1 files changed, 90 insertions, 0 deletions
diff --git a/policy/modules/services/gnomeclock.if b/policy/modules/services/gnomeclock.if
new file mode 100644
index 000000000..3f55702fb
--- /dev/null
+++ b/policy/modules/services/gnomeclock.if
@@ -0,0 +1,90 @@
+## <summary>Gnome clock handler for setting the time.</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to
+##	run gnomeclock.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`gnomeclock_domtrans',`
+	gen_require(`
+		type gnomeclock_t, gnomeclock_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, gnomeclock_exec_t, gnomeclock_t)
+')
+
+########################################
+## <summary>
+##	Execute gnomeclock in the gnomeclock
+##	domain, and allow the specified
+##	role the gnomeclock domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`gnomeclock_run',`
+	gen_require(`
+		attribute_role gnomeclock_roles;
+	')
+
+	gnomeclock_domtrans($1)
+	roleattribute $2 gnomeclock_roles;
+')
+
+########################################
+## <summary>
+##	Send and receive messages from
+##	gnomeclock over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gnomeclock_dbus_chat',`
+	gen_require(`
+		type gnomeclock_t;
+		class dbus send_msg;
+	')
+
+	allow $1 gnomeclock_t:dbus send_msg;
+	allow gnomeclock_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send and
+##	receive messages from gnomeclock
+##	over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`gnomeclock_dontaudit_dbus_chat',`
+	gen_require(`
+		type gnomeclock_t;
+		class dbus send_msg;
+	')
+
+	dontaudit $1 gnomeclock_t:dbus send_msg;
+	dontaudit gnomeclock_t $1:dbus send_msg;
+')