file_t)
')

########################################
## <summary>
##	All of the rules required to administrate
##	a gravity environment
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`gravity_admin',`
  gen_require(`
    type gravity_t;
    type gravity_home_t;
  ')

  allow $1 gravity_t:process { signal_perms };
  ps_process_pattern($1, gravity_t)

  tunable_policy(`deny_ptrace',`',`
    allow $1 gravity_t:process ptrace;
  ')

  files_search_var_lib($1)
  admin_pattern($1, gravity_home_t)
  optional_policy(`
    systemd_passwd_agent_exec($1)
    systemd_read_fifo_file_passwd_run($1)
  ')
')

########################################
## <summary>
##	Execute planet in the planet domain and allow
## the specified role access to the planet domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## 	Role allowed access.
## </summary>
## </param>
#
interface(`gravity_container_runtime_run',`
  gen_require(`
    attribute_role gravity_container_runtime_roles;
  ')

  gravity_container_runtime_domtrans($1)
  roleattribute $2 gravity_container_runtime_roles;
')

########################################
## <summary>
##	Execute planet in the specified domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`gravity_container_runtime_domtrans',`
  gen_require(`
    type gravity_container_runtime_t, gravity_container_runtime_exec_t;
  ')

  corecmd_search_bin($1)
  domtrans_pattern($1, gravity_container_runtime_exec_t, gravity_container_runtime_t)
  allow gravity_container_runtime_t $1:fifo_file setattr;
')

interface(`gravity_container_runtime_exec',`
  gen_require(`
    type gravity_container_runtime_exec_t;
  ')

  corecmd_search_bin($1)
  can_exec($1, gravity_container_runtime_exec_t)
')

interface(`gravity_container_stream_connect',`
  gen_require(`
    attribute gravity_domain;
    type gravity_container_var_run_t;
  ')

  files_search_pids($1)
  stream_connect_pattern($1, gravity_container_var_run_t, gravity_container_var_run_t, gravity_domain)
')

interface(`gravity_manage_executable_content',`
  gen_require(`
    attribute gravity_executable_domain;
  ')

  manage_files_pattern($1, gravity_executable_domain, gravity_executable_domain)
')

########################################
## <summary>
##	Creates types and rules for a
##	system gravity domain
## </summary>
## <param name="prefix">
##	<summary>
##	Prefix for the domain.
##	</summary>
## </param>
## FIXME: due to behavior of systemd-sysusers which seems to require
## access and create passwd_file_t (shadow_t, etc.) I'll resort to enabling
## gravity domains management access to these locations.
## This needs more tinkering to remove this restriction. Once removed,
## read permissions (auth_read_{passwd,shadow}) should suffice
#
template(`gravity_domain_template',`
  gen_require(`
    attribute gravity_domain;
    attribute gravity_executable_domain;
  ')

  type $1_t, gravity_domain;
  type $1_exec_t, gravity_executable_domain;
  role system_r types $1_t;
  application_domain($1_t, $1_exec_t)
  init_daemon_domain($1_t, $1_exec_t)

  auth_manage_passwd($1_t)
  auth_manage_shadow($1_t)
  allow $1_t gravity_executable_domain:file { relabel_file_perms };
')

########################################
## <summary>
##	Creates types and rules for a
##	gravity container runtime domain.
##  Usually there will be only a single domain
##  for the planet binary.
## </summary>
## <param name="prefix">
##	<summary>
##	Prefix for the domain.
##	</summary>
## </param>
template(`gravity_container_runtime_domain_template',`
  gen_require(`
    attribute gravity_executable_domain;
    attribute gravity_container_domain;
  ')

  container_runtime_domain_template($1)
  typeattribute $1_t gravity_container_domain;
  type $1_exec_t, gravity_executable_domain;
  init_daemon_domain($1_t, $1_exec_t)
  can_exec($1_t, gravity_executable_domain)
  role gravity_container_roles types $1_t;
')

########################################
## <summary>
##	Creates types and rules for a
##	system container process domain running inside the gravity container
## </summary>
## <param name="prefix">
##	<summary>
##	Prefix for the domain.
##	</summary>
## </param>
#
template(`gravity_system_container_domain_template',`
  gen_require(`
    attribute container_domain;
    attribute container_net_domain;
    attribute gravity_container_domain;
    attribute gravity_executable_domain;
    attribute gravity_domain;
  ')

  type $1_t, container_domain, container_net_domain;
  type $1_exec_t, gravity_executable_domain;
  role system_r types $1_t;
  init_daemon_domain($1_t, $1_exec_t)
  domain_type($1_t)
  domain_user_exemption_target($1_t)
  kernel_read_all_proc($1_t)
  auth_read_passwd($1_t)
  auth_read_shadow($1_t)

  can_exec($1_t, $1_exec_t)
  can_exec(gravity_domain, $1_exec_t)
  domtrans_pattern(gravity_domain, $1_exec_t, $1_t)

  typeattribute $1_t gravity_container_domain;

  ifdef(`enable_mls',`
    init_ranged_daemon_domain($1_t, $1_exec_t, s0 - mls_systemhigh)
  ')
  mls_file_read_to_clearance($1_t)
  mls_file_write_to_clearance($1_t)
')

########################################
## <summary>
##	Creates types and rules for a
##	container process domain running inside the gravity container
## </summary>
## <param name="prefix">
##	<summary>
##	Prefix for the domain.
##	</summary>
## </param>
#
template(`gravity_container_domain_template',`
  gen_require(`
    attribute container_domain;
    attribute container_net_domain;
    attribute gravity_container_domain;
  ')

  type $1_t, container_domain, container_net_domain;
  typeattribute $1_t gravity_container_domain;
  domain_type($1_t)
  domain_user_exemption_target($1_t)
  mls_rangetrans_target($1_t)
  role system_r types $1_t;
  kernel_read_all_proc($1_t)
')