47 lines
1.1 KiB
Plaintext
47 lines
1.1 KiB
Plaintext
|
#
|
||
|
|
# Macros for lockdev domains.
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# Authors: Daniel Walsh <dwalsh@redhat.com>
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# lockdev_domain(domain_prefix)
|
||
|
|
#
|
||
|
|
# Define a derived domain for the lockdev programs when executed
|
||
|
|
# by a user domain.
|
||
|
|
#
|
||
|
|
# The type declaration for the executable type for this program is
|
||
|
|
# provided separately in domains/program/lockdev.te.
|
||
|
|
#
|
||
|
|
undefine(`lockdev_domain')
|
||
|
|
define(`lockdev_domain',`
|
||
|
|
# Derived domain based on the calling user domain and the program
|
||
|
|
type $1_lockdev_t, domain, privlog;
|
||
|
|
# Transition from the user domain to the derived domain.
|
||
|
|
domain_auto_trans($1_t, lockdev_exec_t, $1_lockdev_t)
|
||
|
|
|
||
|
|
# The user role is authorized for this domain.
|
||
|
|
role $1_r types $1_lockdev_t;
|
||
|
|
# Use capabilities.
|
||
|
|
allow $1_lockdev_t self:capability setgid;
|
||
|
|
allow $1_lockdev_t $1_t:process signull;
|
||
|
|
|
||
|
|
allow $1_lockdev_t var_t:dir search;
|
||
|
|
|
||
|
|
lock_domain($1_lockdev)
|
||
|
|
|
||
|
|
r_dir_file($1_lockdev_t, lockfile)
|
||
|
|
|
||
|
|
allow $1_lockdev_t device_t:dir search;
|
||
|
|
allow $1_lockdev_t null_device_t:chr_file rw_file_perms;
|
||
|
|
access_terminal($1_lockdev_t, $1)
|
||
|
|
dontaudit $1_lockdev_t root_t:dir search;
|
||
|
|
|
||
|
|
uses_shlib($1_lockdev_t)
|
||
|
|
allow $1_lockdev_t fs_t:filesystem getattr;
|
||
|
|
|
||
|
|
')dnl end macro definition
|
||
|
|
|