selinux-policy/refpolicy/policy/modules/system/domain.te

38 lines
1012 B
Plaintext
Raw Normal View History

2005-04-20 19:07:16 +00:00
policy_module(domain,1.0)
2005-06-30 18:54:08 +00:00
########################################
#
# Declarations
#
2005-04-14 20:18:17 +00:00
# Mark process types as domains
attribute domain;
# entrypoint executables
attribute entry_type;
# widely-inheritable file descriptors
attribute privfd;
2005-06-23 15:37:39 +00:00
# Domains that can set their current context
# (perform dynamic transitions)
attribute set_curr_context;
# constraint related attributes
attribute can_change_process_identity;
attribute can_change_process_role;
attribute can_change_object_identity;
# Transitions only allowed from domains to other domains
2005-04-14 20:18:17 +00:00
neverallow domain ~domain:process { transition dyntransition };
2005-06-09 21:07:58 +00:00
# enabling setcurrent breaks process tranquility. If you do not
# know what this means or do not understand the implications of a
# dynamic transition, you should not be using it!!!
2005-06-23 15:37:39 +00:00
neverallow { domain -set_curr_context } self:process setcurrent;
# Files with domain types are currently only proc files
neverallow * domain:dir ~r_dir_perms;
neverallow * domain:file_class_set ~rw_file_perms;