2010-09-15 12:20:16 +00:00
|
|
|
policy_module(staff, 2.1.2)
|
2008-04-29 13:58:34 +00:00
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# Declarations
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
role staff_r;
|
|
|
|
|
|
|
|
|
|
userdom_unpriv_user_template(staff)
|
2010-08-26 13:41:21 +00:00
|
|
|
fs_exec_noxattr(staff_t)
|
|
|
|
|
|
|
|
|
|
# needed for sandbox
|
|
|
|
|
allow staff_t self:process setexec;
|
2008-04-29 13:58:34 +00:00
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
#
|
|
|
|
|
# Local policy
|
|
|
|
|
#
|
|
|
|
|
|
2010-08-26 13:41:21 +00:00
|
|
|
kernel_read_ring_buffer(staff_usertype)
|
|
|
|
|
kernel_getattr_core_if(staff_usertype)
|
|
|
|
|
kernel_getattr_message_if(staff_usertype)
|
|
|
|
|
kernel_read_software_raid_state(staff_usertype)
|
2010-08-26 16:55:57 +00:00
|
|
|
kernel_read_fs_sysctls(staff_usertype)
|
|
|
|
|
|
|
|
|
|
domain_read_all_domains_state(staff_usertype)
|
|
|
|
|
domain_getattr_all_domains(staff_usertype)
|
|
|
|
|
domain_obj_id_change_exemption(staff_t)
|
|
|
|
|
|
|
|
|
|
files_read_kernel_modules(staff_usertype)
|
|
|
|
|
|
|
|
|
|
seutil_read_module_store(staff_t)
|
|
|
|
|
seutil_run_newrole(staff_t, staff_r)
|
|
|
|
|
|
|
|
|
|
term_use_unallocated_ttys(staff_usertype)
|
2010-08-26 13:41:21 +00:00
|
|
|
|
|
|
|
|
auth_domtrans_pam_console(staff_t)
|
|
|
|
|
|
|
|
|
|
init_dbus_chat(staff_t)
|
|
|
|
|
init_dbus_chat_script(staff_t)
|
|
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
miscfiles_read_hwdata(staff_usertype)
|
|
|
|
|
|
|
|
|
|
modutils_read_module_config(staff_usertype)
|
|
|
|
|
modutils_read_module_deps(staff_usertype)
|
|
|
|
|
|
2010-08-26 13:41:21 +00:00
|
|
|
netutils_run_ping(staff_t, staff_r)
|
|
|
|
|
netutils_signal_ping(staff_t)
|
|
|
|
|
|
2008-04-29 13:58:34 +00:00
|
|
|
optional_policy(`
|
2008-11-05 16:10:46 +00:00
|
|
|
apache_role(staff_r, staff_t)
|
2008-04-29 13:58:34 +00:00
|
|
|
')
|
|
|
|
|
|
2010-08-26 13:41:21 +00:00
|
|
|
optional_policy(`
|
2008-11-05 16:10:46 +00:00
|
|
|
auditadm_role_change(staff_r)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
2008-04-29 13:58:34 +00:00
|
|
|
optional_policy(`
|
2010-08-19 12:41:39 +00:00
|
|
|
dbadm_role_change(staff_r)
|
2008-04-29 13:58:34 +00:00
|
|
|
')
|
|
|
|
|
|
2010-08-19 12:41:39 +00:00
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
accountsd_dbus_chat(staff_t)
|
|
|
|
|
accountsd_read_lib_files(staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
gnomeclock_dbus_chat(staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
firewallgui_dbus_chat(staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
lpd_list_spool(staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
kerneloops_dbus_chat(staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
logadm_role_change(staff_r)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
mozilla_run_plugin(staff_t, staff_r)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
2010-09-10 17:18:49 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
oident_manage_user_content(staff_t)
|
|
|
|
|
oident_relabel_user_content(staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
2010-08-26 13:41:21 +00:00
|
|
|
optional_policy(`
|
2010-08-26 16:55:57 +00:00
|
|
|
postgresql_role(staff_r, staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
rtkit_scheduled(staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
rpm_dbus_chat(staff_usertype)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-07-21 14:39:57 +00:00
|
|
|
secadm_role_change(staff_r)
|
2008-11-05 16:10:46 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
sandbox_transition(staff_t, staff_r)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-08-26 16:55:57 +00:00
|
|
|
screen_role_template(staff, staff_r, staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
2008-11-05 16:10:46 +00:00
|
|
|
optional_policy(`
|
2010-07-21 14:39:57 +00:00
|
|
|
sysadm_role_change(staff_r)
|
|
|
|
|
userdom_dontaudit_use_user_terminals(staff_t)
|
2008-11-05 16:10:46 +00:00
|
|
|
')
|
2010-09-16 11:05:26 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
setroubleshoot_stream_connect(staff_t)
|
|
|
|
|
setroubleshoot_dbus_chat(staff_t)
|
|
|
|
|
setroubleshoot_dbus_chat_fixit(staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
2010-08-26 13:41:21 +00:00
|
|
|
optional_policy(`
|
2010-08-26 16:55:57 +00:00
|
|
|
ssh_role_template(staff, staff_r, staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-08-26 16:55:57 +00:00
|
|
|
sudo_role_template(staff, staff_r, staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
telepathy_dbus_session_role(staff_r, staff_t)
|
2010-08-19 12:41:39 +00:00
|
|
|
')
|
|
|
|
|
|
2008-11-05 16:10:46 +00:00
|
|
|
optional_policy(`
|
2010-09-16 11:05:26 +00:00
|
|
|
userhelper_console_role_template(staff, staff_r, staff_usertype)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
unconfined_role_change(staff_r)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
virt_stream_connect(staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
2010-09-16 21:46:06 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
vnstatd_read_lib_files(staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
2010-09-16 11:05:26 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
webadm_role_change(staff_r)
|
2008-11-05 16:10:46 +00:00
|
|
|
')
|
|
|
|
|
|
2010-08-26 13:41:21 +00:00
|
|
|
optional_policy(`
|
2010-08-26 16:55:57 +00:00
|
|
|
xserver_role(staff_r, staff_t)
|
2010-08-26 13:41:21 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
ifndef(`distro_redhat',`
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
auth_role(staff_r, staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
bluetooth_role(staff_r, staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
cdrecord_role(staff_r, staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
cron_role(staff_r, staff_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
dbus_role_template(staff, staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
evolution_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
games_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
gift_role(staff_r, staff_t)
|
|
|
|
|
')
|
2008-11-05 16:10:46 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
gnome_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
gpg_role(staff_r, staff_t)
|
|
|
|
|
')
|
2008-11-05 16:10:46 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
irc_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
java_role(staff_r, staff_t)
|
|
|
|
|
')
|
2008-11-05 16:10:46 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
lockdev_role(staff_r, staff_t)
|
|
|
|
|
')
|
2008-11-05 16:10:46 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
lpd_role(staff_r, staff_t)
|
|
|
|
|
')
|
2008-11-05 16:10:46 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
mozilla_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
mplayer_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
mta_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
pyzor_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
razor_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
rssh_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
spamassassin_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
su_role_template(staff, staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
thunderbird_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
tvtime_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
uml_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
userhelper_role_template(staff, staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
vmware_role(staff_r, staff_t)
|
|
|
|
|
')
|
2010-08-26 13:41:21 +00:00
|
|
|
|
2010-08-26 16:55:57 +00:00
|
|
|
optional_policy(`
|
|
|
|
|
wireshark_role(staff_r, staff_t)
|
|
|
|
|
')
|
|
|
|
|
')
|
