selinux-policy/policy/modules/roles/secadm.te

policy_module(secadm, 2.0.0)

########################################
#
# Declarations
#

role secadm_r;

userdom_unpriv_user_template(secadm)
userdom_security_admin_template(secadm_t, secadm_r)

########################################
#
# Local policy
#

allow secadm_t self:capability { dac_read_search dac_override };

corecmd_exec_shell(secadm_t)

dev_relabel_all_dev_nodes(secadm_t)

domain_obj_id_change_exemption(secadm_t)

mls_process_read_up(secadm_t)
mls_file_read_all_levels(secadm_t)
mls_file_write_all_levels(secadm_t)
mls_file_upgrade(secadm_t)
mls_file_downgrade(secadm_t)

auth_role(secadm_r, secadm_t)
auth_relabel_all_files_except_shadow(secadm_t)
auth_relabel_shadow(secadm_t)

init_exec(secadm_t)

logging_read_audit_log(secadm_t)
logging_read_generic_logs(secadm_t)
logging_read_audit_config(secadm_t)

optional_policy(`
	aide_run(secadm_t, secadm_r)
')

optional_policy(`
	apache_role(secadm_r, secadm_t)
')

optional_policy(`
	auditadm_role_change(secadm_r)
')

optional_policy(`
	bluetooth_role(secadm_r, secadm_t)
')

optional_policy(`
	cdrecord_role(secadm_r, secadm_t)
')

optional_policy(`
	cron_role(secadm_r, secadm_t)
')

optional_policy(`
	dbus_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	dmesg_exec(secadm_t)
')

optional_policy(`
	ethereal_role(secadm_r, secadm_t)
')

optional_policy(`
	evolution_role(secadm_r, secadm_t)
')

optional_policy(`
	games_role(secadm_r, secadm_t)
')

optional_policy(`
	gift_role(secadm_r, secadm_t)
')

optional_policy(`
	gnome_role(secadm_r, secadm_t)
')

optional_policy(`
	gpg_role(secadm_r, secadm_t)
')

optional_policy(`
	irc_role(secadm_r, secadm_t)
')

optional_policy(`
	java_role(secadm_r, secadm_t)
')

optional_policy(`
	lockdev_role(secadm_r, secadm_t)
')

optional_policy(`
	lpd_role(secadm_r, secadm_t)
')

optional_policy(`
	mozilla_role(secadm_r, secadm_t)
')

optional_policy(`
	mplayer_role(secadm_r, secadm_t)
')

optional_policy(`
	mta_role(secadm_r, secadm_t)
')

optional_policy(`
	netlabel_run_mgmt(secadm_t, secadm_r)
')

optional_policy(`
	oident_manage_user_content(secadm_t)
	oident_relabel_user_content(secadm_t)
')

optional_policy(`
	pyzor_role(secadm_r, secadm_t)
')

optional_policy(`
	razor_role(secadm_r, secadm_t)
')

optional_policy(`
	rssh_role(secadm_r, secadm_t)
')

optional_policy(`
	screen_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	spamassassin_role(secadm_r, secadm_t)
')

optional_policy(`
	ssh_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	su_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	sudo_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	sysadm_role_change(secadm_r)
')

optional_policy(`
	thunderbird_role(secadm_r, secadm_t)
')

optional_policy(`
	tvtime_role(secadm_r, secadm_t)
')

optional_policy(`
	uml_role(secadm_r, secadm_t)
')

optional_policy(`
	userhelper_role_template(secadm, secadm_r, secadm_t)
')

optional_policy(`
	vmware_role(secadm_r, secadm_t)
')

optional_policy(`
	wireshark_role(secadm_r, secadm_t)
')

optional_policy(`
	xserver_role(secadm_r, secadm_t)
')