selinux-policy/refpolicy/policy/modules/system/unconfined.te


policy_module(unconfined,1.1.4)

########################################
#
# Declarations
#

# real declaration moved to mls until
# range_transition works in loadable modules
gen_require(`
	type unconfined_t;
')
type unconfined_exec_t;
init_system_domain(unconfined_t,unconfined_exec_t)
role system_r types unconfined_t;

########################################
#
# Local policy
#

unconfined_domain_template(unconfined_t)

logging_send_syslog_msg(unconfined_t)

ifdef(`targeted_policy',`
	allow unconfined_t self:system syslog_read;
	dontaudit unconfined_t self:capability sys_module;

	files_create_boot_flag(unconfined_t)

	init_domtrans_script(unconfined_t)

	libs_domtrans_ldconfig(unconfined_t)

	logging_domtrans_auditctl(unconfined_t)

	seutil_domtrans_restorecon(unconfined_t)

	userdom_unconfined(unconfined_t)
	userdom_priveleged_home_dir_manager(unconfined_t)

	optional_policy(`amanda',`
		amanda_domtrans_recover(unconfined_t)
	')

	optional_policy(`apache',`
		apache_domtrans_helper(unconfined_t)
	')

	optional_policy(`bind',`
		bind_domtrans_ndc(unconfined_t)
	')

	optional_policy(`bluetooth',`
		bluetooth_domtrans_helper(unconfined_t)
	')

	optional_policy(`dbus',`
		dbus_stub(unconfined_t)

		optional_policy(`avahi',`
			avahi_dbus_chat(unconfined_t)
		')

		optional_policy(`bluetooth',`
			bluetooth_dbus_chat(unconfined_t)
		')

		optional_policy(`cups',`
			cups_dbus_chat_config(unconfined_t)
		')

		optional_policy(`hal',`
			hal_dbus_chat(unconfined_t)
		')

		optional_policy(`networkmanager',`
			networkmanager_dbus_chat(unconfined_t)
		')
	')

	optional_policy(`dmidecode',`
		dmidecode_domtrans(unconfined_t)
	')

	optional_policy(`firstboot',`
		firstboot_domtrans(unconfined_t)
	')

	optional_policy(`lpd',`
		lpd_domtrans_checkpc(unconfined_t)
	')

	optional_policy(`modutils',`
		modutils_domtrans_update_mods(unconfined_t)
	')

	optional_policy(`netutils',`
		netutils_domtrans_ping(unconfined_t)
	')

	optional_policy(`portmap',`
		portmap_domtrans_helper(unconfined_t)
	')

	optional_policy(`postfix',`
		postfix_domtrans_map(unconfined_t)
		# cjp: this should probably be removed:
		postfix_domtrans_master(unconfined_t)
	')

	optional_policy(`rpc',`
		# cjp: this should probably be removed:
		rpc_domtrans_nfsd(unconfined_t)
	')

	optional_policy(`rpm',`
		rpm_domtrans(unconfined_t)
	')

	optional_policy(`samba',`
		samba_domtrans_net(unconfined_t)
		samba_domtrans_winbind_helper(unconfined_t)
	')

	optional_policy(`sendmail',`
		sendmail_domtrans(unconfined_t)
	')

	optional_policy(`su',`
		su_per_userdomain_template(sysadm,unconfined_t,system_r)
	')

	optional_policy(`sysnetwork',`
		sysnet_domtrans_dhcpc(unconfined_t)
	')

	optional_policy(`usermanage',`
		usermanage_domtrans_admin_passwd(unconfined_t)
	')

	optional_policy(`webalizer',`
		webalizer_domtrans(unconfined_t)
	')

	ifdef(`TODO',`
	ifdef(`use_mcs',`
	rw_dir_create_file(sysadm_su_t, home_dir_type)
	')
	allow unconfined_t initrc_t : dbus { send_msg acquire_svc };
	allow initrc_t unconfined_t : dbus { send_msg acquire_svc };
	') dnl end TODO
')
add unconfined 2005-07-05 20:59:51 +00:00
patch from dan. 2006-01-11 15:28:14 +00:00			`policy_module(unconfined,1.1.4)`
add unconfined 2005-07-05 20:59:51 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`# real declaration moved to mls until`
			`# range_transition works in loadable modules`
			gen_require(`
			`type unconfined_t;`
			`')`
add unconfined 2005-07-05 20:59:51 +00:00			`type unconfined_exec_t;`
			`init_system_domain(unconfined_t,unconfined_exec_t)`
			`role system_r types unconfined_t;`

			`########################################`
			`#`
			`# Local policy`
			`#`

support for targeted policy 2005-07-06 20:28:29 +00:00			`unconfined_domain_template(unconfined_t)`
another round of TODO cleanup 2005-07-08 20:44:57 +00:00
add unconfined 2005-07-05 20:59:51 +00:00			`logging_send_syslog_msg(unconfined_t)`

support for targeted policy 2005-07-06 20:28:29 +00:00			ifdef(`targeted_policy',`
			`allow unconfined_t self:system syslog_read;`
tty and caps fixes 2005-11-01 15:34:00 +00:00			`dontaudit unconfined_t self:capability sys_module;`
support for targeted policy 2005-07-06 20:28:29 +00:00
more fix 2005-11-09 15:51:22 +00:00			`files_create_boot_flag(unconfined_t)`

another round of TODO cleanup 2005-07-08 20:44:57 +00:00			`init_domtrans_script(unconfined_t)`

add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`libs_domtrans_ldconfig(unconfined_t)`

			`logging_domtrans_auditctl(unconfined_t)`

			`seutil_domtrans_restorecon(unconfined_t)`

support for targeted policy 2005-07-06 20:28:29 +00:00			`userdom_unconfined(unconfined_t)`
easy fixes 2005-10-25 19:03:15 +00:00			`userdom_priveleged_home_dir_manager(unconfined_t)`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`amanda',`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`amanda_domtrans_recover(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`apache',`
more fixes 2005-10-31 22:19:16 +00:00			`apache_domtrans_helper(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`bind',`
more transition work 2005-10-27 15:16:42 +00:00			`bind_domtrans_ndc(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`bluetooth',`
more transition work 2005-10-27 15:16:42 +00:00			`bluetooth_domtrans_helper(unconfined_t)`
			`')`

clean up networkmanager hacks 2005-11-25 16:43:03 +00:00			optional_policy(`dbus',`
			`dbus_stub(unconfined_t)`

fix several modular build problems 2005-11-29 21:27:15 +00:00			optional_policy(`avahi',`
			`avahi_dbus_chat(unconfined_t)`
			`')`

many loadable module build fixes 2005-12-02 22:06:05 +00:00			optional_policy(`bluetooth',`
			`bluetooth_dbus_chat(unconfined_t)`
			`')`

			optional_policy(`cups',`
			`cups_dbus_chat_config(unconfined_t)`
			`')`

fix several modular build problems 2005-11-29 21:27:15 +00:00			optional_policy(`hal',`
			`hal_dbus_chat(unconfined_t)`
			`')`

clean up networkmanager hacks 2005-11-25 16:43:03 +00:00			optional_policy(`networkmanager',`
			`networkmanager_dbus_chat(unconfined_t)`
			`')`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`dmidecode',`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`dmidecode_domtrans(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`firstboot',`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`firstboot_domtrans(unconfined_t)`
pile o fixes 2005-10-26 16:00:13 +00:00			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`lpd',`
pile o fixes 2005-10-26 16:00:13 +00:00			`lpd_domtrans_checkpc(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`modutils',`
easy fixes 2005-10-25 19:03:15 +00:00			`modutils_domtrans_update_mods(unconfined_t)`
			`')`
support for targeted policy 2005-07-06 20:28:29 +00:00
Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`netutils',`
more transition work 2005-10-27 15:16:42 +00:00			`netutils_domtrans_ping(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`portmap',`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`portmap_domtrans_helper(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`postfix',`
more postfix work 2005-10-25 00:00:50 +00:00			`postfix_domtrans_map(unconfined_t)`
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`# cjp: this should probably be removed:`
			`postfix_domtrans_master(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`rpc',`
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`# cjp: this should probably be removed:`
			`rpc_domtrans_nfsd(unconfined_t)`
more postfix work 2005-10-25 00:00:50 +00:00			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`rpm',`
fix rpm transition 2005-10-26 13:51:33 +00:00			`rpm_domtrans(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`samba',`
fix most of samba 2005-10-24 21:33:46 +00:00			`samba_domtrans_net(unconfined_t)`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`samba_domtrans_winbind_helper(unconfined_t)`
fix most of samba 2005-10-24 21:33:46 +00:00			`')`

patch from dan. 2006-01-11 15:28:14 +00:00			optional_policy(`sendmail',`
			`sendmail_domtrans(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`su',`
sediff fixes 2005-10-24 12:38:45 +00:00			`su_per_userdomain_template(sysadm,unconfined_t,system_r)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`sysnetwork',`
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`sysnet_domtrans_dhcpc(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`usermanage',`
more fix 2005-11-09 15:51:22 +00:00			`usermanage_domtrans_admin_passwd(unconfined_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`webalizer',`
sediff fixes 2005-10-27 14:52:37 +00:00			`webalizer_domtrans(unconfined_t)`
			`')`

support for targeted policy 2005-07-06 20:28:29 +00:00			ifdef(`TODO',`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			ifdef(`use_mcs',`
			`rw_dir_create_file(sysadm_su_t, home_dir_type)`
			`')`
add back rules that were mistakenly removed 2005-12-05 15:00:29 +00:00			`allow unconfined_t initrc_t : dbus { send_msg acquire_svc };`
			`allow initrc_t unconfined_t : dbus { send_msg acquire_svc };`
support for targeted policy 2005-07-06 20:28:29 +00:00			`') dnl end TODO`
			`')`