[root@olmrs31 SOURCES]# cat serefpolicy-2.4.6/policy/modules/apps/jboss.fc

/var/run/jboss\.pid     --
gen_context(system_u:object_r:jboss_var_run_t, s0)
/opt/jboss-4.2.2.GA/bin(/.*)?
gen_context(system_u:object_r:jboss_exec_t, s0)
/var/log/jboss(/.*)?
gen_context(system_u:object_r:jboss_log_t, s0)
/opt/jboss-4.2.2.GA(/.*)?
gen_context(system_u:object_r:jboss_opt_t, s0)
[root@olmrs31 SOURCES]#

[root@olmrs31 SOURCES]# cat serefpolicy-2.4.6/policy/modules/apps/jboss.if

## <summary>policy for jboss</summary>

########################################
## <summary>
##      Execute a domain transition to run jboss.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed to transition.
## </summary>
## </param>
#
interface(`jboss_domtrans',`
        gen_require(`
                type jboss_t, jboss_exec_t;
        ')

        domain_auto_trans($1,jboss_exec_t,jboss_t)

        allow jboss_t $1:fd use;
        allow jboss_t $1:fifo_file rw_file_perms;
        allow jboss_t $1:process sigchld;
')

########################################
## <summary>
##      Do not audit attempts to read,
##      jboss tmp files
## </summary>
## <param name="domain">
##      <summary>
##      Domain to not audit.
##      </summary>
## </param>
#
interface(`jboss_dontaudit_read_tmp_files',`
        gen_require(`
                type jboss_tmp_t;
        ')

        dontaudit $1 jboss_tmp_t:file r_file_perms;
')

########################################
## <summary>
##      Allow domain to read, jboss tmp files
## </summary>
## <param name="domain">
##      <summary>
##      Domain to not audit.
##      </summary>
## </param>
#
interface(`jboss_read_tmp_files',`
        gen_require(`
                type jboss_tmp_t;
        ')

        dontaudit $1 jboss_tmp_t:file r_file_perms;
')

########################################
## <summary>
##      Search jboss rw directories.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`jboss_search_rw_dir',`
        gen_require(`
                type jboss_rw_t;
        ')

        allow $1 jboss_rw_t:dir search_dir_perms;
        files_search_rw($1)
')

########################################
## <summary>
##      Read jboss rw files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`jboss_read_rw_files',`
        gen_require(`
                type jboss_rw_t;
        ')

        allow $1 jboss_rw_t:file r_file_perms;
        allow $1 jboss_rw_t:dir list_dir_perms;
        files_search_rw($1)
')

########################################
## <summary>
##      Create, read, write, and delete
##      jboss rw files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`jboss_manage_rw_files',`
        gen_require(`
                type jboss_rw_t;
        ')

        allow $1 jboss_rw_t:file manage_file_perms;
        allow $1 jboss_rw_t:dir rw_dir_perms;
')
########################################

## <summary>
##      Allow the specified domain to write jboss log files.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed to transition.
## </summary>
## </param>
## <rolecap/>
#
interface(`jboss_write_log',`
        gen_require(`
                type jboss_log_t;
        ')

        logging_search_logs($1)
        allow $1 jboss_log_t:dir list_dir_perms;

#allow java_t jboss_log_t:file { write getattr };
        allow $1 jboss_log_t:file rw_dir_perms;

        allow $1 jboss_log_t:file read_file_perms;
        write_files_pattern($1,jboss_log_t,jboss_log_t);

#allow java_t jboss_log_t:dir { getattr search };
        allow $1 jboss_log_t:dir search_dir_perms;
        allow $1 jboss_log_t:dir getattr_dir_perms;

#       allow $1 jboss_log_t:file write_file_perms
')
[root@olmrs31 SOURCES]#

[root@olmrs31 SOURCES]# cat serefpolicy-2.4.6/policy/modules/apps/jboss.te
policy_module(jboss,1.1.0)

########################################
#
# Declarations
#

type jboss_t;
type jboss_exec_t;
domain_type(jboss_t)
init_daemon_domain(jboss_t, jboss_exec_t)

require {
        type sysadm_javaplugin_t;
        class lnk_file read;
        class file write;
}

type jboss_log_t;
logging_log_file(jboss_log_t)
type jboss_tmp_t;
files_tmp_file(jboss_tmp_t)
type jboss_opt_t;
type jboss_var_run_t;
type jboss_rw_t;
files_type(jboss_rw_t)
########################################
#
# jboss local policy
#

# Init script handling
domain_use_interactive_fds(jboss_t)

## internal communication is often done using fifo and unix sockets.
allow jboss_t self:fifo_file rw_file_perms;
allow jboss_t self:unix_stream_socket create_stream_socket_perms;

#allow jboss_t jboss_tmp_t:file manage_file_perms;
#allow jboss_t jboss_tmp_t:dir create_dir_perms;
#files_pid_filetrans(jboss_t,jboss_tmp_t, { file dir })

allow jboss_t jboss_rw_t:file manage_file_perms;
allow jboss_t jboss_rw_t:dir create_dir_perms;
files_pid_filetrans(jboss_t,jboss_rw_t, { file dir })

sysnet_dns_name_resolve(jboss_t)
corenet_non_ipsec_sendrecv(jboss_t)

allow jboss_t self:tcp_socket create_stream_socket_perms;
corenet_tcp_sendrecv_all_if(jboss_t)
corenet_tcp_sendrecv_all_nodes(jboss_t)
corenet_tcp_sendrecv_all_ports(jboss_t)
corenet_tcp_bind_all_nodes(jboss_t)
corenet_tcp_bind_http_cache_port(jboss_t)

#============= sysadm_javaplugin_t ==============
allow sysadm_javaplugin_t jboss_log_t:file write;

[root@olmrs31 SOURCES]#


[root@olmrs31 SOURCES]# cat serefpolicy-2.4.6/policy/modules/apps/java.te

policy_module(java,1.2.1)

########################################
#
# Declarations
#

type java_t;
type java_exec_t;
init_system_domain(java_t,java_exec_t)

#Java needs access to jboss_log_t
jboss_write_log(java_t);

#Java needs access to libs
libs_read_lib_files(java_t)
########################################
#
# Local policy
#

ifdef(`targeted_policy',`
        # execheap is needed for itanium/BEA jrocket
        allow java_t self:process { execstack execmem execheap };
        unconfined_domain_noaudit(java_t)
        role system_r types java_t;
        unconfined_dbus_chat(java_t)
        init_dbus_chat_script(java_t)
')
[root@olmrs31 SOURCES]#