selinux-policy/strict/domains/admin.te

44 lines
1.2 KiB
Plaintext
Raw Normal View History

2005-04-29 17:45:15 +00:00
#DESC Admin - Domains for administrators.
#
#################################
# sysadm_t is the system administrator domain.
type sysadm_t, domain, privlog, privowner, admin, userdomain, web_client_domain, privhome, etc_writer, privmodule, nscd_client_domain
ifdef(`direct_sysadm_daemon', `, priv_system_role')
; dnl end of sysadm_t type declaration
allow privhome home_root_t:dir { getattr search };
# system_r is authorized for sysadm_t for single-user mode.
role system_r types sysadm_t;
general_proc_read_access(sysadm_t)
# sysadm_t is also granted permissions specific to administrator domains.
admin_domain(sysadm)
# for su
allow sysadm_t userdomain:fd use;
2005-09-19 21:17:45 +00:00
ifdef(`separate_secadm', `', `
security_manager_domain(sysadm_t)
')
2005-04-29 17:45:15 +00:00
# Add/remove user home directories
file_type_auto_trans(sysadm_t, home_root_t, user_home_dir_t, dir)
2005-09-19 21:17:45 +00:00
limited_user_role(secadm)
typeattribute secadm_t admin;
role secadm_r types secadm_t;
security_manager_domain(secadm_t)
r_dir_file(secadm_t, { var_t var_log_t })
typeattribute secadm_tty_device_t admin_tty_type;
typeattribute secadm_devpts_t admin_tty_type;
bool allow_ptrace false;
if (allow_ptrace) {
can_ptrace(sysadm_t, domain)
}