2005-04-20 19:07:16 +00:00
|
|
|
|
2005-04-26 17:00:25 +00:00
|
|
|
policy_module(domain,1.0)
|
|
|
|
|
|
2005-04-14 20:18:17 +00:00
|
|
|
# Mark process types as domains
|
|
|
|
|
attribute domain;
|
|
|
|
|
|
2005-04-26 17:00:25 +00:00
|
|
|
# entrypoint executables
|
|
|
|
|
attribute entry_type;
|
|
|
|
|
|
2005-04-22 19:31:32 +00:00
|
|
|
# widely-inheritable file descriptors
|
|
|
|
|
attribute privfd;
|
|
|
|
|
|
2005-04-14 20:18:17 +00:00
|
|
|
neverallow domain ~domain:process { transition dyntransition };
|
2005-06-09 21:07:58 +00:00
|
|
|
|
|
|
|
|
# enabling setcurrent breaks process tranquility. If you do not
|
|
|
|
|
# know what this means or do not understand the implications of a
|
|
|
|
|
# dynamic transition, you should not be using it!!!
|
|
|
|
|
neverallow * *:process setcurrent;
|
