
## <summary>policy for airavatU</summary>

########################################
## <summary>
##	Execute a domain transition to run airavatU.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`airavatU_domtrans',`
	gen_require(`
		type airavatU_t;
                type airavatU_exec_t;
	')

	domtrans_pattern($1,airavatU_exec_t,airavatU_t)
')


########################################
## <summary>
##	Execute airavatU in the airavatU domain, and
##	allow the specified role the airavatU domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the airavatU domain.
##	</summary>
## </param>
#
interface(`airavatU_run',`
	gen_require(`
		type airavatU_t;
	')

	airavatU_domtrans($1)
	role $2 types airavatU_t;
')

########################################
## <summary>
##	Role access for airavatU
## </summary>
## <param name="role">
##	<summary>
##	Role allowed access
##	</summary>
## </param>
## <param name="domain">
##	<summary>
##	User domain for the role
##	</summary>
## </param>
#
interface(`airavatU_role',`
	gen_require(`
              type airavatU_t;
	')

	role $2 types airavatU_t;

	airavatU_domtrans($1)

	ps_process_pattern($2, airavatU_t)
	allow $2 airavatU_t:process signal;
')

## <summary>policy for airavatT</summary>

########################################
## <summary>
##	Execute a domain transition to run airavatT.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`airavatT_domtrans',`
	gen_require(`
		type airavatT_t;
                type airavatT_exec_t;
	')

	domtrans_pattern($1,airavatT_exec_t,airavatT_t)
')


########################################
## <summary>
##	Search airavatT rw directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`airavatT_search_rw_dir',`
	gen_require(`
		type airavatT_rw_t;
	')

	allow $1 airavatT_rw_t:dir search_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Read airavatT rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`airavatT_read_rw_files',`
	gen_require(`
		type airavatT_rw_t;
	')

	allow $1 airavatT_rw_t:file r_file_perms;
	allow $1 airavatT_rw_t:dir list_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Create, read, write, and delete
##	airavatT rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`airavatT_manage_rw_files',`
	gen_require(`
		type airavatT_rw_t;
	')

	allow $1 airavatT_rw_t:file manage_file_perms;
	allow $1 airavatT_rw_t:dir rw_dir_perms;
')

########################################
## <summary>
##	Manage airavatT rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`airavatT_manage_rw',`
	gen_require(`
		type airavatT_rw_t;
	')

         manage_dirs_pattern($1,airavatT_rw_t,airavatT_rw_t)
         manage_files_pattern($1,airavatT_rw_t,airavatT_rw_t)
         manage_lnk_files_pattern($1,airavatT_rw_t,airavatT_rw_t)
')


########################################
## <summary>
##	Execute airavatT in the airavatT domain, and
##	allow the specified role the airavatT domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the airavatT domain.
##	</summary>
## </param>
#
interface(`airavatT_run',`
	gen_require(`
		type airavatT_t;
	')

	airavatT_domtrans($1)
	role $2 types airavatT_t;
')

########################################
## <summary>
##	Role access for airavatT
## </summary>
## <param name="role">
##	<summary>
##	Role allowed access
##	</summary>
## </param>
## <param name="domain">
##	<summary>
##	User domain for the role
##	</summary>
## </param>
#
interface(`airavatT_role',`
	gen_require(`
              type airavatT_t;
	')

	role $2 types airavatT_t;

	airavatT_domtrans($1)

	ps_process_pattern($2, airavatT_t)
	allow $2 airavatT_t:process signal;
')

########################################
## <summary>
##	All of the rules required to administrate 
##	an airavatT environment
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed to manage the airavatT domain.
##	</summary>
## </param>
## <param name="terminal">
##	<summary>
##	The type of the user terminal.
##	</summary>
## </param>
## <rolecap/>
#
interface(`airavatT_admin',`
	gen_require(`
		type airavatT_t;
	')

	allow $1 airavatT_t:process { ptrace signal_perms getattr };
	read_files_pattern($1, airavatT_t, airavatT_t)
	        

	airavatT_manage_rw($1)

')
