[selinux-policy: 2828/3172] Modified amanda

[Daniel J Walsh]

commit 8f4ec142d74e68b3e659f441c6e1717c4d49dd49
Author: Dan Walsh <dwalsh at redhat.com>
Date:   Thu Aug 26 11:02:44 2010 -0400

    Modified amanda

 policy/modules/admin/amanda.if |   34 +++++++++++++---------------------
 1 files changed, 13 insertions(+), 21 deletions(-)
---
diff --git a/policy/modules/admin/amanda.if b/policy/modules/admin/amanda.if
index 2cb11ea..d1d035e 100644
--- a/policy/modules/admin/amanda.if
+++ b/policy/modules/admin/amanda.if
@@ -1,9 +1,8 @@
-## <summary>Advanced Maryland Automatic Network Disk Archiver.</summary>
+## <summary>Automated backup program.</summary>
 
 ########################################
 ## <summary>
-##	Execute a domain transition to
-##	run Amanda Recover.
+##	Execute amrecover in the amanda_recover domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -17,15 +16,12 @@ interface(`amanda_domtrans_recover',`
 	')
 
 	domtrans_pattern($1, amanda_recover_exec_t, amanda_recover_t)
-	corecmd_search_bin($1)
 ')
 
 ########################################
 ## <summary>
-##	Execute a domain transition to
-##	run Amanda Recover and allow the
-##	specified role the Amanda Recover
-##	domain.
+##	Execute amrecover in the amanda_recover domain, and
+##	allow the specified role the amanda_recover domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -50,7 +46,7 @@ interface(`amanda_run_recover',`
 
 ########################################
 ## <summary>
-##	Search Amanda lib directories.
+##	Search amanda library directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -65,13 +61,11 @@ interface(`amanda_search_lib',`
 
 	allow $1 amanda_usr_lib_t:dir search_dir_perms;
 	files_search_usr($1)
-	libs_search_lib($1)
 ')
 
 ########################################
 ## <summary>
-##	Do not audit attempts to read
-##	dumpdates files.
+##	Do not audit attempts to read /etc/dumpdates.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -84,12 +78,12 @@ interface(`amanda_dontaudit_read_dumpdates',`
 		type amanda_dumpdates_t;
 	')
 
-	dontaudit $1 amanda_dumpdates_t:file read_file_perms;
+	dontaudit $1 amanda_dumpdates_t:file { getattr read };
 ')
 
 ########################################
 ## <summary>
-##	Read and write dumpdates files.
+##	Allow read/writing /etc/dumpdates.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -103,12 +97,11 @@ interface(`amanda_rw_dumpdates_files',`
 	')
 
 	allow $1 amanda_dumpdates_t:file rw_file_perms;
-	files_search_etc($1)
 ')
 
 ########################################
 ## <summary>
-##	Search Amanda lib directories.
+##	Search amanda library directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -123,12 +116,11 @@ interface(`amanda_manage_lib',`
 
 	allow $1 amanda_usr_lib_t:dir manage_dir_perms;
 	files_search_usr($1)
-	libs_search_lib($1)
 ')
 
 ########################################
 ## <summary>
-##	Read and write Amanda logs.
+##	Allow read/writing amanda logs
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -142,12 +134,11 @@ interface(`amanda_append_log_files',`
 	')
 
 	allow $1 amanda_log_t:file { read_file_perms append_file_perms };
-	logging_search_logs($1)
 ')
 
 #######################################
 ## <summary>
-##	Search Amanda lib directories.
+##	Search amanda var library directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -160,6 +151,7 @@ interface(`amanda_search_var_lib',`
 		type amanda_var_lib_t;
 	')
 
-	allow $1 amanda_var_lib_t:dir search_dir_perms;
 	files_search_var_lib($1)
+	allow $1 amanda_var_lib_t:dir search_dir_perms;
+
 ')