65 lines
1.6 KiB
Plaintext
65 lines
1.6 KiB
Plaintext
|
#
|
||
|
|
# Macros for locate domains.
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# locate_domain(domain_prefix)
|
||
|
|
#
|
||
|
|
# Define a derived domain for the locate program when executed
|
||
|
|
# by a user domain.
|
||
|
|
#
|
||
|
|
# The type declaration for the executable type for this program is
|
||
|
|
# provided separately in domains/program/locate.te.
|
||
|
|
#
|
||
|
|
undefine(`locate_domain')
|
||
|
|
ifdef(`slocate.te', `
|
||
|
|
define(`locate_domain',`
|
||
|
|
# Derived domain based on the calling user domain and the program.
|
||
|
|
type $1_locate_t, domain;
|
||
|
|
|
||
|
|
allow $1_locate_t self:process signal;
|
||
|
|
|
||
|
|
allow $1_locate_t etc_t:file { getattr read };
|
||
|
|
allow $1_locate_t self:unix_stream_socket create_socket_perms;
|
||
|
|
r_dir_file($1_locate_t,locate_var_lib_t)
|
||
|
|
allow $1_locate_t var_lib_t:dir search;
|
||
|
|
|
||
|
|
# Transition from the user domain to this domain.
|
||
|
|
domain_auto_trans($1_t, locate_exec_t, $1_locate_t)
|
||
|
|
|
||
|
|
# The user role is authorized for this domain.
|
||
|
|
role $1_r types $1_locate_t;
|
||
|
|
|
||
|
|
# Inherit and use descriptors from gnome-pty-helper.
|
||
|
|
ifdef(`gnome-pty-helper.te', `
|
||
|
|
allow $1_locate_t $1_gph_t:fd use;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow $1_locate_t privfd:fd use;
|
||
|
|
|
||
|
|
# allow ps to show locate
|
||
|
|
can_ps($1_t, $1_locate_t)
|
||
|
|
allow $1_t $1_locate_t:process signal;
|
||
|
|
|
||
|
|
uses_shlib($1_locate_t)
|
||
|
|
access_terminal($1_locate_t, $1)
|
||
|
|
|
||
|
|
allow $1_locate_t { home_root_t $1_home_dir_t $1_file_type }:dir { getattr search };
|
||
|
|
allow $1_locate_t $1_file_type:{ file lnk_file } { getattr read };
|
||
|
|
|
||
|
|
base_file_read_access($1_locate_t)
|
||
|
|
r_dir_file($1_locate_t, { etc_t lib_t var_t })
|
||
|
|
dontaudit $1_locate_t { fs_type file_type }:dir r_dir_perms;
|
||
|
|
dontaudit $1_locate_t { fs_type file_type -shadow_t}:file { getattr read };
|
||
|
|
')
|
||
|
|
|
||
|
|
', `
|
||
|
|
|
||
|
|
define(`locate_domain',`')
|
||
|
|
|
||
|
|
')
|