selinux-policy/policy/modules/kernel/corecommands.te

policy_module(corecommands, 1.13.1)

########################################
#
# Declarations
#

#
# Types with the exec_type attribute are executable files.
#
attribute exec_type;

#
# bin_t is the type of files in the system bin/sbin directories.
#
type bin_t alias { ls_exec_t sbin_t };
corecmd_executable_file(bin_t)
dev_associate(bin_t)	#For /dev/MAKEDEV

#
# shell_exec_t is the type of user shells such as /bin/bash.
#
type shell_exec_t;
corecmd_executable_file(shell_exec_t)

type chroot_exec_t;
corecmd_executable_file(chroot_exec_t)
Corecommands patch from Dan Walsh. Lots of new places to stick bin_t files 2010-06-07 13:04:08 +00:00			`policy_module(corecommands, 1.13.1)`
add module statement macro and entrypoint executable attribute to replicate can_exec($1,exec_type) 2005-04-26 17:00:25 +00:00
more work on current modules 2005-06-30 18:54:08 +00:00			`########################################`
			`#`
			`# Declarations`
			`#`

add concept of executables, and update policies which really want this intead of entrypoints 2006-04-19 21:43:02 +00:00			`#`
			`# Types with the exec_type attribute are executable files.`
			`#`
			`attribute exec_type;`

initial commit 2005-04-14 20:18:17 +00:00			`#`
Merge sbin_t and ls_exec_t into bin_t. 2007-03-23 23:24:59 +00:00			`# bin_t is the type of files in the system bin/sbin directories.`
initial commit 2005-04-14 20:18:17 +00:00			`#`
Merge sbin_t and ls_exec_t into bin_t. 2007-03-23 23:24:59 +00:00			`type bin_t alias { ls_exec_t sbin_t };`
add concept of executables, and update policies which really want this intead of entrypoints 2006-04-19 21:43:02 +00:00			`corecmd_executable_file(bin_t)`
Move devtmpfs to devices from filesystem Move devtmpfs to devices module (remove from filesystem module) Make device_t a filesystem Add interface for associating types with device_t filesystem (dev_associate) Call dev_associate from dev_filetrans Allow all device nodes associate with device_t filesystem Remove dev_tmpfs_filetrans_dev from kernel_t Remove fs_associate_tmpfs(initctl_t) - redundant, it was in dev_filetrans, now in dev_associate Mounton interface, to allow the kernel to mounton device_t Signed-off-by: Jeremy Solt <jsolt@tresys.com> 2010-08-18 15:36:34 +00:00			`dev_associate(bin_t) #For /dev/MAKEDEV`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
			`# shell_exec_t is the type of user shells such as /bin/bash.`
			`#`
			`type shell_exec_t;`
add concept of executables, and update policies which really want this intead of entrypoints 2006-04-19 21:43:02 +00:00			`corecmd_executable_file(shell_exec_t)`
initial commit 2005-04-14 20:18:17 +00:00
			`type chroot_exec_t;`
add concept of executables, and update policies which really want this intead of entrypoints 2006-04-19 21:43:02 +00:00			`corecmd_executable_file(chroot_exec_t)`