trunk: massive whitespace cleanup from dominick grift.
This commit is contained in:
parent
2b592aa495
commit
0bfccda4e8
@ -1,3 +1,4 @@
|
|||||||
|
- Large whitespace fix from Dominick Grift.
|
||||||
- Pam_mount fix for local login from Stefan Schulze Frielinghaus.
|
- Pam_mount fix for local login from Stefan Schulze Frielinghaus.
|
||||||
- Issuing commands to upstart is over a datagram socket, not the initctl
|
- Issuing commands to upstart is over a datagram socket, not the initctl
|
||||||
named pipe. Updated init_telinit() to match.
|
named pipe. Updated init_telinit() to match.
|
||||||
|
@ -16,7 +16,7 @@ interface(`acct_domtrans',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,acct_exec_t,acct_t)
|
domtrans_pattern($1, acct_exec_t, acct_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -35,7 +35,7 @@ interface(`acct_exec',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
can_exec($1,acct_exec_t)
|
can_exec($1, acct_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -56,7 +56,7 @@ interface(`acct_exec_data',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
files_search_var($1)
|
files_search_var($1)
|
||||||
can_exec($1,acct_data_t)
|
can_exec($1, acct_data_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -75,6 +75,6 @@ interface(`acct_manage_data',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
files_search_var($1)
|
files_search_var($1)
|
||||||
manage_files_pattern($1,acct_data_t,acct_data_t)
|
manage_files_pattern($1, acct_data_t, acct_data_t)
|
||||||
manage_lnk_files_pattern($1,acct_data_t,acct_data_t)
|
manage_lnk_files_pattern($1, acct_data_t, acct_data_t)
|
||||||
')
|
')
|
||||||
|
@ -8,7 +8,7 @@ policy_module(acct, 1.2.0)
|
|||||||
|
|
||||||
type acct_t;
|
type acct_t;
|
||||||
type acct_exec_t;
|
type acct_exec_t;
|
||||||
init_system_domain(acct_t,acct_exec_t)
|
init_system_domain(acct_t, acct_exec_t)
|
||||||
|
|
||||||
type acct_data_t;
|
type acct_data_t;
|
||||||
logging_log_file(acct_data_t)
|
logging_log_file(acct_data_t)
|
||||||
@ -26,10 +26,10 @@ dontaudit acct_t self:capability { kill sys_tty_config };
|
|||||||
allow acct_t self:fifo_file { read write getattr };
|
allow acct_t self:fifo_file { read write getattr };
|
||||||
allow acct_t self:process signal_perms;
|
allow acct_t self:process signal_perms;
|
||||||
|
|
||||||
manage_files_pattern(acct_t,acct_data_t,acct_data_t)
|
manage_files_pattern(acct_t, acct_data_t, acct_data_t)
|
||||||
manage_lnk_files_pattern(acct_t,acct_data_t,acct_data_t)
|
manage_lnk_files_pattern(acct_t, acct_data_t, acct_data_t)
|
||||||
|
|
||||||
can_exec(acct_t,acct_exec_t)
|
can_exec(acct_t, acct_exec_t)
|
||||||
|
|
||||||
kernel_list_proc(acct_t)
|
kernel_list_proc(acct_t)
|
||||||
kernel_read_system_state(acct_t)
|
kernel_read_system_state(acct_t)
|
||||||
@ -77,7 +77,7 @@ optional_policy(`
|
|||||||
auth_manage_login_records(acct_t)
|
auth_manage_login_records(acct_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
cron_system_entry(acct_t,acct_exec_t)
|
cron_system_entry(acct_t, acct_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
|
@ -12,8 +12,7 @@
|
|||||||
#
|
#
|
||||||
interface(`alsa_domtrans',`
|
interface(`alsa_domtrans',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type alsa_t;
|
type alsa_t, alsa_exec_t;
|
||||||
type alsa_exec_t;
|
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1, alsa_exec_t, alsa_t)
|
domtrans_pattern($1, alsa_exec_t, alsa_t)
|
||||||
@ -71,8 +70,8 @@ interface(`alsa_read_rw_config',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
allow $1 alsa_etc_rw_t:dir list_dir_perms;
|
allow $1 alsa_etc_rw_t:dir list_dir_perms;
|
||||||
read_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t)
|
read_files_pattern($1, alsa_etc_rw_t, alsa_etc_rw_t)
|
||||||
read_lnk_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t)
|
read_lnk_files_pattern($1, alsa_etc_rw_t, alsa_etc_rw_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -15,7 +15,7 @@ interface(`amanda_domtrans_recover',`
|
|||||||
type amanda_recover_t, amanda_recover_exec_t;
|
type amanda_recover_t, amanda_recover_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,amanda_recover_exec_t,amanda_recover_t)
|
domtrans_pattern($1, amanda_recover_exec_t, amanda_recover_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -8,11 +8,11 @@ policy_module(amanda, 1.9.0)
|
|||||||
|
|
||||||
type amanda_t;
|
type amanda_t;
|
||||||
type amanda_inetd_exec_t;
|
type amanda_inetd_exec_t;
|
||||||
inetd_service_domain(amanda_t,amanda_inetd_exec_t)
|
inetd_service_domain(amanda_t, amanda_inetd_exec_t)
|
||||||
role system_r types amanda_t;
|
role system_r types amanda_t;
|
||||||
|
|
||||||
type amanda_exec_t;
|
type amanda_exec_t;
|
||||||
domain_entry_file(amanda_t,amanda_exec_t)
|
domain_entry_file(amanda_t, amanda_exec_t)
|
||||||
|
|
||||||
type amanda_log_t;
|
type amanda_log_t;
|
||||||
logging_log_file(amanda_log_t)
|
logging_log_file(amanda_log_t)
|
||||||
@ -51,7 +51,7 @@ files_type(amanda_data_t)
|
|||||||
# type for amrecover
|
# type for amrecover
|
||||||
type amanda_recover_t;
|
type amanda_recover_t;
|
||||||
type amanda_recover_exec_t;
|
type amanda_recover_exec_t;
|
||||||
application_domain(amanda_recover_t,amanda_recover_exec_t)
|
application_domain(amanda_recover_t, amanda_recover_exec_t)
|
||||||
role system_r types amanda_recover_t;
|
role system_r types amanda_recover_t;
|
||||||
|
|
||||||
# type for recover files ( restored data )
|
# type for recover files ( restored data )
|
||||||
@ -88,8 +88,8 @@ allow amanda_t amanda_data_t:file manage_file_perms;
|
|||||||
# access to amanda_dumpdates_t
|
# access to amanda_dumpdates_t
|
||||||
allow amanda_t amanda_dumpdates_t:file { getattr lock read write };
|
allow amanda_t amanda_dumpdates_t:file { getattr lock read write };
|
||||||
|
|
||||||
can_exec(amanda_t,amanda_exec_t)
|
can_exec(amanda_t, amanda_exec_t)
|
||||||
can_exec(amanda_t,amanda_inetd_exec_t)
|
can_exec(amanda_t, amanda_inetd_exec_t)
|
||||||
|
|
||||||
# access to amanda_gnutarlists_t (/var/lib/amanda/gnutar-lists)
|
# access to amanda_gnutarlists_t (/var/lib/amanda/gnutar-lists)
|
||||||
allow amanda_t amanda_gnutarlists_t:dir rw_dir_perms;
|
allow amanda_t amanda_gnutarlists_t:dir rw_dir_perms;
|
||||||
@ -99,12 +99,12 @@ allow amanda_t amanda_gnutarlists_t:lnk_file manage_lnk_file_perms;
|
|||||||
manage_dirs_pattern(amanda_t,amanda_var_lib_t,amanda_var_lib_t)
|
manage_dirs_pattern(amanda_t,amanda_var_lib_t,amanda_var_lib_t)
|
||||||
manage_files_pattern(amanda_t,amanda_var_lib_t,amanda_var_lib_t)
|
manage_files_pattern(amanda_t,amanda_var_lib_t,amanda_var_lib_t)
|
||||||
|
|
||||||
manage_files_pattern(amanda_t,amanda_log_t,amanda_log_t)
|
manage_files_pattern(amanda_t, amanda_log_t, amanda_log_t)
|
||||||
manage_dirs_pattern(amanda_t,amanda_log_t,amanda_log_t)
|
manage_dirs_pattern(amanda_t, amanda_log_t, amanda_log_t)
|
||||||
logging_log_filetrans(amanda_t,amanda_log_t,{ file dir })
|
logging_log_filetrans(amanda_t, amanda_log_t, { file dir })
|
||||||
|
|
||||||
manage_files_pattern(amanda_t,amanda_tmp_t,amanda_tmp_t)
|
manage_files_pattern(amanda_t, amanda_tmp_t, amanda_tmp_t)
|
||||||
manage_dirs_pattern(amanda_t,amanda_tmp_t,amanda_tmp_t)
|
manage_dirs_pattern(amanda_t, amanda_tmp_t, amanda_tmp_t)
|
||||||
files_tmp_filetrans(amanda_t, amanda_tmp_t, { file dir })
|
files_tmp_filetrans(amanda_t, amanda_tmp_t, { file dir })
|
||||||
|
|
||||||
kernel_read_system_state(amanda_t)
|
kernel_read_system_state(amanda_t)
|
||||||
@ -172,23 +172,23 @@ allow amanda_recover_t self:unix_stream_socket { connect create read write };
|
|||||||
allow amanda_recover_t self:tcp_socket create_stream_socket_perms;
|
allow amanda_recover_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow amanda_recover_t self:udp_socket create_socket_perms;
|
allow amanda_recover_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
manage_files_pattern(amanda_recover_t,amanda_log_t,amanda_log_t)
|
manage_files_pattern(amanda_recover_t, amanda_log_t, amanda_log_t)
|
||||||
manage_lnk_files_pattern(amanda_recover_t,amanda_log_t,amanda_log_t)
|
manage_lnk_files_pattern(amanda_recover_t, amanda_log_t, amanda_log_t)
|
||||||
|
|
||||||
# access to amanda_recover_dir_t
|
# access to amanda_recover_dir_t
|
||||||
manage_dirs_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t)
|
manage_dirs_pattern(amanda_recover_t, amanda_recover_dir_t, amanda_recover_dir_t)
|
||||||
manage_files_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t)
|
manage_files_pattern(amanda_recover_t, amanda_recover_dir_t, amanda_recover_dir_t)
|
||||||
manage_lnk_files_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t)
|
manage_lnk_files_pattern(amanda_recover_t, amanda_recover_dir_t, amanda_recover_dir_t)
|
||||||
manage_fifo_files_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t)
|
manage_fifo_files_pattern(amanda_recover_t, amanda_recover_dir_t, amanda_recover_dir_t)
|
||||||
manage_sock_files_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t)
|
manage_sock_files_pattern(amanda_recover_t, amanda_recover_dir_t, amanda_recover_dir_t)
|
||||||
sysadm_home_dir_filetrans(amanda_recover_t,amanda_recover_dir_t,{ dir file lnk_file sock_file fifo_file })
|
sysadm_home_dir_filetrans(amanda_recover_t, amanda_recover_dir_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
manage_dirs_pattern(amanda_recover_t,amanda_tmp_t,amanda_tmp_t)
|
manage_dirs_pattern(amanda_recover_t, amanda_tmp_t, amanda_tmp_t)
|
||||||
manage_files_pattern(amanda_recover_t,amanda_tmp_t,amanda_tmp_t)
|
manage_files_pattern(amanda_recover_t, amanda_tmp_t, amanda_tmp_t)
|
||||||
manage_lnk_files_pattern(amanda_recover_t,amanda_tmp_t,amanda_tmp_t)
|
manage_lnk_files_pattern(amanda_recover_t, amanda_tmp_t, amanda_tmp_t)
|
||||||
manage_fifo_files_pattern(amanda_recover_t,amanda_tmp_t,amanda_tmp_t)
|
manage_fifo_files_pattern(amanda_recover_t, amanda_tmp_t, amanda_tmp_t)
|
||||||
manage_sock_files_pattern(amanda_recover_t,amanda_tmp_t,amanda_tmp_t)
|
manage_sock_files_pattern(amanda_recover_t, amanda_tmp_t, amanda_tmp_t)
|
||||||
files_tmp_filetrans(amanda_recover_t,amanda_tmp_t,{ dir file lnk_file sock_file fifo_file })
|
files_tmp_filetrans(amanda_recover_t, amanda_tmp_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
kernel_read_system_state(amanda_recover_t)
|
kernel_read_system_state(amanda_recover_t)
|
||||||
kernel_read_kernel_sysctls(amanda_recover_t)
|
kernel_read_kernel_sysctls(amanda_recover_t)
|
||||||
|
@ -16,7 +16,7 @@ interface(`amtu_domtrans',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,amtu_exec_t,amtu_t)
|
domtrans_pattern($1, amtu_exec_t, amtu_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -19,7 +19,7 @@ role system_r types anaconda_t;
|
|||||||
|
|
||||||
allow anaconda_t self:process execmem;
|
allow anaconda_t self:process execmem;
|
||||||
|
|
||||||
kernel_domtrans_to(anaconda_t,anaconda_exec_t)
|
kernel_domtrans_to(anaconda_t, anaconda_exec_t)
|
||||||
|
|
||||||
# Run other rc scripts in the anaconda_t domain.
|
# Run other rc scripts in the anaconda_t domain.
|
||||||
init_domtrans_script(anaconda_t)
|
init_domtrans_script(anaconda_t)
|
||||||
@ -34,7 +34,7 @@ seutil_domtrans_semanage(anaconda_t)
|
|||||||
|
|
||||||
unconfined_domain(anaconda_t)
|
unconfined_domain(anaconda_t)
|
||||||
|
|
||||||
unprivuser_home_dir_filetrans_home_content(anaconda_t,{ dir file lnk_file fifo_file sock_file })
|
unprivuser_home_dir_filetrans_home_content(anaconda_t, { dir file lnk_file fifo_file sock_file })
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
dmesg_domtrans(anaconda_t)
|
dmesg_domtrans(anaconda_t)
|
||||||
|
@ -17,7 +17,7 @@ interface(`apt_domtrans',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,apt_exec_t,apt_t)
|
domtrans_pattern($1, apt_exec_t, apt_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -144,8 +144,8 @@ interface(`apt_read_db',`
|
|||||||
|
|
||||||
files_search_var_lib($1)
|
files_search_var_lib($1)
|
||||||
allow $1 apt_var_lib_t:dir list_dir_perms;
|
allow $1 apt_var_lib_t:dir list_dir_perms;
|
||||||
read_files_pattern($1,apt_var_lib_t,apt_var_lib_t)
|
read_files_pattern($1, apt_var_lib_t, apt_var_lib_t)
|
||||||
read_lnk_files_pattern($1,apt_var_lib_t,apt_var_lib_t)
|
read_lnk_files_pattern($1, apt_var_lib_t, apt_var_lib_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -164,10 +164,10 @@ interface(`apt_manage_db',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
files_search_var_lib($1)
|
files_search_var_lib($1)
|
||||||
manage_files_pattern($1,apt_var_lib_t,apt_var_lib_t)
|
manage_files_pattern($1, apt_var_lib_t, apt_var_lib_t)
|
||||||
# cjp: shouldnt this be manage_lnk_files?
|
# cjp: shouldnt this be manage_lnk_files?
|
||||||
rw_lnk_files_pattern($1,apt_var_lib_t,apt_var_lib_t)
|
rw_lnk_files_pattern($1, apt_var_lib_t, apt_var_lib_t)
|
||||||
delete_lnk_files_pattern($1,apt_var_lib_t,apt_var_lib_t)
|
delete_lnk_files_pattern($1, apt_var_lib_t, apt_var_lib_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(apt,1.4.0)
|
policy_module(apt, 1.4.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(apt,1.4.0)
|
|||||||
|
|
||||||
type apt_t;
|
type apt_t;
|
||||||
type apt_exec_t;
|
type apt_exec_t;
|
||||||
init_system_domain(apt_t,apt_exec_t)
|
init_system_domain(apt_t, apt_exec_t)
|
||||||
domain_system_change_exemption(apt_t)
|
domain_system_change_exemption(apt_t)
|
||||||
role system_r types apt_t;
|
role system_r types apt_t;
|
||||||
|
|
||||||
@ -54,23 +54,23 @@ allow apt_t self:msgq create_msgq_perms;
|
|||||||
allow apt_t self:msg { send receive };
|
allow apt_t self:msg { send receive };
|
||||||
|
|
||||||
# Access /var/cache/apt files
|
# Access /var/cache/apt files
|
||||||
manage_files_pattern(apt_t,apt_var_cache_t,apt_var_cache_t)
|
manage_files_pattern(apt_t, apt_var_cache_t, apt_var_cache_t)
|
||||||
files_var_filetrans(apt_t,apt_var_cache_t,dir)
|
files_var_filetrans(apt_t, apt_var_cache_t, dir)
|
||||||
|
|
||||||
manage_dirs_pattern(apt_t,apt_tmp_t,apt_tmp_t)
|
manage_dirs_pattern(apt_t, apt_tmp_t, apt_tmp_t)
|
||||||
manage_files_pattern(apt_t,apt_tmp_t,apt_tmp_t)
|
manage_files_pattern(apt_t, apt_tmp_t, apt_tmp_t)
|
||||||
files_tmp_filetrans(apt_t, apt_tmp_t, { file dir })
|
files_tmp_filetrans(apt_t, apt_tmp_t, { file dir })
|
||||||
|
|
||||||
manage_dirs_pattern(apt_t,apt_tmpfs_t,apt_tmpfs_t)
|
manage_dirs_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
|
||||||
manage_files_pattern(apt_t,apt_tmpfs_t,apt_tmpfs_t)
|
manage_files_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
|
||||||
manage_lnk_files_pattern(apt_t,apt_tmpfs_t,apt_tmpfs_t)
|
manage_lnk_files_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
|
||||||
manage_fifo_files_pattern(apt_t,apt_tmpfs_t,apt_tmpfs_t)
|
manage_fifo_files_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
|
||||||
manage_sock_files_pattern(apt_t,apt_tmpfs_t,apt_tmpfs_t)
|
manage_sock_files_pattern(apt_t, apt_tmpfs_t, apt_tmpfs_t)
|
||||||
fs_tmpfs_filetrans(apt_t,apt_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans(apt_t, apt_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
# Access /var/lib/apt files
|
# Access /var/lib/apt files
|
||||||
manage_files_pattern(apt_t,apt_var_lib_t,apt_var_lib_t)
|
manage_files_pattern(apt_t, apt_var_lib_t, apt_var_lib_t)
|
||||||
files_var_lib_filetrans(apt_t,apt_var_lib_t,dir)
|
files_var_lib_filetrans(apt_t, apt_var_lib_t, dir)
|
||||||
|
|
||||||
kernel_read_system_state(apt_t)
|
kernel_read_system_state(apt_t)
|
||||||
kernel_read_kernel_sysctls(apt_t)
|
kernel_read_kernel_sysctls(apt_t)
|
||||||
|
@ -15,7 +15,7 @@ interface(`backup_domtrans',`
|
|||||||
type backup_t, backup_exec_t;
|
type backup_t, backup_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,backup_exec_t,backup_t)
|
domtrans_pattern($1, backup_exec_t, backup_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(backup,1.3.0)
|
policy_module(backup, 1.3.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -9,7 +9,7 @@ policy_module(backup,1.3.0)
|
|||||||
type backup_t;
|
type backup_t;
|
||||||
type backup_exec_t;
|
type backup_exec_t;
|
||||||
domain_type(backup_t)
|
domain_type(backup_t)
|
||||||
domain_entry_file(backup_t,backup_exec_t)
|
domain_entry_file(backup_t, backup_exec_t)
|
||||||
role system_r types backup_t;
|
role system_r types backup_t;
|
||||||
|
|
||||||
type backup_store_t;
|
type backup_store_t;
|
||||||
@ -27,9 +27,9 @@ allow backup_t self:tcp_socket create_socket_perms;
|
|||||||
allow backup_t self:udp_socket create_socket_perms;
|
allow backup_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
allow backup_t backup_store_t:file setattr;
|
allow backup_t backup_store_t:file setattr;
|
||||||
manage_files_pattern(backup_t,backup_store_t,backup_store_t)
|
manage_files_pattern(backup_t, backup_store_t, backup_store_t)
|
||||||
rw_files_pattern(backup_t,backup_store_t,backup_store_t)
|
rw_files_pattern(backup_t, backup_store_t, backup_store_t)
|
||||||
read_lnk_files_pattern(backup_t,backup_store_t,backup_store_t)
|
read_lnk_files_pattern(backup_t, backup_store_t, backup_store_t)
|
||||||
|
|
||||||
kernel_read_system_state(backup_t)
|
kernel_read_system_state(backup_t)
|
||||||
kernel_read_kernel_sysctls(backup_t)
|
kernel_read_kernel_sysctls(backup_t)
|
||||||
@ -75,7 +75,7 @@ logging_send_syslog_msg(backup_t)
|
|||||||
sysnet_read_config(backup_t)
|
sysnet_read_config(backup_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cron_system_entry(backup_t,backup_exec_t)
|
cron_system_entry(backup_t, backup_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
|
@ -126,5 +126,5 @@ interface(`bootloader_create_runtime_file',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
allow $1 boot_runtime_t:file { create_file_perms rw_file_perms };
|
allow $1 boot_runtime_t:file { create_file_perms rw_file_perms };
|
||||||
files_boot_filetrans($1,boot_runtime_t,file)
|
files_boot_filetrans($1, boot_runtime_t, file)
|
||||||
')
|
')
|
||||||
|
@ -16,7 +16,7 @@ files_type(boot_runtime_t)
|
|||||||
|
|
||||||
type bootloader_t;
|
type bootloader_t;
|
||||||
type bootloader_exec_t;
|
type bootloader_exec_t;
|
||||||
application_domain(bootloader_t,bootloader_exec_t)
|
application_domain(bootloader_t, bootloader_exec_t)
|
||||||
role system_r types bootloader_t;
|
role system_r types bootloader_t;
|
||||||
|
|
||||||
#
|
#
|
||||||
@ -55,14 +55,14 @@ allow bootloader_t bootloader_etc_t:file read_file_perms;
|
|||||||
#allow bootloader_t bootloader_etc_t:file manage_file_perms;
|
#allow bootloader_t bootloader_etc_t:file manage_file_perms;
|
||||||
#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)
|
#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)
|
||||||
|
|
||||||
manage_dirs_pattern(bootloader_t,bootloader_tmp_t,bootloader_tmp_t)
|
manage_dirs_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
||||||
manage_files_pattern(bootloader_t,bootloader_tmp_t,bootloader_tmp_t)
|
manage_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
||||||
manage_lnk_files_pattern(bootloader_t,bootloader_tmp_t,bootloader_tmp_t)
|
manage_lnk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
||||||
manage_blk_files_pattern(bootloader_t,bootloader_tmp_t,bootloader_tmp_t)
|
manage_blk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
||||||
manage_chr_files_pattern(bootloader_t,bootloader_tmp_t,bootloader_tmp_t)
|
manage_chr_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
||||||
files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file })
|
files_tmp_filetrans(bootloader_t, bootloader_tmp_t, { dir file lnk_file chr_file blk_file })
|
||||||
# for tune2fs (cjp: ?)
|
# for tune2fs (cjp: ?)
|
||||||
files_root_filetrans(bootloader_t,bootloader_tmp_t,file)
|
files_root_filetrans(bootloader_t, bootloader_tmp_t, file)
|
||||||
|
|
||||||
kernel_getattr_core_if(bootloader_t)
|
kernel_getattr_core_if(bootloader_t)
|
||||||
kernel_read_network_state(bootloader_t)
|
kernel_read_network_state(bootloader_t)
|
||||||
@ -114,7 +114,7 @@ files_read_kernel_modules(bootloader_t)
|
|||||||
files_dontaudit_search_pids(bootloader_t)
|
files_dontaudit_search_pids(bootloader_t)
|
||||||
# for blkid.tab
|
# for blkid.tab
|
||||||
files_manage_etc_runtime_files(bootloader_t)
|
files_manage_etc_runtime_files(bootloader_t)
|
||||||
files_etc_filetrans_etc_runtime(bootloader_t,file)
|
files_etc_filetrans_etc_runtime(bootloader_t, file)
|
||||||
files_dontaudit_search_home(bootloader_t)
|
files_dontaudit_search_home(bootloader_t)
|
||||||
|
|
||||||
init_getattr_initctl(bootloader_t)
|
init_getattr_initctl(bootloader_t)
|
||||||
|
@ -15,5 +15,5 @@ interface(`brctl_domtrans',`
|
|||||||
type brctl_t, brctl_exec_t;
|
type brctl_t, brctl_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,brctl_exec_t,brctl_t)
|
domtrans_pattern($1, brctl_exec_t, brctl_t)
|
||||||
')
|
')
|
||||||
|
@ -1,4 +1,4 @@
|
|||||||
policy_module(brctl,1.2.0)
|
policy_module(brctl, 1.2.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -17,7 +17,7 @@ interface(`certwatch_domtrans',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,certwatch_exec_t,certwatch_t)
|
domtrans_pattern($1, certwatch_exec_t, certwatch_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(certwatch,1.0)
|
policy_module(certwatch, 1.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(certwatch,1.0)
|
|||||||
|
|
||||||
type certwatch_t;
|
type certwatch_t;
|
||||||
type certwatch_exec_t;
|
type certwatch_exec_t;
|
||||||
application_domain(certwatch_t,certwatch_exec_t)
|
application_domain(certwatch_t, certwatch_exec_t)
|
||||||
role system_r types certwatch_t;
|
role system_r types certwatch_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -29,5 +29,5 @@ miscfiles_read_localization(certwatch_t)
|
|||||||
apache_exec_modules(certwatch_t)
|
apache_exec_modules(certwatch_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cron_system_entry(certwatch_t,certwatch_exec_t)
|
cron_system_entry(certwatch_t, certwatch_exec_t)
|
||||||
')
|
')
|
||||||
|
@ -18,7 +18,7 @@ interface(`consoletype_domtrans',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,consoletype_exec_t,consoletype_t)
|
domtrans_pattern($1, consoletype_exec_t, consoletype_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -69,5 +69,5 @@ interface(`consoletype_exec',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
can_exec($1,consoletype_exec_t)
|
can_exec($1, consoletype_exec_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(consoletype,1.6.0)
|
policy_module(consoletype, 1.6.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -9,8 +9,8 @@ policy_module(consoletype,1.6.0)
|
|||||||
type consoletype_t;
|
type consoletype_t;
|
||||||
type consoletype_exec_t;
|
type consoletype_exec_t;
|
||||||
application_executable_file(consoletype_exec_t)
|
application_executable_file(consoletype_exec_t)
|
||||||
init_domain(consoletype_t,consoletype_exec_t)
|
init_domain(consoletype_t, consoletype_exec_t)
|
||||||
init_system_domain(consoletype_t,consoletype_exec_t)
|
init_system_domain(consoletype_t, consoletype_exec_t)
|
||||||
role system_r types consoletype_t;
|
role system_r types consoletype_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -15,7 +15,7 @@ interface(`ddcprobe_domtrans',`
|
|||||||
type ddcprobe_t, ddcprobe_exec_t;
|
type ddcprobe_t, ddcprobe_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,ddcprobe_exec_t,ddcprobe_t)
|
domtrans_pattern($1, ddcprobe_exec_t, ddcprobe_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(ddcprobe,1.1.0)
|
policy_module(ddcprobe, 1.1.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(ddcprobe,1.1.0)
|
|||||||
|
|
||||||
type ddcprobe_t;
|
type ddcprobe_t;
|
||||||
type ddcprobe_exec_t;
|
type ddcprobe_exec_t;
|
||||||
application_domain(ddcprobe_t,ddcprobe_exec_t)
|
application_domain(ddcprobe_t, ddcprobe_exec_t)
|
||||||
role system_r types ddcprobe_t;
|
role system_r types ddcprobe_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -36,5 +36,5 @@ interface(`dmesg_exec',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
can_exec($1,dmesg_exec_t)
|
can_exec($1, dmesg_exec_t)
|
||||||
')
|
')
|
||||||
|
@ -8,7 +8,7 @@ policy_module(dmesg, 1.2.0)
|
|||||||
|
|
||||||
type dmesg_t;
|
type dmesg_t;
|
||||||
type dmesg_exec_t;
|
type dmesg_exec_t;
|
||||||
init_system_domain(dmesg_t,dmesg_exec_t)
|
init_system_domain(dmesg_t, dmesg_exec_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -15,7 +15,7 @@ interface(`dmidecode_domtrans',`
|
|||||||
type dmidecode_t, dmidecode_exec_t;
|
type dmidecode_t, dmidecode_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domain_auto_trans($1,dmidecode_exec_t,dmidecode_t)
|
domain_auto_trans($1, dmidecode_exec_t, dmidecode_t)
|
||||||
|
|
||||||
allow $1 dmidecode_t:fd use;
|
allow $1 dmidecode_t:fd use;
|
||||||
allow dmidecode_t $1:fd use;
|
allow dmidecode_t $1:fd use;
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(dmidecode,1.3.0)
|
policy_module(dmidecode, 1.3.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(dmidecode,1.3.0)
|
|||||||
|
|
||||||
type dmidecode_t;
|
type dmidecode_t;
|
||||||
type dmidecode_exec_t;
|
type dmidecode_exec_t;
|
||||||
application_domain(dmidecode_t,dmidecode_exec_t)
|
application_domain(dmidecode_t, dmidecode_exec_t)
|
||||||
role system_r types dmidecode_t;
|
role system_r types dmidecode_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -19,7 +19,7 @@ interface(`dpkg_domtrans',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,dpkg_exec_t,dpkg_t)
|
domtrans_pattern($1, dpkg_exec_t, dpkg_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -73,7 +73,7 @@ interface(`dpkg_run',`
|
|||||||
dpkg_domtrans($1)
|
dpkg_domtrans($1)
|
||||||
role $2 types dpkg_t;
|
role $2 types dpkg_t;
|
||||||
role $2 types dpkg_script_t;
|
role $2 types dpkg_script_t;
|
||||||
seutil_run_loadpolicy(dpkg_script_t,$2,$3)
|
seutil_run_loadpolicy(dpkg_script_t, $2, $3)
|
||||||
allow dpkg_t $3:chr_file rw_term_perms;
|
allow dpkg_t $3:chr_file rw_term_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -166,8 +166,8 @@ interface(`dpkg_read_db',`
|
|||||||
|
|
||||||
files_search_var_lib($1)
|
files_search_var_lib($1)
|
||||||
allow $1 dpkg_var_lib_t:dir list_dir_perms;
|
allow $1 dpkg_var_lib_t:dir list_dir_perms;
|
||||||
read_files_pattern($1,dpkg_var_lib_t,dpkg_var_lib_t)
|
read_files_pattern($1, dpkg_var_lib_t, dpkg_var_lib_t)
|
||||||
read_lnk_files_pattern($1,dpkg_var_lib_t,dpkg_var_lib_t)
|
read_lnk_files_pattern($1, dpkg_var_lib_t, dpkg_var_lib_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -186,8 +186,8 @@ interface(`dpkg_manage_db',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
files_search_var_lib($1)
|
files_search_var_lib($1)
|
||||||
manage_files_pattern($1,dpkg_var_lib_t,dpkg_var_lib_t)
|
manage_files_pattern($1, dpkg_var_lib_t, dpkg_var_lib_t)
|
||||||
manage_lnk_files_pattern($1,dpkg_var_lib_t,dpkg_var_lib_t)
|
manage_lnk_files_pattern($1, dpkg_var_lib_t, dpkg_var_lib_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(dpkg,1.5.0)
|
policy_module(dpkg, 1.5.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -9,7 +9,7 @@ policy_module(dpkg,1.5.0)
|
|||||||
type dpkg_t;
|
type dpkg_t;
|
||||||
type dpkg_exec_t;
|
type dpkg_exec_t;
|
||||||
# dpkg can start/stop services
|
# dpkg can start/stop services
|
||||||
init_system_domain(dpkg_t,dpkg_exec_t)
|
init_system_domain(dpkg_t, dpkg_exec_t)
|
||||||
# dpkg can change file labels, roles, IO
|
# dpkg can change file labels, roles, IO
|
||||||
domain_obj_id_change_exemption(dpkg_t)
|
domain_obj_id_change_exemption(dpkg_t)
|
||||||
domain_role_change_exemption(dpkg_t)
|
domain_role_change_exemption(dpkg_t)
|
||||||
@ -69,20 +69,20 @@ allow dpkg_t self:msg { send receive };
|
|||||||
|
|
||||||
allow dpkg_t dpkg_lock_t:file manage_file_perms;
|
allow dpkg_t dpkg_lock_t:file manage_file_perms;
|
||||||
|
|
||||||
manage_dirs_pattern(dpkg_t,dpkg_tmp_t,dpkg_tmp_t)
|
manage_dirs_pattern(dpkg_t, dpkg_tmp_t, dpkg_tmp_t)
|
||||||
manage_files_pattern(dpkg_t,dpkg_tmp_t,dpkg_tmp_t)
|
manage_files_pattern(dpkg_t, dpkg_tmp_t, dpkg_tmp_t)
|
||||||
files_tmp_filetrans(dpkg_t, dpkg_tmp_t, { file dir })
|
files_tmp_filetrans(dpkg_t, dpkg_tmp_t, { file dir })
|
||||||
|
|
||||||
manage_dirs_pattern(dpkg_t,dpkg_tmpfs_t,dpkg_tmpfs_t)
|
manage_dirs_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
|
||||||
manage_files_pattern(dpkg_t,dpkg_tmpfs_t,dpkg_tmpfs_t)
|
manage_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
|
||||||
manage_lnk_files_pattern(dpkg_t,dpkg_tmpfs_t,dpkg_tmpfs_t)
|
manage_lnk_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
|
||||||
manage_sock_files_pattern(dpkg_t,dpkg_tmpfs_t,dpkg_tmpfs_t)
|
manage_sock_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
|
||||||
manage_fifo_files_pattern(dpkg_t,dpkg_tmpfs_t,dpkg_tmpfs_t)
|
manage_fifo_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
|
||||||
fs_tmpfs_filetrans(dpkg_t,dpkg_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans(dpkg_t, dpkg_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
# Access /var/lib/dpkg files
|
# Access /var/lib/dpkg files
|
||||||
manage_files_pattern(dpkg_t,dpkg_var_lib_t,dpkg_var_lib_t)
|
manage_files_pattern(dpkg_t, dpkg_var_lib_t, dpkg_var_lib_t)
|
||||||
files_var_lib_filetrans(dpkg_t,dpkg_var_lib_t,dir)
|
files_var_lib_filetrans(dpkg_t, dpkg_var_lib_t, dir)
|
||||||
|
|
||||||
kernel_read_system_state(dpkg_t)
|
kernel_read_system_state(dpkg_t)
|
||||||
kernel_read_kernel_sysctls(dpkg_t)
|
kernel_read_kernel_sysctls(dpkg_t)
|
||||||
@ -240,7 +240,7 @@ allow dpkg_script_t dpkg_script_tmpfs_t:file manage_file_perms;
|
|||||||
allow dpkg_script_t dpkg_script_tmpfs_t:lnk_file manage_lnk_file_perms;
|
allow dpkg_script_t dpkg_script_tmpfs_t:lnk_file manage_lnk_file_perms;
|
||||||
allow dpkg_script_t dpkg_script_tmpfs_t:sock_file manage_sock_file_perms;
|
allow dpkg_script_t dpkg_script_tmpfs_t:sock_file manage_sock_file_perms;
|
||||||
allow dpkg_script_t dpkg_script_tmpfs_t:fifo_file manage_fifo_file_perms;
|
allow dpkg_script_t dpkg_script_tmpfs_t:fifo_file manage_fifo_file_perms;
|
||||||
fs_tmpfs_filetrans(dpkg_script_t,dpkg_script_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans(dpkg_script_t, dpkg_script_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
kernel_read_kernel_sysctls(dpkg_script_t)
|
kernel_read_kernel_sysctls(dpkg_script_t)
|
||||||
kernel_read_system_state(dpkg_script_t)
|
kernel_read_system_state(dpkg_script_t)
|
||||||
|
@ -18,7 +18,7 @@ interface(`firstboot_domtrans',`
|
|||||||
type firstboot_t, firstboot_exec_t;
|
type firstboot_t, firstboot_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,firstboot_exec_t,firstboot_t)
|
domtrans_pattern($1, firstboot_exec_t, firstboot_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -12,7 +12,7 @@ gen_require(`
|
|||||||
|
|
||||||
type firstboot_t;
|
type firstboot_t;
|
||||||
type firstboot_exec_t;
|
type firstboot_exec_t;
|
||||||
init_system_domain(firstboot_t,firstboot_exec_t)
|
init_system_domain(firstboot_t, firstboot_exec_t)
|
||||||
domain_obj_id_change_exemption(firstboot_t)
|
domain_obj_id_change_exemption(firstboot_t)
|
||||||
domain_subj_id_change_exemption(firstboot_t)
|
domain_subj_id_change_exemption(firstboot_t)
|
||||||
role system_r types firstboot_t;
|
role system_r types firstboot_t;
|
||||||
|
@ -15,7 +15,7 @@ interface(`kudzu_domtrans',`
|
|||||||
type kudzu_t, kudzu_exec_t;
|
type kudzu_t, kudzu_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,kudzu_exec_t,kudzu_t)
|
domtrans_pattern($1, kudzu_exec_t, kudzu_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -8,7 +8,7 @@ policy_module(kudzu, 1.6.0)
|
|||||||
|
|
||||||
type kudzu_t;
|
type kudzu_t;
|
||||||
type kudzu_exec_t;
|
type kudzu_exec_t;
|
||||||
init_system_domain(kudzu_t,kudzu_exec_t)
|
init_system_domain(kudzu_t, kudzu_exec_t)
|
||||||
|
|
||||||
type kudzu_tmp_t;
|
type kudzu_tmp_t;
|
||||||
files_tmp_file(kudzu_tmp_t)
|
files_tmp_file(kudzu_tmp_t)
|
||||||
@ -29,14 +29,14 @@ allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
|||||||
allow kudzu_t self:unix_dgram_socket create_socket_perms;
|
allow kudzu_t self:unix_dgram_socket create_socket_perms;
|
||||||
allow kudzu_t self:udp_socket { create ioctl };
|
allow kudzu_t self:udp_socket { create ioctl };
|
||||||
|
|
||||||
manage_dirs_pattern(kudzu_t,kudzu_tmp_t,kudzu_tmp_t)
|
manage_dirs_pattern(kudzu_t, kudzu_tmp_t, kudzu_tmp_t)
|
||||||
manage_files_pattern(kudzu_t,kudzu_tmp_t,kudzu_tmp_t)
|
manage_files_pattern(kudzu_t, kudzu_tmp_t, kudzu_tmp_t)
|
||||||
manage_chr_files_pattern(kudzu_t,kudzu_tmp_t,kudzu_tmp_t)
|
manage_chr_files_pattern(kudzu_t, kudzu_tmp_t, kudzu_tmp_t)
|
||||||
files_tmp_filetrans(kudzu_t, kudzu_tmp_t, { file dir chr_file })
|
files_tmp_filetrans(kudzu_t, kudzu_tmp_t, { file dir chr_file })
|
||||||
|
|
||||||
manage_dirs_pattern(kudzu_t,kudzu_var_run_t,kudzu_var_run_t)
|
manage_dirs_pattern(kudzu_t, kudzu_var_run_t, kudzu_var_run_t)
|
||||||
manage_files_pattern(kudzu_t,kudzu_var_run_t,kudzu_var_run_t)
|
manage_files_pattern(kudzu_t, kudzu_var_run_t, kudzu_var_run_t)
|
||||||
files_pid_filetrans(kudzu_t,kudzu_var_run_t,file)
|
files_pid_filetrans(kudzu_t, kudzu_var_run_t, file)
|
||||||
|
|
||||||
kernel_change_ring_buffer_level(kudzu_t)
|
kernel_change_ring_buffer_level(kudzu_t)
|
||||||
kernel_list_proc(kudzu_t)
|
kernel_list_proc(kudzu_t)
|
||||||
|
@ -15,7 +15,7 @@ interface(`logrotate_domtrans',`
|
|||||||
type logrotate_t, logrotate_exec_t;
|
type logrotate_t, logrotate_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,logrotate_exec_t,logrotate_t)
|
domtrans_pattern($1, logrotate_exec_t, logrotate_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -65,7 +65,7 @@ interface(`logrotate_exec',`
|
|||||||
type logrotate_exec_t;
|
type logrotate_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
can_exec($1,logrotate_exec_t)
|
can_exec($1, logrotate_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -13,7 +13,7 @@ domain_system_change_exemption(logrotate_t)
|
|||||||
role system_r types logrotate_t;
|
role system_r types logrotate_t;
|
||||||
|
|
||||||
type logrotate_exec_t;
|
type logrotate_exec_t;
|
||||||
domain_entry_file(logrotate_t,logrotate_exec_t)
|
domain_entry_file(logrotate_t, logrotate_exec_t)
|
||||||
|
|
||||||
type logrotate_lock_t;
|
type logrotate_lock_t;
|
||||||
files_lock_file(logrotate_lock_t)
|
files_lock_file(logrotate_lock_t)
|
||||||
@ -51,17 +51,17 @@ allow logrotate_t self:msgq create_msgq_perms;
|
|||||||
allow logrotate_t self:msg { send receive };
|
allow logrotate_t self:msg { send receive };
|
||||||
|
|
||||||
allow logrotate_t logrotate_lock_t:file manage_file_perms;
|
allow logrotate_t logrotate_lock_t:file manage_file_perms;
|
||||||
files_lock_filetrans(logrotate_t,logrotate_lock_t,file)
|
files_lock_filetrans(logrotate_t, logrotate_lock_t, file)
|
||||||
|
|
||||||
can_exec(logrotate_t, logrotate_tmp_t)
|
can_exec(logrotate_t, logrotate_tmp_t)
|
||||||
|
|
||||||
manage_dirs_pattern(logrotate_t,logrotate_tmp_t,logrotate_tmp_t)
|
manage_dirs_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
|
||||||
manage_files_pattern(logrotate_t,logrotate_tmp_t,logrotate_tmp_t)
|
manage_files_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
|
||||||
files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })
|
files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })
|
||||||
|
|
||||||
# for /var/lib/logrotate.status and /var/lib/logcheck
|
# for /var/lib/logrotate.status and /var/lib/logcheck
|
||||||
create_dirs_pattern(logrotate_t,logrotate_var_lib_t,logrotate_var_lib_t)
|
create_dirs_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
|
||||||
manage_files_pattern(logrotate_t,logrotate_var_lib_t,logrotate_var_lib_t)
|
manage_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
|
||||||
files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)
|
files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)
|
||||||
|
|
||||||
kernel_read_system_state(logrotate_t)
|
kernel_read_system_state(logrotate_t)
|
||||||
|
@ -8,7 +8,7 @@ policy_module(logwatch, 1.8.0)
|
|||||||
|
|
||||||
type logwatch_t;
|
type logwatch_t;
|
||||||
type logwatch_exec_t;
|
type logwatch_exec_t;
|
||||||
application_domain(logwatch_t,logwatch_exec_t)
|
application_domain(logwatch_t, logwatch_exec_t)
|
||||||
role system_r types logwatch_t;
|
role system_r types logwatch_t;
|
||||||
|
|
||||||
type logwatch_cache_t;
|
type logwatch_cache_t;
|
||||||
@ -30,14 +30,14 @@ allow logwatch_t self:process signal;
|
|||||||
allow logwatch_t self:fifo_file rw_file_perms;
|
allow logwatch_t self:fifo_file rw_file_perms;
|
||||||
allow logwatch_t self:unix_stream_socket create_stream_socket_perms;
|
allow logwatch_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
|
|
||||||
manage_dirs_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t)
|
manage_dirs_pattern(logwatch_t, logwatch_cache_t, logwatch_cache_t)
|
||||||
manage_files_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t)
|
manage_files_pattern(logwatch_t, logwatch_cache_t, logwatch_cache_t)
|
||||||
|
|
||||||
allow logwatch_t logwatch_lock_t:file manage_file_perms;
|
allow logwatch_t logwatch_lock_t:file manage_file_perms;
|
||||||
files_lock_filetrans(logwatch_t,logwatch_lock_t,file)
|
files_lock_filetrans(logwatch_t,logwatch_lock_t,file)
|
||||||
|
|
||||||
manage_dirs_pattern(logwatch_t,logwatch_tmp_t,logwatch_tmp_t)
|
manage_dirs_pattern(logwatch_t, logwatch_tmp_t, logwatch_tmp_t)
|
||||||
manage_files_pattern(logwatch_t,logwatch_tmp_t,logwatch_tmp_t)
|
manage_files_pattern(logwatch_t, logwatch_tmp_t, logwatch_tmp_t)
|
||||||
files_tmp_filetrans(logwatch_t, logwatch_tmp_t, { file dir })
|
files_tmp_filetrans(logwatch_t, logwatch_tmp_t, { file dir })
|
||||||
|
|
||||||
kernel_read_fs_sysctls(logwatch_t)
|
kernel_read_fs_sysctls(logwatch_t)
|
||||||
|
@ -15,6 +15,6 @@ interface(`mrtg_append_create_logs',`
|
|||||||
type mrtg_log_t;
|
type mrtg_log_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
append_files_pattern($1,mrtg_log_t,mrtg_log_t)
|
append_files_pattern($1, mrtg_log_t, mrtg_log_t)
|
||||||
create_files_pattern($1,mrtg_log_t,mrtg_log_t)
|
create_files_pattern($1, mrtg_log_t, mrtg_log_t)
|
||||||
')
|
')
|
||||||
|
@ -8,7 +8,7 @@ policy_module(mrtg, 1.4.0)
|
|||||||
|
|
||||||
type mrtg_t;
|
type mrtg_t;
|
||||||
type mrtg_exec_t;
|
type mrtg_exec_t;
|
||||||
init_system_domain(mrtg_t,mrtg_exec_t)
|
init_system_domain(mrtg_t, mrtg_exec_t)
|
||||||
|
|
||||||
type mrtg_etc_t;
|
type mrtg_etc_t;
|
||||||
files_config_file(mrtg_etc_t)
|
files_config_file(mrtg_etc_t)
|
||||||
@ -39,19 +39,19 @@ allow mrtg_t self:tcp_socket create_socket_perms;
|
|||||||
allow mrtg_t self:udp_socket create_socket_perms;
|
allow mrtg_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
allow mrtg_t mrtg_etc_t:dir list_dir_perms;
|
allow mrtg_t mrtg_etc_t:dir list_dir_perms;
|
||||||
read_files_pattern(mrtg_t,mrtg_etc_t,mrtg_etc_t)
|
read_files_pattern(mrtg_t, mrtg_etc_t, mrtg_etc_t)
|
||||||
read_lnk_files_pattern(mrtg_t,mrtg_etc_t,mrtg_etc_t)
|
read_lnk_files_pattern(mrtg_t, mrtg_etc_t, mrtg_etc_t)
|
||||||
dontaudit mrtg_t mrtg_etc_t:dir write;
|
dontaudit mrtg_t mrtg_etc_t:dir write;
|
||||||
dontaudit mrtg_t mrtg_etc_t:file { write ioctl };
|
dontaudit mrtg_t mrtg_etc_t:file { write ioctl };
|
||||||
|
|
||||||
manage_files_pattern(mrtg_t,mrtg_lock_t,mrtg_lock_t)
|
manage_files_pattern(mrtg_t, mrtg_lock_t, mrtg_lock_t)
|
||||||
manage_lnk_files_pattern(mrtg_t,mrtg_lock_t,mrtg_lock_t)
|
manage_lnk_files_pattern(mrtg_t, mrtg_lock_t, mrtg_lock_t)
|
||||||
|
|
||||||
manage_files_pattern(mrtg_t,mrtg_log_t,mrtg_log_t)
|
manage_files_pattern(mrtg_t, mrtg_log_t, mrtg_log_t)
|
||||||
logging_log_filetrans(mrtg_t,mrtg_log_t,{ file dir })
|
logging_log_filetrans(mrtg_t, mrtg_log_t, { file dir })
|
||||||
|
|
||||||
manage_files_pattern(mrtg_t,mrtg_var_lib_t,mrtg_var_lib_t)
|
manage_files_pattern(mrtg_t, mrtg_var_lib_t, mrtg_var_lib_t)
|
||||||
manage_lnk_files_pattern(mrtg_t,mrtg_var_lib_t,mrtg_var_lib_t)
|
manage_lnk_files_pattern(mrtg_t, mrtg_var_lib_t, mrtg_var_lib_t)
|
||||||
|
|
||||||
allow mrtg_t mrtg_var_run_t:file manage_file_perms;
|
allow mrtg_t mrtg_var_run_t:file manage_file_perms;
|
||||||
files_pid_filetrans(mrtg_t,mrtg_var_run_t,file)
|
files_pid_filetrans(mrtg_t,mrtg_var_run_t,file)
|
||||||
@ -124,7 +124,7 @@ ifdef(`enable_mls',`
|
|||||||
|
|
||||||
ifdef(`distro_redhat',`
|
ifdef(`distro_redhat',`
|
||||||
allow mrtg_t mrtg_lock_t:file manage_file_perms;
|
allow mrtg_t mrtg_lock_t:file manage_file_perms;
|
||||||
filetrans_pattern(mrtg_t,mrtg_etc_t,mrtg_lock_t,file)
|
filetrans_pattern(mrtg_t, mrtg_etc_t, mrtg_lock_t, file)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -132,7 +132,7 @@ optional_policy(`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cron_system_entry(mrtg_t,mrtg_exec_t)
|
cron_system_entry(mrtg_t, mrtg_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
|
@ -15,7 +15,7 @@ interface(`netutils_domtrans',`
|
|||||||
type netutils_t, netutils_exec_t;
|
type netutils_t, netutils_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,netutils_exec_t,netutils_t)
|
domtrans_pattern($1, netutils_exec_t, netutils_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -65,7 +65,7 @@ interface(`netutils_exec',`
|
|||||||
type netutils_exec_t;
|
type netutils_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
can_exec($1,netutils_exec_t)
|
can_exec($1, netutils_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -83,7 +83,7 @@ interface(`netutils_domtrans_ping',`
|
|||||||
type ping_t, ping_exec_t;
|
type ping_t, ping_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,ping_exec_t,ping_t)
|
domtrans_pattern($1, ping_exec_t, ping_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -205,7 +205,7 @@ interface(`netutils_exec_ping',`
|
|||||||
type ping_exec_t;
|
type ping_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
can_exec($1,ping_exec_t)
|
can_exec($1, ping_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -223,7 +223,7 @@ interface(`netutils_domtrans_traceroute',`
|
|||||||
type traceroute_t, traceroute_exec_t;
|
type traceroute_t, traceroute_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,traceroute_exec_t,traceroute_t)
|
domtrans_pattern($1, traceroute_exec_t, traceroute_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -309,5 +309,5 @@ interface(`netutils_exec_traceroute',`
|
|||||||
type traceroute_exec_t;
|
type traceroute_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
can_exec($1,traceroute_exec_t)
|
can_exec($1, traceroute_exec_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(netutils,1.6.0)
|
policy_module(netutils, 1.6.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -11,11 +11,11 @@ policy_module(netutils,1.6.0)
|
|||||||
## Control users use of ping and traceroute
|
## Control users use of ping and traceroute
|
||||||
## </p>
|
## </p>
|
||||||
## </desc>
|
## </desc>
|
||||||
gen_tunable(user_ping,false)
|
gen_tunable(user_ping, false)
|
||||||
|
|
||||||
type netutils_t;
|
type netutils_t;
|
||||||
type netutils_exec_t;
|
type netutils_exec_t;
|
||||||
init_system_domain(netutils_t,netutils_exec_t)
|
init_system_domain(netutils_t, netutils_exec_t)
|
||||||
role system_r types netutils_t;
|
role system_r types netutils_t;
|
||||||
|
|
||||||
type netutils_tmp_t;
|
type netutils_tmp_t;
|
||||||
@ -23,12 +23,12 @@ files_tmp_file(netutils_tmp_t)
|
|||||||
|
|
||||||
type ping_t;
|
type ping_t;
|
||||||
type ping_exec_t;
|
type ping_exec_t;
|
||||||
init_system_domain(ping_t,ping_exec_t)
|
init_system_domain(ping_t, ping_exec_t)
|
||||||
role system_r types ping_t;
|
role system_r types ping_t;
|
||||||
|
|
||||||
type traceroute_t;
|
type traceroute_t;
|
||||||
type traceroute_exec_t;
|
type traceroute_exec_t;
|
||||||
init_system_domain(traceroute_t,traceroute_exec_t)
|
init_system_domain(traceroute_t, traceroute_exec_t)
|
||||||
role system_r types traceroute_t;
|
role system_r types traceroute_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -45,8 +45,8 @@ allow netutils_t self:packet_socket create_socket_perms;
|
|||||||
allow netutils_t self:udp_socket create_socket_perms;
|
allow netutils_t self:udp_socket create_socket_perms;
|
||||||
allow netutils_t self:tcp_socket create_stream_socket_perms;
|
allow netutils_t self:tcp_socket create_stream_socket_perms;
|
||||||
|
|
||||||
manage_dirs_pattern(netutils_t,netutils_tmp_t,netutils_tmp_t)
|
manage_dirs_pattern(netutils_t, netutils_tmp_t, netutils_tmp_t)
|
||||||
manage_files_pattern(netutils_t,netutils_tmp_t,netutils_tmp_t)
|
manage_files_pattern(netutils_t, netutils_tmp_t, netutils_tmp_t)
|
||||||
files_tmp_filetrans(netutils_t, netutils_tmp_t, { file dir })
|
files_tmp_filetrans(netutils_t, netutils_tmp_t, { file dir })
|
||||||
|
|
||||||
kernel_search_proc(netutils_t)
|
kernel_search_proc(netutils_t)
|
||||||
|
@ -28,7 +28,7 @@ interface(`portage_domtrans',`
|
|||||||
allow portage_t $1:process sigchld;
|
allow portage_t $1:process sigchld;
|
||||||
|
|
||||||
# transition to portage
|
# transition to portage
|
||||||
domtrans_pattern($1,portage_exec_t,portage_t.merge)
|
domtrans_pattern($1, portage_exec_t, portage_t.merge)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -127,20 +127,20 @@ interface(`portage_compile_domain',`
|
|||||||
allow $1 portage_log_t:file { append write setattr };
|
allow $1 portage_log_t:file { append write setattr };
|
||||||
|
|
||||||
# run scripts out of the build directory
|
# run scripts out of the build directory
|
||||||
can_exec(portage_sandbox_t,portage_tmp_t)
|
can_exec(portage_sandbox_t, portage_tmp_t)
|
||||||
|
|
||||||
manage_dirs_pattern($1,portage_tmp_t,portage_tmp_t)
|
manage_dirs_pattern($1, portage_tmp_t, portage_tmp_t)
|
||||||
manage_files_pattern($1,portage_tmp_t,portage_tmp_t)
|
manage_files_pattern($1, portage_tmp_t, portage_tmp_t)
|
||||||
manage_lnk_files_pattern($1,portage_tmp_t,portage_tmp_t)
|
manage_lnk_files_pattern($1, portage_tmp_t, portage_tmp_t)
|
||||||
manage_fifo_files_pattern($1,portage_tmp_t,portage_tmp_t)
|
manage_fifo_files_pattern($1, portage_tmp_t, portage_tmp_t)
|
||||||
manage_sock_files_pattern($1,portage_tmp_t,portage_tmp_t)
|
manage_sock_files_pattern($1, portage_tmp_t, portage_tmp_t)
|
||||||
files_tmp_filetrans($1,portage_tmp_t,{ dir file lnk_file sock_file fifo_file })
|
files_tmp_filetrans($1, portage_tmp_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
manage_files_pattern($1,portage_tmpfs_t,portage_tmpfs_t)
|
manage_files_pattern($1, portage_tmpfs_t, portage_tmpfs_t)
|
||||||
manage_lnk_files_pattern($1,portage_tmpfs_t,portage_tmpfs_t)
|
manage_lnk_files_pattern($1, portage_tmpfs_t, portage_tmpfs_t)
|
||||||
manage_fifo_files_pattern($1,portage_tmpfs_t,portage_tmpfs_t)
|
manage_fifo_files_pattern($1, portage_tmpfs_t, portage_tmpfs_t)
|
||||||
manage_sock_files_pattern($1,portage_tmpfs_t,portage_tmpfs_t)
|
manage_sock_files_pattern($1, portage_tmpfs_t, portage_tmpfs_t)
|
||||||
fs_tmpfs_filetrans($1,portage_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1, portage_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
kernel_read_system_state($1)
|
kernel_read_system_state($1)
|
||||||
kernel_read_network_state($1)
|
kernel_read_network_state($1)
|
||||||
@ -232,13 +232,13 @@ interface(`portage_fetch_domain',`
|
|||||||
allow $1 self:tcp_socket create_stream_socket_perms;
|
allow $1 self:tcp_socket create_stream_socket_perms;
|
||||||
|
|
||||||
allow $1 portage_conf_t:dir list_dir_perms;
|
allow $1 portage_conf_t:dir list_dir_perms;
|
||||||
read_files_pattern($1,portage_conf_t,portage_conf_t)
|
read_files_pattern($1, portage_conf_t, portage_conf_t)
|
||||||
|
|
||||||
manage_dirs_pattern($1,portage_ebuild_t,portage_ebuild_t)
|
manage_dirs_pattern($1, portage_ebuild_t, portage_ebuild_t)
|
||||||
manage_files_pattern($1,portage_ebuild_t,portage_ebuild_t)
|
manage_files_pattern($1, portage_ebuild_t, portage_ebuild_t)
|
||||||
|
|
||||||
manage_dirs_pattern($1,portage_fetch_tmp_t,portage_fetch_tmp_t)
|
manage_dirs_pattern($1, portage_fetch_tmp_t, portage_fetch_tmp_t)
|
||||||
manage_files_pattern($1,portage_fetch_tmp_t,portage_fetch_tmp_t)
|
manage_files_pattern($1, portage_fetch_tmp_t, portage_fetch_tmp_t)
|
||||||
|
|
||||||
# portage makes home dir the portage tmp dir, so
|
# portage makes home dir the portage tmp dir, so
|
||||||
# wget looks for .wgetrc there
|
# wget looks for .wgetrc there
|
||||||
@ -309,10 +309,10 @@ interface(`portage_main_domain',`
|
|||||||
portage_compile_domain($1)
|
portage_compile_domain($1)
|
||||||
|
|
||||||
allow $1 portage_log_t:file manage_file_perms;
|
allow $1 portage_log_t:file manage_file_perms;
|
||||||
logging_log_filetrans($1,portage_log_t,file)
|
logging_log_filetrans($1, portage_log_t, file)
|
||||||
|
|
||||||
# run scripts out of the build directory
|
# run scripts out of the build directory
|
||||||
can_exec($1,portage_tmp_t)
|
can_exec($1, portage_tmp_t)
|
||||||
|
|
||||||
# merging baselayout will need this:
|
# merging baselayout will need this:
|
||||||
kernel_write_proc_files($1)
|
kernel_write_proc_files($1)
|
||||||
@ -378,7 +378,7 @@ interface(`portage_domtrans_gcc_config',`
|
|||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
|
|
||||||
domtrans_pattern($1,gcc_config_exec_t,gcc_config_t)
|
domtrans_pattern($1, gcc_config_exec_t, gcc_config_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -8,18 +8,18 @@ policy_module(portage, 1.6.0)
|
|||||||
|
|
||||||
type gcc_config_t;
|
type gcc_config_t;
|
||||||
type gcc_config_exec_t;
|
type gcc_config_exec_t;
|
||||||
application_domain(gcc_config_t,gcc_config_exec_t)
|
application_domain(gcc_config_t, gcc_config_exec_t)
|
||||||
|
|
||||||
# constraining type
|
# constraining type
|
||||||
type portage_t;
|
type portage_t;
|
||||||
type portage_exec_t;
|
type portage_exec_t;
|
||||||
application_domain(portage_t,portage_exec_t)
|
application_domain(portage_t, portage_exec_t)
|
||||||
rsync_entry_type(portage_t)
|
rsync_entry_type(portage_t)
|
||||||
corecmd_shell_entry_type(portage_t)
|
corecmd_shell_entry_type(portage_t)
|
||||||
|
|
||||||
# portage domain for merging packages to the live fs
|
# portage domain for merging packages to the live fs
|
||||||
type portage_t.merge;
|
type portage_t.merge;
|
||||||
application_domain(portage_t.merge,portage_exec_t)
|
application_domain(portage_t.merge, portage_exec_t)
|
||||||
domain_obj_id_change_exemption(portage_t.merge)
|
domain_obj_id_change_exemption(portage_t.merge)
|
||||||
|
|
||||||
# portage compile sandbox domain
|
# portage compile sandbox domain
|
||||||
@ -70,12 +70,12 @@ files_tmpfs_file(portage_tmpfs_t)
|
|||||||
allow gcc_config_t self:capability { chown fsetid };
|
allow gcc_config_t self:capability { chown fsetid };
|
||||||
allow gcc_config_t self:fifo_file rw_file_perms;
|
allow gcc_config_t self:fifo_file rw_file_perms;
|
||||||
|
|
||||||
manage_files_pattern(gcc_config_t,portage_cache_t,portage_cache_t)
|
manage_files_pattern(gcc_config_t, portage_cache_t, portage_cache_t)
|
||||||
|
|
||||||
read_files_pattern(gcc_config_t,portage_conf_t,portage_conf_t)
|
read_files_pattern(gcc_config_t, portage_conf_t, portage_conf_t)
|
||||||
|
|
||||||
allow gcc_config_t portage_ebuild_t:dir list_dir_perms;
|
allow gcc_config_t portage_ebuild_t:dir list_dir_perms;
|
||||||
read_files_pattern(gcc_config_t,portage_ebuild_t,portage_ebuild_t)
|
read_files_pattern(gcc_config_t, portage_ebuild_t, portage_ebuild_t)
|
||||||
|
|
||||||
allow gcc_config_t portage_exec_t:file { execute getattr };
|
allow gcc_config_t portage_exec_t:file { execute getattr };
|
||||||
|
|
||||||
@ -127,8 +127,8 @@ portage_compile_domain(portage_t)
|
|||||||
portage_fetch_domain(portage_t)
|
portage_fetch_domain(portage_t)
|
||||||
|
|
||||||
# transition between child domains on shells and rsync
|
# transition between child domains on shells and rsync
|
||||||
corecmd_shell_spec_domtrans(portage_t,portage_t)
|
corecmd_shell_spec_domtrans(portage_t, portage_t)
|
||||||
rsync_entry_spec_domtrans(portage_t,portage_t)
|
rsync_entry_spec_domtrans(portage_t, portage_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -144,14 +144,14 @@ allow portage_t.merge { portage_t.fetch portage_t.sandbox }:process signal;
|
|||||||
|
|
||||||
# transition for rsync and wget
|
# transition for rsync and wget
|
||||||
corecmd_shell_spec_domtrans(portage_t.merge,portage_t.fetch)
|
corecmd_shell_spec_domtrans(portage_t.merge,portage_t.fetch)
|
||||||
rsync_entry_domtrans(portage_t.merge,portage_t.fetch)
|
rsync_entry_domtrans(portage_t.merge, portage_t.fetch)
|
||||||
allow portage_t.fetch portage_t.merge:fd use;
|
allow portage_t.fetch portage_t.merge:fd use;
|
||||||
allow portage_t.fetch portage_t.merge:fifo_file rw_file_perms;
|
allow portage_t.fetch portage_t.merge:fifo_file rw_file_perms;
|
||||||
allow portage_t.fetch portage_t.merge:process sigchld;
|
allow portage_t.fetch portage_t.merge:process sigchld;
|
||||||
|
|
||||||
# transition to sandbox for compiling
|
# transition to sandbox for compiling
|
||||||
domain_trans(portage_t.merge,portage_exec_t,portage_t.sandbox)
|
domain_trans(portage_t.merge, portage_exec_t, portage_t.sandbox)
|
||||||
corecmd_shell_spec_domtrans(portage_t.merge,portage_t.sandbox)
|
corecmd_shell_spec_domtrans(portage_t.merge, portage_t.sandbox)
|
||||||
allow portage_t.sandbox portage_t.merge:fd use;
|
allow portage_t.sandbox portage_t.merge:fd use;
|
||||||
allow portage_t.sandbox portage_t.merge:fifo_file rw_file_perms;
|
allow portage_t.sandbox portage_t.merge:fifo_file rw_file_perms;
|
||||||
allow portage_t.sandbox portage_t.merge:process sigchld;
|
allow portage_t.sandbox portage_t.merge:process sigchld;
|
||||||
|
@ -124,5 +124,5 @@ interface(`prelink_manage_log',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
logging_search_logs($1)
|
logging_search_logs($1)
|
||||||
manage_files_pattern($1,prelink_log_t,prelink_log_t)
|
manage_files_pattern($1, prelink_log_t, prelink_log_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(prelink,1.5.0)
|
policy_module(prelink, 1.5.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -9,7 +9,7 @@ attribute prelink_object;
|
|||||||
|
|
||||||
type prelink_t;
|
type prelink_t;
|
||||||
type prelink_exec_t;
|
type prelink_exec_t;
|
||||||
init_system_domain(prelink_t,prelink_exec_t)
|
init_system_domain(prelink_t, prelink_exec_t)
|
||||||
domain_obj_id_change_exemption(prelink_t)
|
domain_obj_id_change_exemption(prelink_t)
|
||||||
|
|
||||||
type prelink_cache_t;
|
type prelink_cache_t;
|
||||||
@ -35,9 +35,9 @@ files_etc_filetrans(prelink_t, prelink_cache_t, file)
|
|||||||
files_var_lib_filetrans(prelink_t, prelink_cache_t, file)
|
files_var_lib_filetrans(prelink_t, prelink_cache_t, file)
|
||||||
|
|
||||||
allow prelink_t prelink_log_t:dir setattr;
|
allow prelink_t prelink_log_t:dir setattr;
|
||||||
create_files_pattern(prelink_t,prelink_log_t,prelink_log_t)
|
create_files_pattern(prelink_t, prelink_log_t, prelink_log_t)
|
||||||
append_files_pattern(prelink_t,prelink_log_t,prelink_log_t)
|
append_files_pattern(prelink_t, prelink_log_t, prelink_log_t)
|
||||||
read_lnk_files_pattern(prelink_t,prelink_log_t,prelink_log_t)
|
read_lnk_files_pattern(prelink_t, prelink_log_t, prelink_log_t)
|
||||||
logging_log_filetrans(prelink_t, prelink_log_t, file)
|
logging_log_filetrans(prelink_t, prelink_log_t, file)
|
||||||
|
|
||||||
allow prelink_t prelink_tmp_t:file { manage_file_perms execute relabelfrom };
|
allow prelink_t prelink_tmp_t:file { manage_file_perms execute relabelfrom };
|
||||||
|
@ -15,7 +15,7 @@ interface(`quota_domtrans',`
|
|||||||
type quota_t, quota_exec_t;
|
type quota_t, quota_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,quota_exec_t,quota_t)
|
domtrans_pattern($1, quota_exec_t, quota_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -86,5 +86,5 @@ interface(`quota_manage_flags',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
files_search_var_lib($1)
|
files_search_var_lib($1)
|
||||||
manage_files_pattern($1,quota_flag_t,quota_flag_t)
|
manage_files_pattern($1, quota_flag_t, quota_flag_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(quota,1.3.0)
|
policy_module(quota, 1.3.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(quota,1.3.0)
|
|||||||
|
|
||||||
type quota_t;
|
type quota_t;
|
||||||
type quota_exec_t;
|
type quota_exec_t;
|
||||||
init_system_domain(quota_t,quota_exec_t)
|
init_system_domain(quota_t, quota_exec_t)
|
||||||
|
|
||||||
type quota_db_t;
|
type quota_db_t;
|
||||||
files_type(quota_db_t)
|
files_type(quota_db_t)
|
||||||
|
@ -8,8 +8,8 @@ policy_module(readahead, 1.6.0)
|
|||||||
|
|
||||||
type readahead_t;
|
type readahead_t;
|
||||||
type readahead_exec_t;
|
type readahead_exec_t;
|
||||||
init_daemon_domain(readahead_t,readahead_exec_t)
|
init_daemon_domain(readahead_t, readahead_exec_t)
|
||||||
application_domain(readahead_t,readahead_exec_t)
|
application_domain(readahead_t, readahead_exec_t)
|
||||||
|
|
||||||
type readahead_etc_rw_t;
|
type readahead_etc_rw_t;
|
||||||
files_pid_file(readahead_etc_rw_t)
|
files_pid_file(readahead_etc_rw_t)
|
||||||
@ -26,10 +26,10 @@ allow readahead_t self:capability { dac_override dac_read_search };
|
|||||||
dontaudit readahead_t self:capability sys_tty_config;
|
dontaudit readahead_t self:capability sys_tty_config;
|
||||||
allow readahead_t self:process signal_perms;
|
allow readahead_t self:process signal_perms;
|
||||||
|
|
||||||
manage_files_pattern(readahead_t,readahead_etc_rw_t,readahead_etc_rw_t)
|
manage_files_pattern(readahead_t, readahead_etc_rw_t, readahead_etc_rw_t)
|
||||||
|
|
||||||
manage_files_pattern(readahead_t,readahead_var_run_t,readahead_var_run_t)
|
manage_files_pattern(readahead_t, readahead_var_run_t, readahead_var_run_t)
|
||||||
files_pid_filetrans(readahead_t,readahead_var_run_t,file)
|
files_pid_filetrans(readahead_t, readahead_var_run_t, file)
|
||||||
|
|
||||||
kernel_read_kernel_sysctls(readahead_t)
|
kernel_read_kernel_sysctls(readahead_t)
|
||||||
kernel_read_system_state(readahead_t)
|
kernel_read_system_state(readahead_t)
|
||||||
|
@ -17,7 +17,7 @@ interface(`rpm_domtrans',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,rpm_exec_t,rpm_t)
|
domtrans_pattern($1, rpm_exec_t, rpm_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -71,9 +71,9 @@ interface(`rpm_run',`
|
|||||||
rpm_domtrans($1)
|
rpm_domtrans($1)
|
||||||
role $2 types rpm_t;
|
role $2 types rpm_t;
|
||||||
role $2 types rpm_script_t;
|
role $2 types rpm_script_t;
|
||||||
seutil_run_loadpolicy(rpm_script_t,$2,$3)
|
seutil_run_loadpolicy(rpm_script_t, $2, $3)
|
||||||
seutil_run_semanage(rpm_script_t,$2,$3)
|
seutil_run_semanage(rpm_script_t, $2, $3)
|
||||||
seutil_run_setfiles(rpm_script_t,$2,$3)
|
seutil_run_setfiles(rpm_script_t, $2, $3)
|
||||||
allow rpm_t $3:chr_file rw_term_perms;
|
allow rpm_t $3:chr_file rw_term_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -93,7 +93,7 @@ interface(`rpm_exec',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
can_exec($1,rpm_exec_t)
|
can_exec($1, rpm_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -225,7 +225,7 @@ interface(`rpm_manage_script_tmp_files',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
files_search_tmp($1)
|
files_search_tmp($1)
|
||||||
manage_files_pattern($1,rpm_script_tmp_t,rpm_script_tmp_t)
|
manage_files_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -245,8 +245,8 @@ interface(`rpm_read_db',`
|
|||||||
|
|
||||||
files_search_var_lib($1)
|
files_search_var_lib($1)
|
||||||
allow $1 rpm_var_lib_t:dir list_dir_perms;
|
allow $1 rpm_var_lib_t:dir list_dir_perms;
|
||||||
read_files_pattern($1,rpm_var_lib_t,rpm_var_lib_t)
|
read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
|
||||||
read_lnk_files_pattern($1,rpm_var_lib_t,rpm_var_lib_t)
|
read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -265,8 +265,8 @@ interface(`rpm_manage_db',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
files_search_var_lib($1)
|
files_search_var_lib($1)
|
||||||
manage_files_pattern($1,rpm_var_lib_t,rpm_var_lib_t)
|
manage_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
|
||||||
manage_lnk_files_pattern($1,rpm_var_lib_t,rpm_var_lib_t)
|
manage_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(rpm,1.8.0)
|
policy_module(rpm, 1.8.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(rpm,1.8.0)
|
|||||||
|
|
||||||
type rpm_t;
|
type rpm_t;
|
||||||
type rpm_exec_t;
|
type rpm_exec_t;
|
||||||
init_system_domain(rpm_t,rpm_exec_t)
|
init_system_domain(rpm_t, rpm_exec_t)
|
||||||
domain_obj_id_change_exemption(rpm_t)
|
domain_obj_id_change_exemption(rpm_t)
|
||||||
domain_role_change_exemption(rpm_t)
|
domain_role_change_exemption(rpm_t)
|
||||||
domain_system_change_exemption(rpm_t)
|
domain_system_change_exemption(rpm_t)
|
||||||
@ -37,7 +37,7 @@ domain_obj_id_change_exemption(rpm_script_t)
|
|||||||
domain_system_change_exemption(rpm_script_t)
|
domain_system_change_exemption(rpm_script_t)
|
||||||
corecmd_shell_entry_type(rpm_script_t)
|
corecmd_shell_entry_type(rpm_script_t)
|
||||||
domain_type(rpm_script_t)
|
domain_type(rpm_script_t)
|
||||||
domain_entry_file(rpm_t,rpm_script_exec_t)
|
domain_entry_file(rpm_t, rpm_script_exec_t)
|
||||||
domain_interactive_fd(rpm_script_t)
|
domain_interactive_fd(rpm_script_t)
|
||||||
role system_r types rpm_script_t;
|
role system_r types rpm_script_t;
|
||||||
|
|
||||||
@ -72,22 +72,22 @@ allow rpm_t self:dir search;
|
|||||||
allow rpm_t self:file rw_file_perms;;
|
allow rpm_t self:file rw_file_perms;;
|
||||||
|
|
||||||
allow rpm_t rpm_log_t:file manage_file_perms;
|
allow rpm_t rpm_log_t:file manage_file_perms;
|
||||||
logging_log_filetrans(rpm_t,rpm_log_t,file)
|
logging_log_filetrans(rpm_t, rpm_log_t, file)
|
||||||
|
|
||||||
manage_dirs_pattern(rpm_t,rpm_tmp_t,rpm_tmp_t)
|
manage_dirs_pattern(rpm_t, rpm_tmp_t, rpm_tmp_t)
|
||||||
manage_files_pattern(rpm_t,rpm_tmp_t,rpm_tmp_t)
|
manage_files_pattern(rpm_t, rpm_tmp_t, rpm_tmp_t)
|
||||||
files_tmp_filetrans(rpm_t, rpm_tmp_t, { file dir })
|
files_tmp_filetrans(rpm_t, rpm_tmp_t, { file dir })
|
||||||
|
|
||||||
manage_dirs_pattern(rpm_t,rpm_tmpfs_t,rpm_tmpfs_t)
|
manage_dirs_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
|
||||||
manage_files_pattern(rpm_t,rpm_tmpfs_t,rpm_tmpfs_t)
|
manage_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
|
||||||
manage_lnk_files_pattern(rpm_t,rpm_tmpfs_t,rpm_tmpfs_t)
|
manage_lnk_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
|
||||||
manage_fifo_files_pattern(rpm_t,rpm_tmpfs_t,rpm_tmpfs_t)
|
manage_fifo_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
|
||||||
manage_sock_files_pattern(rpm_t,rpm_tmpfs_t,rpm_tmpfs_t)
|
manage_sock_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
|
||||||
fs_tmpfs_filetrans(rpm_t,rpm_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans(rpm_t, rpm_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
# Access /var/lib/rpm files
|
# Access /var/lib/rpm files
|
||||||
manage_files_pattern(rpm_t,rpm_var_lib_t,rpm_var_lib_t)
|
manage_files_pattern(rpm_t, rpm_var_lib_t, rpm_var_lib_t)
|
||||||
files_var_lib_filetrans(rpm_t,rpm_var_lib_t,dir)
|
files_var_lib_filetrans(rpm_t, rpm_var_lib_t, dir)
|
||||||
|
|
||||||
kernel_read_system_state(rpm_t)
|
kernel_read_system_state(rpm_t)
|
||||||
kernel_read_kernel_sysctls(rpm_t)
|
kernel_read_kernel_sysctls(rpm_t)
|
||||||
@ -175,7 +175,7 @@ seutil_manage_bin_policy(rpm_t)
|
|||||||
userdom_use_unpriv_users_fds(rpm_t)
|
userdom_use_unpriv_users_fds(rpm_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cron_system_entry(rpm_t,rpm_exec_t)
|
cron_system_entry(rpm_t, rpm_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -231,16 +231,16 @@ allow rpm_script_t self:msg { send receive };
|
|||||||
allow rpm_script_t rpm_tmp_t:file read_file_perms;
|
allow rpm_script_t rpm_tmp_t:file read_file_perms;
|
||||||
|
|
||||||
allow rpm_script_t rpm_script_tmp_t:dir mounton;
|
allow rpm_script_t rpm_script_tmp_t:dir mounton;
|
||||||
manage_dirs_pattern(rpm_script_t,rpm_script_tmp_t,rpm_script_tmp_t)
|
manage_dirs_pattern(rpm_script_t, rpm_script_tmp_t, rpm_script_tmp_t)
|
||||||
manage_files_pattern(rpm_script_t,rpm_script_tmp_t,rpm_script_tmp_t)
|
manage_files_pattern(rpm_script_t, rpm_script_tmp_t, rpm_script_tmp_t)
|
||||||
files_tmp_filetrans(rpm_script_t, rpm_script_tmp_t, { file dir })
|
files_tmp_filetrans(rpm_script_t, rpm_script_tmp_t, { file dir })
|
||||||
|
|
||||||
manage_dirs_pattern(rpm_script_t,rpm_script_tmpfs_t,rpm_script_tmpfs_t)
|
manage_dirs_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t)
|
||||||
manage_files_pattern(rpm_script_t,rpm_script_tmpfs_t,rpm_script_tmpfs_t)
|
manage_files_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t)
|
||||||
manage_lnk_files_pattern(rpm_script_t,rpm_script_tmpfs_t,rpm_script_tmpfs_t)
|
manage_lnk_files_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t)
|
||||||
manage_fifo_files_pattern(rpm_script_t,rpm_script_tmpfs_t,rpm_script_tmpfs_t)
|
manage_fifo_files_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t)
|
||||||
manage_sock_files_pattern(rpm_script_t,rpm_script_tmpfs_t,rpm_script_tmpfs_t)
|
manage_sock_files_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t)
|
||||||
fs_tmpfs_filetrans(rpm_script_t,rpm_script_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans(rpm_script_t, rpm_script_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
kernel_read_kernel_sysctls(rpm_script_t)
|
kernel_read_kernel_sysctls(rpm_script_t)
|
||||||
kernel_read_system_state(rpm_script_t)
|
kernel_read_system_state(rpm_script_t)
|
||||||
|
@ -34,7 +34,7 @@ template(`su_restricted_domain_template', `
|
|||||||
')
|
')
|
||||||
|
|
||||||
type $1_su_t;
|
type $1_su_t;
|
||||||
domain_entry_file($1_su_t,su_exec_t)
|
domain_entry_file($1_su_t, su_exec_t)
|
||||||
domain_type($1_su_t)
|
domain_type($1_su_t)
|
||||||
domain_interactive_fd($1_su_t)
|
domain_interactive_fd($1_su_t)
|
||||||
role $3 types $1_su_t;
|
role $3 types $1_su_t;
|
||||||
@ -185,7 +185,7 @@ template(`su_per_role_template',`
|
|||||||
domtrans_pattern($2, su_exec_t, $1_su_t)
|
domtrans_pattern($2, su_exec_t, $1_su_t)
|
||||||
|
|
||||||
# By default, revert to the calling domain when a shell is executed.
|
# By default, revert to the calling domain when a shell is executed.
|
||||||
corecmd_shell_domtrans($1_su_t,$2)
|
corecmd_shell_domtrans($1_su_t, $2)
|
||||||
allow $2 $1_su_t:fd use;
|
allow $2 $1_su_t:fd use;
|
||||||
allow $2 $1_su_t:fifo_file rw_file_perms;
|
allow $2 $1_su_t:fifo_file rw_file_perms;
|
||||||
allow $2 $1_su_t:process sigchld;
|
allow $2 $1_su_t:process sigchld;
|
||||||
@ -203,7 +203,7 @@ template(`su_per_role_template',`
|
|||||||
# needed for pam_rootok
|
# needed for pam_rootok
|
||||||
selinux_compute_access_vector($1_su_t)
|
selinux_compute_access_vector($1_su_t)
|
||||||
|
|
||||||
auth_domtrans_user_chk_passwd($1,$1_su_t)
|
auth_domtrans_user_chk_passwd($1, $1_su_t)
|
||||||
auth_dontaudit_read_shadow($1_su_t)
|
auth_dontaudit_read_shadow($1_su_t)
|
||||||
auth_use_nsswitch($1_su_t)
|
auth_use_nsswitch($1_su_t)
|
||||||
auth_rw_faillog($1_su_t)
|
auth_rw_faillog($1_su_t)
|
||||||
@ -230,8 +230,8 @@ template(`su_per_role_template',`
|
|||||||
|
|
||||||
miscfiles_read_localization($1_su_t)
|
miscfiles_read_localization($1_su_t)
|
||||||
|
|
||||||
userdom_use_user_terminals($1,$1_su_t)
|
userdom_use_user_terminals($1, $1_su_t)
|
||||||
userdom_search_user_home_dirs($1,$1_su_t)
|
userdom_search_user_home_dirs($1, $1_su_t)
|
||||||
|
|
||||||
ifdef(`distro_rhel4',`
|
ifdef(`distro_rhel4',`
|
||||||
domain_role_change_exemption($1_su_t)
|
domain_role_change_exemption($1_su_t)
|
||||||
@ -319,5 +319,5 @@ interface(`su_exec',`
|
|||||||
type su_exec_t;
|
type su_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
can_exec($1,su_exec_t)
|
can_exec($1, su_exec_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(su,1.8.0)
|
policy_module(su, 1.8.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -45,7 +45,7 @@ template(`sudo_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_sudo_t;
|
type $1_sudo_t;
|
||||||
application_domain($1_sudo_t,sudo_exec_t)
|
application_domain($1_sudo_t, sudo_exec_t)
|
||||||
domain_interactive_fd($1_sudo_t)
|
domain_interactive_fd($1_sudo_t)
|
||||||
role $3 types $1_sudo_t;
|
role $3 types $1_sudo_t;
|
||||||
|
|
||||||
@ -74,7 +74,7 @@ template(`sudo_per_role_template',`
|
|||||||
domtrans_pattern($2, sudo_exec_t, $1_sudo_t)
|
domtrans_pattern($2, sudo_exec_t, $1_sudo_t)
|
||||||
|
|
||||||
# By default, revert to the calling domain when a shell is executed.
|
# By default, revert to the calling domain when a shell is executed.
|
||||||
corecmd_shell_domtrans($1_sudo_t,$2)
|
corecmd_shell_domtrans($1_sudo_t, $2)
|
||||||
allow $2 $1_sudo_t:fd use;
|
allow $2 $1_sudo_t:fd use;
|
||||||
allow $2 $1_sudo_t:fifo_file rw_file_perms;
|
allow $2 $1_sudo_t:fifo_file rw_file_perms;
|
||||||
allow $2 $1_sudo_t:process sigchld;
|
allow $2 $1_sudo_t:process sigchld;
|
||||||
@ -116,11 +116,11 @@ template(`sudo_per_role_template',`
|
|||||||
|
|
||||||
miscfiles_read_localization($1_sudo_t)
|
miscfiles_read_localization($1_sudo_t)
|
||||||
|
|
||||||
userdom_manage_user_home_content_files($1,$1_sudo_t)
|
userdom_manage_user_home_content_files($1, $1_sudo_t)
|
||||||
userdom_manage_user_home_content_symlinks($1,$1_sudo_t)
|
userdom_manage_user_home_content_symlinks($1, $1_sudo_t)
|
||||||
userdom_manage_user_tmp_files($1,$1_sudo_t)
|
userdom_manage_user_tmp_files($1, $1_sudo_t)
|
||||||
userdom_manage_user_tmp_symlinks($1,$1_sudo_t)
|
userdom_manage_user_tmp_symlinks($1, $1_sudo_t)
|
||||||
userdom_use_user_terminals($1,$1_sudo_t)
|
userdom_use_user_terminals($1, $1_sudo_t)
|
||||||
userdom_use_unpriv_users_fds($1_sudo_t)
|
userdom_use_unpriv_users_fds($1_sudo_t)
|
||||||
# for some PAM modules and for cwd
|
# for some PAM modules and for cwd
|
||||||
userdom_dontaudit_search_all_users_home_content($1_sudo_t)
|
userdom_dontaudit_search_all_users_home_content($1_sudo_t)
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(sudo,1.3.0)
|
policy_module(sudo, 1.3.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(sxid,1.4.0)
|
policy_module(sxid, 1.4.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(sxid,1.4.0)
|
|||||||
|
|
||||||
type sxid_t;
|
type sxid_t;
|
||||||
type sxid_exec_t;
|
type sxid_exec_t;
|
||||||
application_domain(sxid_t,sxid_exec_t)
|
application_domain(sxid_t, sxid_exec_t)
|
||||||
|
|
||||||
type sxid_log_t;
|
type sxid_log_t;
|
||||||
logging_log_file(sxid_log_t)
|
logging_log_file(sxid_log_t)
|
||||||
@ -31,8 +31,8 @@ allow sxid_t self:udp_socket create_socket_perms;
|
|||||||
allow sxid_t sxid_log_t:file manage_file_perms;
|
allow sxid_t sxid_log_t:file manage_file_perms;
|
||||||
logging_log_filetrans(sxid_t,sxid_log_t,file)
|
logging_log_filetrans(sxid_t,sxid_log_t,file)
|
||||||
|
|
||||||
manage_dirs_pattern(sxid_t,sxid_tmp_t,sxid_tmp_t)
|
manage_dirs_pattern(sxid_t, sxid_tmp_t, sxid_tmp_t)
|
||||||
manage_files_pattern(sxid_t,sxid_tmp_t,sxid_tmp_t)
|
manage_files_pattern(sxid_t, sxid_tmp_t, sxid_tmp_t)
|
||||||
files_tmp_filetrans(sxid_t, sxid_tmp_t, { file dir })
|
files_tmp_filetrans(sxid_t, sxid_tmp_t, { file dir })
|
||||||
|
|
||||||
kernel_read_system_state(sxid_t)
|
kernel_read_system_state(sxid_t)
|
||||||
@ -86,7 +86,7 @@ sysnet_read_config(sxid_t)
|
|||||||
|
|
||||||
userdom_dontaudit_use_unpriv_user_fds(sxid_t)
|
userdom_dontaudit_use_unpriv_user_fds(sxid_t)
|
||||||
|
|
||||||
cron_system_entry(sxid_t,sxid_exec_t)
|
cron_system_entry(sxid_t, sxid_exec_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
mta_send_mail(sxid_t)
|
mta_send_mail(sxid_t)
|
||||||
|
@ -17,5 +17,5 @@ interface(`tmpreaper_exec',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
can_exec($1,tmpreaper_exec_t)
|
can_exec($1, tmpreaper_exec_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(tmpreaper,1.3.0)
|
policy_module(tmpreaper, 1.3.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(tmpreaper,1.3.0)
|
|||||||
|
|
||||||
type tmpreaper_t;
|
type tmpreaper_t;
|
||||||
type tmpreaper_exec_t;
|
type tmpreaper_exec_t;
|
||||||
application_domain(tmpreaper_t,tmpreaper_exec_t)
|
application_domain(tmpreaper_t, tmpreaper_exec_t)
|
||||||
role system_r types tmpreaper_t;
|
role system_r types tmpreaper_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -40,7 +40,7 @@ logging_send_syslog_msg(tmpreaper_t)
|
|||||||
miscfiles_read_localization(tmpreaper_t)
|
miscfiles_read_localization(tmpreaper_t)
|
||||||
miscfiles_delete_man_pages(tmpreaper_t)
|
miscfiles_delete_man_pages(tmpreaper_t)
|
||||||
|
|
||||||
cron_system_entry(tmpreaper_t,tmpreaper_exec_t)
|
cron_system_entry(tmpreaper_t, tmpreaper_exec_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
lpd_manage_spool(tmpreaper_t)
|
lpd_manage_spool(tmpreaper_t)
|
||||||
|
@ -28,7 +28,7 @@ interface(`tripwire_domtrans_tripwire',`
|
|||||||
type tripwire_t, tripwire_exec_t;
|
type tripwire_t, tripwire_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,tripwire_exec_t,tripwire_t)
|
domtrans_pattern($1, tripwire_exec_t, tripwire_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -78,7 +78,7 @@ interface(`tripwire_domtrans_twadmin',`
|
|||||||
type twadmin_t, twadmin_exec_t;
|
type twadmin_t, twadmin_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,twadmin_exec_t,twadmin_t)
|
domtrans_pattern($1, twadmin_exec_t, twadmin_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -128,7 +128,7 @@ interface(`tripwire_domtrans_twprint',`
|
|||||||
type twprint_t, twprint_exec_t;
|
type twprint_t, twprint_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,twprint_exec_t,twprint_t)
|
domtrans_pattern($1, twprint_exec_t, twprint_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -178,7 +178,7 @@ interface(`tripwire_domtrans_siggen',`
|
|||||||
type siggen_t, siggen_exec_t;
|
type siggen_t, siggen_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,siggen_exec_t,siggen_t)
|
domtrans_pattern($1, siggen_exec_t, siggen_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(tripwire,1.1.0)
|
policy_module(tripwire, 1.1.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,11 +8,11 @@ policy_module(tripwire,1.1.0)
|
|||||||
|
|
||||||
type siggen_t;
|
type siggen_t;
|
||||||
type siggen_exec_t;
|
type siggen_exec_t;
|
||||||
application_domain(siggen_t,siggen_exec_t)
|
application_domain(siggen_t, siggen_exec_t)
|
||||||
|
|
||||||
type tripwire_t;
|
type tripwire_t;
|
||||||
type tripwire_exec_t;
|
type tripwire_exec_t;
|
||||||
application_domain(tripwire_t,tripwire_exec_t)
|
application_domain(tripwire_t, tripwire_exec_t)
|
||||||
role system_r types tripwire_t;
|
role system_r types tripwire_t;
|
||||||
|
|
||||||
type tripwire_etc_t;
|
type tripwire_etc_t;
|
||||||
@ -29,11 +29,11 @@ files_type(tripwire_var_lib_t)
|
|||||||
|
|
||||||
type twadmin_t;
|
type twadmin_t;
|
||||||
type twadmin_exec_t;
|
type twadmin_exec_t;
|
||||||
application_domain(twadmin_t,twadmin_exec_t)
|
application_domain(twadmin_t, twadmin_exec_t)
|
||||||
|
|
||||||
type twprint_t;
|
type twprint_t;
|
||||||
type twprint_exec_t;
|
type twprint_exec_t;
|
||||||
application_domain(twprint_t,twprint_exec_t)
|
application_domain(twprint_t, twprint_exec_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -43,24 +43,24 @@ application_domain(twprint_t,twprint_exec_t)
|
|||||||
allow tripwire_t self:capability { setgid setuid dac_override };
|
allow tripwire_t self:capability { setgid setuid dac_override };
|
||||||
|
|
||||||
allow tripwire_t tripwire_etc_t:dir list_dir_perms;
|
allow tripwire_t tripwire_etc_t:dir list_dir_perms;
|
||||||
read_files_pattern(tripwire_t,tripwire_etc_t,tripwire_etc_t)
|
read_files_pattern(tripwire_t, tripwire_etc_t, tripwire_etc_t)
|
||||||
read_lnk_files_pattern(tripwire_t,tripwire_etc_t,tripwire_etc_t)
|
read_lnk_files_pattern(tripwire_t, tripwire_etc_t, tripwire_etc_t)
|
||||||
files_search_etc(tripwire_t)
|
files_search_etc(tripwire_t)
|
||||||
|
|
||||||
# Tripwire report files
|
# Tripwire report files
|
||||||
manage_dirs_pattern(tripwire_t,tripwire_report_t,tripwire_report_t)
|
manage_dirs_pattern(tripwire_t, tripwire_report_t, tripwire_report_t)
|
||||||
manage_files_pattern(tripwire_t,tripwire_report_t,tripwire_report_t)
|
manage_files_pattern(tripwire_t, tripwire_report_t, tripwire_report_t)
|
||||||
manage_lnk_files_pattern(tripwire_t,tripwire_report_t,tripwire_report_t)
|
manage_lnk_files_pattern(tripwire_t, tripwire_report_t, tripwire_report_t)
|
||||||
|
|
||||||
manage_dirs_pattern(tripwire_t,tripwire_tmp_t,tripwire_tmp_t)
|
manage_dirs_pattern(tripwire_t, tripwire_tmp_t, tripwire_tmp_t)
|
||||||
manage_files_pattern(tripwire_t,tripwire_tmp_t,tripwire_tmp_t)
|
manage_files_pattern(tripwire_t, tripwire_tmp_t, tripwire_tmp_t)
|
||||||
manage_lnk_files_pattern(tripwire_t,tripwire_tmp_t,tripwire_tmp_t)
|
manage_lnk_files_pattern(tripwire_t, tripwire_tmp_t, tripwire_tmp_t)
|
||||||
manage_fifo_files_pattern(tripwire_t,tripwire_tmp_t,tripwire_tmp_t)
|
manage_fifo_files_pattern(tripwire_t, tripwire_tmp_t, tripwire_tmp_t)
|
||||||
manage_sock_files_pattern(tripwire_t,tripwire_tmp_t,tripwire_tmp_t)
|
manage_sock_files_pattern(tripwire_t, tripwire_tmp_t, tripwire_tmp_t)
|
||||||
files_tmp_filetrans(tripwire_t,tripwire_tmp_t,{ dir file lnk_file sock_file fifo_file })
|
files_tmp_filetrans(tripwire_t, tripwire_tmp_t,{ dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
manage_files_pattern(tripwire_t,tripwire_var_lib_t,tripwire_var_lib_t)
|
manage_files_pattern(tripwire_t, tripwire_var_lib_t, tripwire_var_lib_t)
|
||||||
files_var_lib_filetrans(tripwire_t,tripwire_var_lib_t,file)
|
files_var_lib_filetrans(tripwire_t, tripwire_var_lib_t, file)
|
||||||
|
|
||||||
kernel_read_system_state(tripwire_t)
|
kernel_read_system_state(tripwire_t)
|
||||||
kernel_read_network_state(tripwire_t)
|
kernel_read_network_state(tripwire_t)
|
||||||
@ -85,7 +85,7 @@ libs_use_shared_libs(tripwire_t)
|
|||||||
logging_send_syslog_msg(tripwire_t)
|
logging_send_syslog_msg(tripwire_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cron_system_entry(tripwire_t,tripwire_exec_t)
|
cron_system_entry(tripwire_t, tripwire_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -93,9 +93,9 @@ optional_policy(`
|
|||||||
# Twadmin local policy
|
# Twadmin local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
manage_dirs_pattern(twadmin_t,tripwire_etc_t,tripwire_etc_t)
|
manage_dirs_pattern(twadmin_t, tripwire_etc_t, tripwire_etc_t)
|
||||||
manage_files_pattern(twadmin_t,tripwire_etc_t,tripwire_etc_t)
|
manage_files_pattern(twadmin_t, tripwire_etc_t, tripwire_etc_t)
|
||||||
manage_lnk_files_pattern(twadmin_t,tripwire_etc_t,tripwire_etc_t)
|
manage_lnk_files_pattern(twadmin_t, tripwire_etc_t, tripwire_etc_t)
|
||||||
|
|
||||||
domain_use_interactive_fds(twadmin_t)
|
domain_use_interactive_fds(twadmin_t)
|
||||||
|
|
||||||
@ -112,16 +112,16 @@ miscfiles_read_localization(twadmin_t)
|
|||||||
#
|
#
|
||||||
|
|
||||||
allow twprint_t tripwire_etc_t:dir list_dir_perms;
|
allow twprint_t tripwire_etc_t:dir list_dir_perms;
|
||||||
read_files_pattern(twprint_t,tripwire_etc_t,tripwire_etc_t)
|
read_files_pattern(twprint_t, tripwire_etc_t, tripwire_etc_t)
|
||||||
read_lnk_files_pattern(twprint_t,tripwire_etc_t,tripwire_etc_t)
|
read_lnk_files_pattern(twprint_t, tripwire_etc_t, tripwire_etc_t)
|
||||||
|
|
||||||
allow twprint_t tripwire_report_t:dir list_dir_perms;
|
allow twprint_t tripwire_report_t:dir list_dir_perms;
|
||||||
read_files_pattern(twprint_t,tripwire_report_t,tripwire_report_t)
|
read_files_pattern(twprint_t, tripwire_report_t, tripwire_report_t)
|
||||||
read_lnk_files_pattern(twprint_t,tripwire_report_t,tripwire_report_t)
|
read_lnk_files_pattern(twprint_t, tripwire_report_t, tripwire_report_t)
|
||||||
|
|
||||||
allow twprint_t tripwire_var_lib_t:dir list_dir_perms;
|
allow twprint_t tripwire_var_lib_t:dir list_dir_perms;
|
||||||
read_files_pattern(twprint_t,tripwire_var_lib_t,tripwire_var_lib_t)
|
read_files_pattern(twprint_t, tripwire_var_lib_t, tripwire_var_lib_t)
|
||||||
read_lnk_files_pattern(twprint_t,tripwire_var_lib_t,tripwire_var_lib_t)
|
read_lnk_files_pattern(twprint_t, tripwire_var_lib_t, tripwire_var_lib_t)
|
||||||
files_search_var_lib(twprint_t)
|
files_search_var_lib(twprint_t)
|
||||||
|
|
||||||
domain_use_interactive_fds(twprint_t)
|
domain_use_interactive_fds(twprint_t)
|
||||||
|
@ -15,7 +15,7 @@ interface(`tzdata_domtrans',`
|
|||||||
type tzdata_t, tzdata_exec_t;
|
type tzdata_t, tzdata_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,tzdata_exec_t,tzdata_t)
|
domtrans_pattern($1, tzdata_exec_t, tzdata_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(tzdata,1.2.0)
|
policy_module(tzdata, 1.2.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -17,5 +17,5 @@ interface(`updfstab_domtrans',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,updfstab_exec_t,updfstab_t)
|
domtrans_pattern($1, updfstab_exec_t, updfstab_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(updfstab,1.4.0)
|
policy_module(updfstab, 1.4.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(updfstab,1.4.0)
|
|||||||
|
|
||||||
type updfstab_t;
|
type updfstab_t;
|
||||||
type updfstab_exec_t;
|
type updfstab_exec_t;
|
||||||
init_system_domain(updfstab_t,updfstab_exec_t)
|
init_system_domain(updfstab_t, updfstab_exec_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -89,7 +89,7 @@ optional_policy(`
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
init_dbus_chat_script(updfstab_t)
|
init_dbus_chat_script(updfstab_t)
|
||||||
|
|
||||||
dbus_system_bus_client_template(updfstab,updfstab_t)
|
dbus_system_bus_client_template(updfstab, updfstab_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(usbmodules,1.1.0)
|
policy_module(usbmodules, 1.1.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(usbmodules,1.1.0)
|
|||||||
|
|
||||||
type usbmodules_t;
|
type usbmodules_t;
|
||||||
type usbmodules_exec_t;
|
type usbmodules_exec_t;
|
||||||
init_system_domain(usbmodules_t,usbmodules_exec_t)
|
init_system_domain(usbmodules_t, usbmodules_exec_t)
|
||||||
role system_r types usbmodules_t;
|
role system_r types usbmodules_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -17,7 +17,7 @@ interface(`usermanage_domtrans_chfn',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,chfn_exec_t,chfn_t)
|
domtrans_pattern($1, chfn_exec_t, chfn_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -68,7 +68,7 @@ interface(`usermanage_domtrans_groupadd',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,groupadd_exec_t,groupadd_t)
|
domtrans_pattern($1, groupadd_exec_t, groupadd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -124,7 +124,7 @@ interface(`usermanage_domtrans_passwd',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,passwd_exec_t,passwd_t)
|
domtrans_pattern($1, passwd_exec_t, passwd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -176,7 +176,7 @@ interface(`usermanage_domtrans_admin_passwd',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,admin_passwd_exec_t,sysadm_passwd_t)
|
domtrans_pattern($1, admin_passwd_exec_t, sysadm_passwd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -251,7 +251,7 @@ interface(`usermanage_domtrans_useradd',`
|
|||||||
|
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,useradd_exec_t,useradd_t)
|
domtrans_pattern($1, useradd_exec_t, useradd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -305,5 +305,5 @@ interface(`usermanage_read_crack_db',`
|
|||||||
type crack_db_t;
|
type crack_db_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
read_files_pattern($1,crack_db_t,crack_db_t)
|
read_files_pattern($1, crack_db_t, crack_db_t)
|
||||||
')
|
')
|
||||||
|
@ -12,12 +12,12 @@ files_type(admin_passwd_exec_t)
|
|||||||
type chfn_t;
|
type chfn_t;
|
||||||
type chfn_exec_t;
|
type chfn_exec_t;
|
||||||
domain_obj_id_change_exemption(chfn_t)
|
domain_obj_id_change_exemption(chfn_t)
|
||||||
application_domain(chfn_t,chfn_exec_t)
|
application_domain(chfn_t, chfn_exec_t)
|
||||||
role system_r types chfn_t;
|
role system_r types chfn_t;
|
||||||
|
|
||||||
type crack_t;
|
type crack_t;
|
||||||
type crack_exec_t;
|
type crack_exec_t;
|
||||||
application_domain(crack_t,crack_exec_t)
|
application_domain(crack_t, crack_exec_t)
|
||||||
role system_r types crack_t;
|
role system_r types crack_t;
|
||||||
|
|
||||||
type crack_db_t;
|
type crack_db_t;
|
||||||
@ -29,18 +29,18 @@ files_tmp_file(crack_tmp_t)
|
|||||||
type groupadd_t;
|
type groupadd_t;
|
||||||
type groupadd_exec_t;
|
type groupadd_exec_t;
|
||||||
domain_obj_id_change_exemption(groupadd_t)
|
domain_obj_id_change_exemption(groupadd_t)
|
||||||
init_system_domain(groupadd_t,groupadd_exec_t)
|
init_system_domain(groupadd_t, groupadd_exec_t)
|
||||||
role system_r types groupadd_t;
|
role system_r types groupadd_t;
|
||||||
|
|
||||||
type passwd_t;
|
type passwd_t;
|
||||||
type passwd_exec_t;
|
type passwd_exec_t;
|
||||||
domain_obj_id_change_exemption(passwd_t)
|
domain_obj_id_change_exemption(passwd_t)
|
||||||
application_domain(passwd_t,passwd_exec_t)
|
application_domain(passwd_t, passwd_exec_t)
|
||||||
role system_r types passwd_t;
|
role system_r types passwd_t;
|
||||||
|
|
||||||
type sysadm_passwd_t;
|
type sysadm_passwd_t;
|
||||||
domain_obj_id_change_exemption(sysadm_passwd_t)
|
domain_obj_id_change_exemption(sysadm_passwd_t)
|
||||||
application_domain(sysadm_passwd_t,admin_passwd_exec_t)
|
application_domain(sysadm_passwd_t, admin_passwd_exec_t)
|
||||||
role system_r types sysadm_passwd_t;
|
role system_r types sysadm_passwd_t;
|
||||||
|
|
||||||
type sysadm_passwd_tmp_t;
|
type sysadm_passwd_tmp_t;
|
||||||
@ -132,12 +132,12 @@ userdom_dontaudit_search_all_users_home_content(chfn_t)
|
|||||||
allow crack_t self:process { sigkill sigstop signull signal };
|
allow crack_t self:process { sigkill sigstop signull signal };
|
||||||
allow crack_t self:fifo_file rw_fifo_file_perms;
|
allow crack_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
|
||||||
manage_files_pattern(crack_t,crack_db_t,crack_db_t)
|
manage_files_pattern(crack_t, crack_db_t, crack_db_t)
|
||||||
manage_lnk_files_pattern(crack_t,crack_db_t,crack_db_t)
|
manage_lnk_files_pattern(crack_t, crack_db_t, crack_db_t)
|
||||||
files_search_var(crack_t)
|
files_search_var(crack_t)
|
||||||
|
|
||||||
manage_dirs_pattern(crack_t,crack_tmp_t,crack_tmp_t)
|
manage_dirs_pattern(crack_t, crack_tmp_t, crack_tmp_t)
|
||||||
manage_files_pattern(crack_t,crack_tmp_t,crack_tmp_t)
|
manage_files_pattern(crack_t, crack_tmp_t, crack_tmp_t)
|
||||||
files_tmp_filetrans(crack_t, crack_tmp_t, { file dir })
|
files_tmp_filetrans(crack_t, crack_tmp_t, { file dir })
|
||||||
|
|
||||||
kernel_read_system_state(crack_t)
|
kernel_read_system_state(crack_t)
|
||||||
@ -169,7 +169,7 @@ ifdef(`distro_debian',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cron_system_entry(crack_t,crack_exec_t)
|
cron_system_entry(crack_t, crack_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -275,7 +275,7 @@ allow passwd_t self:msgq create_msgq_perms;
|
|||||||
allow passwd_t self:msg { send receive };
|
allow passwd_t self:msg { send receive };
|
||||||
|
|
||||||
allow passwd_t crack_db_t:dir list_dir_perms;
|
allow passwd_t crack_db_t:dir list_dir_perms;
|
||||||
read_files_pattern(passwd_t,crack_db_t,crack_db_t)
|
read_files_pattern(passwd_t, crack_db_t, crack_db_t)
|
||||||
|
|
||||||
kernel_read_kernel_sysctls(passwd_t)
|
kernel_read_kernel_sysctls(passwd_t)
|
||||||
|
|
||||||
@ -361,8 +361,8 @@ allow sysadm_passwd_t self:msgq create_msgq_perms;
|
|||||||
allow sysadm_passwd_t self:msg { send receive };
|
allow sysadm_passwd_t self:msg { send receive };
|
||||||
|
|
||||||
# allow vipw to create temporary files under /var/tmp/vi.recover
|
# allow vipw to create temporary files under /var/tmp/vi.recover
|
||||||
manage_dirs_pattern(sysadm_passwd_t,sysadm_passwd_tmp_t,sysadm_passwd_tmp_t)
|
manage_dirs_pattern(sysadm_passwd_t, sysadm_passwd_tmp_t, sysadm_passwd_tmp_t)
|
||||||
manage_files_pattern(sysadm_passwd_t,sysadm_passwd_tmp_t,sysadm_passwd_tmp_t)
|
manage_files_pattern(sysadm_passwd_t, sysadm_passwd_tmp_t, sysadm_passwd_tmp_t)
|
||||||
files_tmp_filetrans(sysadm_passwd_t, sysadm_passwd_tmp_t, { file dir })
|
files_tmp_filetrans(sysadm_passwd_t, sysadm_passwd_tmp_t, { file dir })
|
||||||
files_search_var(sysadm_passwd_t)
|
files_search_var(sysadm_passwd_t)
|
||||||
files_dontaudit_search_home(sysadm_passwd_t)
|
files_dontaudit_search_home(sysadm_passwd_t)
|
||||||
@ -506,7 +506,7 @@ userdom_use_unpriv_users_fds(useradd_t)
|
|||||||
userdom_manage_all_users_home_content_dirs(useradd_t)
|
userdom_manage_all_users_home_content_dirs(useradd_t)
|
||||||
userdom_manage_all_users_home_content_files(useradd_t)
|
userdom_manage_all_users_home_content_files(useradd_t)
|
||||||
unprivuser_home_filetrans_home_dir(useradd_t)
|
unprivuser_home_filetrans_home_dir(useradd_t)
|
||||||
unprivuser_home_dir_filetrans_home_content(useradd_t,notdevfile_class_set)
|
unprivuser_home_dir_filetrans_home_content(useradd_t, notdevfile_class_set)
|
||||||
|
|
||||||
mta_manage_spool(useradd_t)
|
mta_manage_spool(useradd_t)
|
||||||
|
|
||||||
|
@ -16,5 +16,5 @@ interface(`vbetool_domtrans',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,vbetool_exec_t,vbetool_t)
|
domtrans_pattern($1, vbetool_exec_t, vbetool_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(vbetool,1.3.0)
|
policy_module(vbetool, 1.3.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(vbetool,1.3.0)
|
|||||||
|
|
||||||
type vbetool_t;
|
type vbetool_t;
|
||||||
type vbetool_exec_t;
|
type vbetool_exec_t;
|
||||||
init_system_domain(vbetool_t,vbetool_exec_t)
|
init_system_domain(vbetool_t, vbetool_exec_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -15,7 +15,7 @@ interface(`vpn_domtrans',`
|
|||||||
type vpnc_t, vpnc_exec_t;
|
type vpnc_t, vpnc_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1, vpnc_exec_t,vpnc_t)
|
domtrans_pattern($1, vpnc_exec_t, vpnc_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(vpn,1.8.0)
|
policy_module(vpn, 1.8.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(ada,1.2.0)
|
policy_module(ada, 1.2.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(ada,1.2.0)
|
|||||||
|
|
||||||
type ada_t;
|
type ada_t;
|
||||||
type ada_exec_t;
|
type ada_exec_t;
|
||||||
application_domain(ada_t,ada_exec_t)
|
application_domain(ada_t, ada_exec_t)
|
||||||
role system_r types ada_t;
|
role system_r types ada_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -15,6 +15,6 @@ interface(`authbind_domtrans',`
|
|||||||
type authbind_t, authbind_exec_t;
|
type authbind_t, authbind_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,authbind_exec_t,authbind_t)
|
domtrans_pattern($1, authbind_exec_t, authbind_t)
|
||||||
allow authbind_t $1:{ tcp_socket udp_socket } rw_socket_perms;
|
allow authbind_t $1:{ tcp_socket udp_socket } rw_socket_perms;
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(authbind,1.1.0)
|
policy_module(authbind, 1.1.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -8,7 +8,7 @@ policy_module(authbind,1.1.0)
|
|||||||
|
|
||||||
type authbind_t;
|
type authbind_t;
|
||||||
type authbind_exec_t;
|
type authbind_exec_t;
|
||||||
application_domain(authbind_t,authbind_exec_t)
|
application_domain(authbind_t, authbind_exec_t)
|
||||||
role system_r types authbind_t;
|
role system_r types authbind_t;
|
||||||
|
|
||||||
type authbind_etc_t;
|
type authbind_etc_t;
|
||||||
@ -22,8 +22,8 @@ files_config_file(authbind_etc_t)
|
|||||||
allow authbind_t self:capability net_bind_service;
|
allow authbind_t self:capability net_bind_service;
|
||||||
|
|
||||||
allow authbind_t authbind_etc_t:dir list_dir_perms;
|
allow authbind_t authbind_etc_t:dir list_dir_perms;
|
||||||
exec_files_pattern(authbind_t,authbind_etc_t,authbind_etc_t)
|
exec_files_pattern(authbind_t, authbind_etc_t, authbind_etc_t)
|
||||||
read_lnk_files_pattern(authbind_t,authbind_etc_t,authbind_etc_t)
|
read_lnk_files_pattern(authbind_t, authbind_etc_t, authbind_etc_t)
|
||||||
|
|
||||||
files_list_etc(authbind_t)
|
files_list_etc(authbind_t)
|
||||||
|
|
||||||
|
@ -33,11 +33,10 @@ interface(`awstats_rw_pipes',`
|
|||||||
#
|
#
|
||||||
interface(`awstats_cgi_exec',`
|
interface(`awstats_cgi_exec',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type httpd_awstats_script_exec_t;
|
type httpd_awstats_script_exec_t, httpd_awstats_content_t;
|
||||||
type httpd_awstats_content_t;
|
|
||||||
')
|
')
|
||||||
|
|
||||||
allow $1 httpd_awstats_content_t:dir search_dir_perms;
|
allow $1 httpd_awstats_content_t:dir search_dir_perms;
|
||||||
allow $1 httpd_awstats_script_exec_t:dir search_dir_perms;
|
allow $1 httpd_awstats_script_exec_t:dir search_dir_perms;
|
||||||
can_exec($1,httpd_awstats_script_exec_t)
|
can_exec($1, httpd_awstats_script_exec_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(awstats,1.0.0)
|
policy_module(awstats, 1.0.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -16,6 +16,6 @@ interface(`calamaris_read_www_files',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
allow $1 calamaris_www_t:dir list_dir_perms;
|
allow $1 calamaris_www_t:dir list_dir_perms;
|
||||||
read_files_pattern($1,calamaris_www_t,calamaris_www_t)
|
read_files_pattern($1, calamaris_www_t, calamaris_www_t)
|
||||||
read_lnk_files_pattern($1,calamaris_www_t,calamaris_www_t)
|
read_lnk_files_pattern($1, calamaris_www_t, calamaris_www_t)
|
||||||
')
|
')
|
||||||
|
@ -8,7 +8,7 @@ policy_module(calamaris, 1.3.0)
|
|||||||
|
|
||||||
type calamaris_t;
|
type calamaris_t;
|
||||||
type calamaris_exec_t;
|
type calamaris_exec_t;
|
||||||
init_system_domain(calamaris_t,calamaris_exec_t)
|
init_system_domain(calamaris_t, calamaris_exec_t)
|
||||||
|
|
||||||
type calamaris_www_t;
|
type calamaris_www_t;
|
||||||
files_type(calamaris_www_t)
|
files_type(calamaris_www_t)
|
||||||
@ -29,11 +29,11 @@ allow calamaris_t self:unix_stream_socket create_stream_socket_perms;
|
|||||||
allow calamaris_t self:tcp_socket create_stream_socket_perms;
|
allow calamaris_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow calamaris_t self:udp_socket create_socket_perms;
|
allow calamaris_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
manage_files_pattern(calamaris_t,calamaris_www_t,calamaris_www_t)
|
manage_files_pattern(calamaris_t, calamaris_www_t, calamaris_www_t)
|
||||||
manage_lnk_files_pattern(calamaris_t,calamaris_www_t,calamaris_www_t)
|
manage_lnk_files_pattern(calamaris_t, calamaris_www_t, calamaris_www_t)
|
||||||
|
|
||||||
manage_files_pattern(calamaris_t,calamaris_log_t,calamaris_log_t)
|
manage_files_pattern(calamaris_t, calamaris_log_t, calamaris_log_t)
|
||||||
logging_log_filetrans(calamaris_t,calamaris_log_t,{ file dir })
|
logging_log_filetrans(calamaris_t, calamaris_log_t, { file dir })
|
||||||
|
|
||||||
kernel_read_all_sysctls(calamaris_t)
|
kernel_read_all_sysctls(calamaris_t)
|
||||||
kernel_read_system_state(calamaris_t)
|
kernel_read_system_state(calamaris_t)
|
||||||
@ -76,7 +76,7 @@ optional_policy(`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cron_system_entry(calamaris_t,calamaris_exec_t)
|
cron_system_entry(calamaris_t, calamaris_exec_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
|
@ -44,7 +44,7 @@ template(`cdrecord_per_role_template', `
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_cdrecord_t;
|
type $1_cdrecord_t;
|
||||||
application_domain($1_cdrecord_t,cdrecord_exec_t)
|
application_domain($1_cdrecord_t, cdrecord_exec_t)
|
||||||
role $3 types $1_cdrecord_t;
|
role $3 types $1_cdrecord_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -64,7 +64,7 @@ template(`cdrecord_per_role_template', `
|
|||||||
allow $2 $1_cdrecord_t:process signal;
|
allow $2 $1_cdrecord_t:process signal;
|
||||||
|
|
||||||
# Transition from the user domain to the derived domain.
|
# Transition from the user domain to the derived domain.
|
||||||
domtrans_pattern($2,cdrecord_exec_t,$1_cdrecord_t)
|
domtrans_pattern($2, cdrecord_exec_t, $1_cdrecord_t)
|
||||||
|
|
||||||
# allow searching for cdrom-drive
|
# allow searching for cdrom-drive
|
||||||
dev_list_all_dev_nodes($1_cdrecord_t)
|
dev_list_all_dev_nodes($1_cdrecord_t)
|
||||||
@ -89,10 +89,10 @@ template(`cdrecord_per_role_template', `
|
|||||||
miscfiles_read_localization($1_cdrecord_t)
|
miscfiles_read_localization($1_cdrecord_t)
|
||||||
|
|
||||||
# write to the user domain tty.
|
# write to the user domain tty.
|
||||||
userdom_use_user_terminals($1,$1_cdrecord_t)
|
userdom_use_user_terminals($1, $1_cdrecord_t)
|
||||||
userdom_use_user_terminals($1,$2)
|
userdom_use_user_terminals($1, $2)
|
||||||
|
|
||||||
userdom_read_user_home_content_files($1,$1_cdrecord_t)
|
userdom_read_user_home_content_files($1, $1_cdrecord_t)
|
||||||
|
|
||||||
# Handle nfs home dirs
|
# Handle nfs home dirs
|
||||||
tunable_policy(`cdrecord_read_content && use_nfs_home_dirs',`
|
tunable_policy(`cdrecord_read_content && use_nfs_home_dirs',`
|
||||||
@ -122,12 +122,12 @@ template(`cdrecord_per_role_template', `
|
|||||||
|
|
||||||
# Handle removable media, /tmp, and /home
|
# Handle removable media, /tmp, and /home
|
||||||
tunable_policy(`cdrecord_read_content',`
|
tunable_policy(`cdrecord_read_content',`
|
||||||
userdom_list_user_tmp($1,$1_cdrecord_t)
|
userdom_list_user_tmp($1, $1_cdrecord_t)
|
||||||
userdom_read_user_tmp_files($1,$1_cdrecord_t)
|
userdom_read_user_tmp_files($1, $1_cdrecord_t)
|
||||||
userdom_read_user_tmp_symlinks($1,$1_cdrecord_t)
|
userdom_read_user_tmp_symlinks($1, $1_cdrecord_t)
|
||||||
userdom_search_user_home_dirs($1,$1_cdrecord_t)
|
userdom_search_user_home_dirs($1, $1_cdrecord_t)
|
||||||
userdom_read_user_home_content_files($1,$1_cdrecord_t)
|
userdom_read_user_home_content_files($1, $1_cdrecord_t)
|
||||||
userdom_read_user_home_content_symlinks($1,$1_cdrecord_t)
|
userdom_read_user_home_content_symlinks($1, $1_cdrecord_t)
|
||||||
|
|
||||||
ifdef(`enable_mls',`
|
ifdef(`enable_mls',`
|
||||||
',`
|
',`
|
||||||
@ -140,10 +140,10 @@ template(`cdrecord_per_role_template', `
|
|||||||
files_dontaudit_list_home($1_cdrecord_t)
|
files_dontaudit_list_home($1_cdrecord_t)
|
||||||
fs_dontaudit_list_removable($1_cdrecord_t)
|
fs_dontaudit_list_removable($1_cdrecord_t)
|
||||||
fs_dontaudit_read_removable_files($1_cdrecord_t)
|
fs_dontaudit_read_removable_files($1_cdrecord_t)
|
||||||
userdom_dontaudit_list_user_tmp($1,$1_cdrecord_t)
|
userdom_dontaudit_list_user_tmp($1, $1_cdrecord_t)
|
||||||
userdom_dontaudit_read_user_tmp_files($1,$1_cdrecord_t)
|
userdom_dontaudit_read_user_tmp_files($1, $1_cdrecord_t)
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_cdrecord_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_cdrecord_t)
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_cdrecord_t)
|
userdom_dontaudit_read_user_home_content_files($1, $1_cdrecord_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
# Handle default_t content
|
# Handle default_t content
|
||||||
@ -160,22 +160,22 @@ template(`cdrecord_per_role_template', `
|
|||||||
tunable_policy(`cdrecord_read_content && read_untrusted_content',`
|
tunable_policy(`cdrecord_read_content && read_untrusted_content',`
|
||||||
files_list_tmp($1_cdrecord_t)
|
files_list_tmp($1_cdrecord_t)
|
||||||
files_list_home($1_cdrecord_t)
|
files_list_home($1_cdrecord_t)
|
||||||
userdom_search_user_home_dirs($1,$1_cdrecord_t)
|
userdom_search_user_home_dirs($1, $1_cdrecord_t)
|
||||||
|
|
||||||
userdom_list_user_untrusted_content($1,$1_cdrecord_t)
|
userdom_list_user_untrusted_content($1, $1_cdrecord_t)
|
||||||
userdom_read_user_untrusted_content_files($1,$1_cdrecord_t)
|
userdom_read_user_untrusted_content_files($1, $1_cdrecord_t)
|
||||||
userdom_read_user_untrusted_content_symlinks($1,$1_cdrecord_t)
|
userdom_read_user_untrusted_content_symlinks($1, $1_cdrecord_t)
|
||||||
userdom_list_user_tmp_untrusted_content($1,$1_cdrecord_t)
|
userdom_list_user_tmp_untrusted_content($1, $1_cdrecord_t)
|
||||||
userdom_read_user_tmp_untrusted_content_files($1,$1_cdrecord_t)
|
userdom_read_user_tmp_untrusted_content_files($1, $1_cdrecord_t)
|
||||||
userdom_read_user_tmp_untrusted_content_symlinks($1,$1_cdrecord_t)
|
userdom_read_user_tmp_untrusted_content_symlinks($1, $1_cdrecord_t)
|
||||||
',`
|
',`
|
||||||
files_dontaudit_list_tmp($1_cdrecord_t)
|
files_dontaudit_list_tmp($1_cdrecord_t)
|
||||||
files_dontaudit_list_home($1_cdrecord_t)
|
files_dontaudit_list_home($1_cdrecord_t)
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_cdrecord_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_cdrecord_t)
|
||||||
userdom_dontaudit_list_user_untrusted_content($1,$1_cdrecord_t)
|
userdom_dontaudit_list_user_untrusted_content($1, $1_cdrecord_t)
|
||||||
userdom_dontaudit_read_user_untrusted_content_files($1,$1_cdrecord_t)
|
userdom_dontaudit_read_user_untrusted_content_files($1, $1_cdrecord_t)
|
||||||
userdom_dontaudit_list_user_tmp_untrusted_content($1,$1_cdrecord_t)
|
userdom_dontaudit_list_user_tmp_untrusted_content($1, $1_cdrecord_t)
|
||||||
userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_cdrecord_t)
|
userdom_dontaudit_read_user_tmp_untrusted_content_files($1, $1_cdrecord_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(cdrecord,1.4.0)
|
policy_module(cdrecord, 1.4.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -13,7 +13,7 @@ policy_module(cdrecord,1.4.0)
|
|||||||
## and untrusted content files
|
## and untrusted content files
|
||||||
## </p>
|
## </p>
|
||||||
## </desc>
|
## </desc>
|
||||||
gen_tunable(cdrecord_read_content,false)
|
gen_tunable(cdrecord_read_content, false)
|
||||||
|
|
||||||
type cdrecord_exec_t;
|
type cdrecord_exec_t;
|
||||||
application_executable_file(cdrecord_exec_t)
|
application_executable_file(cdrecord_exec_t)
|
||||||
|
@ -45,12 +45,12 @@ template(`ethereal_per_role_template',`
|
|||||||
|
|
||||||
# Type for program
|
# Type for program
|
||||||
type $1_ethereal_t;
|
type $1_ethereal_t;
|
||||||
application_domain($1_ethereal_t,ethereal_exec_t)
|
application_domain($1_ethereal_t, ethereal_exec_t)
|
||||||
role $3 types $1_ethereal_t;
|
role $3 types $1_ethereal_t;
|
||||||
|
|
||||||
type $1_ethereal_home_t alias $1_ethereal_rw_t;
|
type $1_ethereal_home_t alias $1_ethereal_rw_t;
|
||||||
files_poly_member($1_ethereal_home_t)
|
files_poly_member($1_ethereal_home_t)
|
||||||
userdom_user_home_content($1,$1_ethereal_home_t)
|
userdom_user_home_content($1, $1_ethereal_home_t)
|
||||||
|
|
||||||
type $1_ethereal_tmp_t;
|
type $1_ethereal_tmp_t;
|
||||||
files_tmp_file($1_ethereal_tmp_t)
|
files_tmp_file($1_ethereal_tmp_t)
|
||||||
@ -78,33 +78,33 @@ template(`ethereal_per_role_template',`
|
|||||||
corecmd_search_bin($1_ethereal_t)
|
corecmd_search_bin($1_ethereal_t)
|
||||||
|
|
||||||
# /home/.ethereal
|
# /home/.ethereal
|
||||||
manage_dirs_pattern($1_ethereal_t,$1_ethereal_home_t,$1_ethereal_home_t)
|
manage_dirs_pattern($1_ethereal_t, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
manage_files_pattern($1_ethereal_t,$1_ethereal_home_t,$1_ethereal_home_t)
|
manage_files_pattern($1_ethereal_t, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
manage_lnk_files_pattern($1_ethereal_t,$1_ethereal_home_t,$1_ethereal_home_t)
|
manage_lnk_files_pattern($1_ethereal_t, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
userdom_user_home_dir_filetrans($1,$1_ethereal_t,$1_ethereal_home_t,dir)
|
userdom_user_home_dir_filetrans($1, $1_ethereal_t, $1_ethereal_home_t, dir)
|
||||||
|
|
||||||
# Store temporary files
|
# Store temporary files
|
||||||
manage_dirs_pattern($1_ethereal_t,$1_ethereal_tmp_t,$1_ethereal_tmp_t)
|
manage_dirs_pattern($1_ethereal_t, $1_ethereal_tmp_t, $1_ethereal_tmp_t)
|
||||||
manage_files_pattern($1_ethereal_t,$1_ethereal_tmp_t,$1_ethereal_tmp_t)
|
manage_files_pattern($1_ethereal_t, $1_ethereal_tmp_t, $1_ethereal_tmp_t)
|
||||||
files_tmp_filetrans($1_ethereal_t, $1_ethereal_tmp_t, { dir file })
|
files_tmp_filetrans($1_ethereal_t, $1_ethereal_tmp_t, { dir file })
|
||||||
|
|
||||||
manage_dirs_pattern($1_ethereal_t,$1_ethereal_tmpfs_t,$1_ethereal_tmpfs_t)
|
manage_dirs_pattern($1_ethereal_t, $1_ethereal_tmpfs_t, $1_ethereal_tmpfs_t)
|
||||||
manage_files_pattern($1_ethereal_t,$1_ethereal_tmpfs_t,$1_ethereal_tmpfs_t)
|
manage_files_pattern($1_ethereal_t, $1_ethereal_tmpfs_t, $1_ethereal_tmpfs_t)
|
||||||
manage_lnk_files_pattern($1_ethereal_t,$1_ethereal_tmpfs_t,$1_ethereal_tmpfs_t)
|
manage_lnk_files_pattern($1_ethereal_t, $1_ethereal_tmpfs_t, $1_ethereal_tmpfs_t)
|
||||||
manage_sock_files_pattern($1_ethereal_t,$1_ethereal_tmpfs_t,$1_ethereal_tmpfs_t)
|
manage_sock_files_pattern($1_ethereal_t, $1_ethereal_tmpfs_t, $1_ethereal_tmpfs_t)
|
||||||
manage_fifo_files_pattern($1_ethereal_t,$1_ethereal_tmpfs_t,$1_ethereal_tmpfs_t)
|
manage_fifo_files_pattern($1_ethereal_t, $1_ethereal_tmpfs_t, $1_ethereal_tmpfs_t)
|
||||||
fs_tmpfs_filetrans($1_ethereal_t,$1_ethereal_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_ethereal_t, $1_ethereal_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
domain_auto_trans($2, ethereal_exec_t, $1_ethereal_t)
|
domain_auto_trans($2, ethereal_exec_t, $1_ethereal_t)
|
||||||
allow $1_ethereal_t $2:fd use;
|
allow $1_ethereal_t $2:fd use;
|
||||||
allow $1_ethereal_t $2:process sigchld;
|
allow $1_ethereal_t $2:process sigchld;
|
||||||
|
|
||||||
manage_dirs_pattern($2,$1_ethereal_home_t,$1_ethereal_home_t)
|
manage_dirs_pattern($2, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
manage_files_pattern($2,$1_ethereal_home_t,$1_ethereal_home_t)
|
manage_files_pattern($2, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
manage_lnk_files_pattern($2,$1_ethereal_home_t,$1_ethereal_home_t)
|
manage_lnk_files_pattern($2, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
relabel_dirs_pattern($2,$1_ethereal_home_t,$1_ethereal_home_t)
|
relabel_dirs_pattern($2, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
relabel_files_pattern($2,$1_ethereal_home_t,$1_ethereal_home_t)
|
relabel_files_pattern($2, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
relabel_lnk_files_pattern($2,$1_ethereal_home_t,$1_ethereal_home_t)
|
relabel_lnk_files_pattern($2, $1_ethereal_home_t, $1_ethereal_home_t)
|
||||||
|
|
||||||
kernel_read_kernel_sysctls($1_ethereal_t)
|
kernel_read_kernel_sysctls($1_ethereal_t)
|
||||||
kernel_read_system_state($1_ethereal_t)
|
kernel_read_system_state($1_ethereal_t)
|
||||||
@ -134,7 +134,7 @@ template(`ethereal_per_role_template',`
|
|||||||
|
|
||||||
sysnet_read_config($1_ethereal_t)
|
sysnet_read_config($1_ethereal_t)
|
||||||
|
|
||||||
userdom_manage_user_home_content_files($1,$1_ethereal_t)
|
userdom_manage_user_home_content_files($1, $1_ethereal_t)
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
fs_manage_nfs_dirs($1_ethereal_t)
|
fs_manage_nfs_dirs($1_ethereal_t)
|
||||||
@ -154,12 +154,12 @@ template(`ethereal_per_role_template',`
|
|||||||
|
|
||||||
# Manual transition from userhelper
|
# Manual transition from userhelper
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
userhelper_use_user_fd($1,$1_ethereal_t)
|
userhelper_use_user_fd($1, $1_ethereal_t)
|
||||||
userhelper_sigchld_user($1,$1_ethereal_t)
|
userhelper_sigchld_user($1, $1_ethereal_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_x_domain_template($1,$1_ethereal,$1_ethereal_t,$1_ethereal_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_ethereal, $1_ethereal_t, $1_ethereal_tmpfs_t)
|
||||||
xserver_create_xdm_tmp_sockets($1_ethereal_t)
|
xserver_create_xdm_tmp_sockets($1_ethereal_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -205,9 +205,9 @@ template(`ethereal_admin_template',`
|
|||||||
allow $1_ethereal_t self:unix_stream_socket create_stream_socket_perms;
|
allow $1_ethereal_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
allow $1_ethereal_t self:tcp_socket create_socket_perms;
|
allow $1_ethereal_t self:tcp_socket create_socket_perms;
|
||||||
|
|
||||||
userdom_use_user_terminals($1,$1_ethereal_t)
|
userdom_use_user_terminals($1, $1_ethereal_t)
|
||||||
# Ethereal tries to write to user terminal
|
# Ethereal tries to write to user terminal
|
||||||
userdom_dontaudit_use_user_terminals($1,$1_ethereal_t)
|
userdom_dontaudit_use_user_terminals($1, $1_ethereal_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -240,7 +240,7 @@ template(`ethereal_domtrans_user_ethereal',`
|
|||||||
type $1_ethereal_t, ethereal_exec_t;
|
type $1_ethereal_t, ethereal_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($2,ethereal_exec_t,$1_ethereal_t)
|
domtrans_pattern($2, ethereal_exec_t, $1_ethereal_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -258,7 +258,7 @@ template(`ethereal_domtrans_tethereal',`
|
|||||||
type tethereal_t, tethereal_exec_t;
|
type tethereal_t, tethereal_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($1,tethereal_exec_t,tethereal_t)
|
domtrans_pattern($1, tethereal_exec_t, tethereal_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(ethereal,1.5.0)
|
policy_module(ethereal, 1.5.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -11,7 +11,7 @@ application_executable_file(ethereal_exec_t)
|
|||||||
|
|
||||||
type tethereal_t;
|
type tethereal_t;
|
||||||
type tethereal_exec_t;
|
type tethereal_exec_t;
|
||||||
application_domain(tethereal_t,tethereal_exec_t)
|
application_domain(tethereal_t, tethereal_exec_t)
|
||||||
|
|
||||||
type tethereal_tmp_t;
|
type tethereal_tmp_t;
|
||||||
files_tmp_file(tethereal_tmp_t)
|
files_tmp_file(tethereal_tmp_t)
|
||||||
@ -29,8 +29,8 @@ allow tethereal_t self:tcp_socket create_socket_perms;
|
|||||||
allow tethereal_t self:udp_socket create_socket_perms;
|
allow tethereal_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
# Store temporary files
|
# Store temporary files
|
||||||
manage_dirs_pattern(tethereal_t,tethereal_tmp_t,tethereal_tmp_t)
|
manage_dirs_pattern(tethereal_t, tethereal_tmp_t, tethereal_tmp_t)
|
||||||
manage_files_pattern(tethereal_t,tethereal_tmp_t,tethereal_tmp_t)
|
manage_files_pattern(tethereal_t, tethereal_tmp_t, tethereal_tmp_t)
|
||||||
files_tmp_filetrans(tethereal_t, tethereal_tmp_t, { dir file })
|
files_tmp_filetrans(tethereal_t, tethereal_tmp_t, { dir file })
|
||||||
|
|
||||||
# /proc
|
# /proc
|
||||||
|
@ -41,7 +41,7 @@ template(`evolution_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_evolution_t;
|
type $1_evolution_t;
|
||||||
application_domain($1_evolution_t,evolution_exec_t)
|
application_domain($1_evolution_t, evolution_exec_t)
|
||||||
role $3 types $1_evolution_t;
|
role $3 types $1_evolution_t;
|
||||||
|
|
||||||
type $1_evolution_tmpfs_t;
|
type $1_evolution_tmpfs_t;
|
||||||
@ -49,13 +49,13 @@ template(`evolution_per_role_template',`
|
|||||||
|
|
||||||
type $1_evolution_home_t alias $1_evolution_rw_t;
|
type $1_evolution_home_t alias $1_evolution_rw_t;
|
||||||
files_poly_member($1_evolution_home_t)
|
files_poly_member($1_evolution_home_t)
|
||||||
userdom_user_home_content($1,$1_evolution_home_t)
|
userdom_user_home_content($1, $1_evolution_home_t)
|
||||||
|
|
||||||
type $1_evolution_orbit_tmp_t;
|
type $1_evolution_orbit_tmp_t;
|
||||||
files_tmp_file($1_evolution_orbit_tmp_t)
|
files_tmp_file($1_evolution_orbit_tmp_t)
|
||||||
|
|
||||||
type $1_evolution_alarm_t;
|
type $1_evolution_alarm_t;
|
||||||
application_domain($1_evolution_alarm_t,evolution_alarm_exec_t)
|
application_domain($1_evolution_alarm_t, evolution_alarm_exec_t)
|
||||||
role $3 types $1_evolution_alarm_t;
|
role $3 types $1_evolution_alarm_t;
|
||||||
|
|
||||||
type $1_evolution_alarm_tmpfs_t;
|
type $1_evolution_alarm_tmpfs_t;
|
||||||
@ -65,7 +65,7 @@ template(`evolution_per_role_template',`
|
|||||||
files_tmp_file($1_evolution_alarm_orbit_tmp_t)
|
files_tmp_file($1_evolution_alarm_orbit_tmp_t)
|
||||||
|
|
||||||
type $1_evolution_exchange_t;
|
type $1_evolution_exchange_t;
|
||||||
application_domain($1_evolution_exchange_t,evolution_exchange_exec_t)
|
application_domain($1_evolution_exchange_t, evolution_exchange_exec_t)
|
||||||
role $3 types $1_evolution_exchange_t;
|
role $3 types $1_evolution_exchange_t;
|
||||||
|
|
||||||
type $1_evolution_exchange_tmpfs_t;
|
type $1_evolution_exchange_tmpfs_t;
|
||||||
@ -78,14 +78,14 @@ template(`evolution_per_role_template',`
|
|||||||
files_tmp_file($1_evolution_exchange_orbit_tmp_t)
|
files_tmp_file($1_evolution_exchange_orbit_tmp_t)
|
||||||
|
|
||||||
type $1_evolution_server_t;
|
type $1_evolution_server_t;
|
||||||
application_domain($1_evolution_server_t,evolution_server_exec_t)
|
application_domain($1_evolution_server_t, evolution_server_exec_t)
|
||||||
role $3 types $1_evolution_server_t;
|
role $3 types $1_evolution_server_t;
|
||||||
|
|
||||||
type $1_evolution_server_orbit_tmp_t;
|
type $1_evolution_server_orbit_tmp_t;
|
||||||
files_tmp_file($1_evolution_server_orbit_tmp_t)
|
files_tmp_file($1_evolution_server_orbit_tmp_t)
|
||||||
|
|
||||||
type $1_evolution_webcal_t;
|
type $1_evolution_webcal_t;
|
||||||
application_domain($1_evolution_webcal_t,evolution_webcal_exec_t)
|
application_domain($1_evolution_webcal_t, evolution_webcal_exec_t)
|
||||||
role $3 types $1_evolution_webcal_t;
|
role $3 types $1_evolution_webcal_t;
|
||||||
|
|
||||||
type $1_evolution_webcal_tmpfs_t;
|
type $1_evolution_webcal_tmpfs_t;
|
||||||
@ -111,7 +111,7 @@ template(`evolution_per_role_template',`
|
|||||||
allow $1_evolution_t $1_evolution_alarm_t:unix_stream_socket connectto;
|
allow $1_evolution_t $1_evolution_alarm_t:unix_stream_socket connectto;
|
||||||
allow $1_evolution_t $1_evolution_alarm_orbit_tmp_t:sock_file write;
|
allow $1_evolution_t $1_evolution_alarm_orbit_tmp_t:sock_file write;
|
||||||
|
|
||||||
can_exec($1_evolution_t,evolution_alarm_exec_t)
|
can_exec($1_evolution_t, evolution_alarm_exec_t)
|
||||||
|
|
||||||
allow $1_evolution_t $1_evolution_exchange_t:unix_stream_socket connectto;
|
allow $1_evolution_t $1_evolution_exchange_t:unix_stream_socket connectto;
|
||||||
allow $1_evolution_t $1_evolution_exchange_orbit_tmp_t:sock_file write;
|
allow $1_evolution_t $1_evolution_exchange_orbit_tmp_t:sock_file write;
|
||||||
@ -122,11 +122,11 @@ template(`evolution_per_role_template',`
|
|||||||
|
|
||||||
allow $1_evolution_t $1_evolution_orbit_tmp_t:dir manage_dir_perms;
|
allow $1_evolution_t $1_evolution_orbit_tmp_t:dir manage_dir_perms;
|
||||||
allow $1_evolution_t $1_evolution_orbit_tmp_t:file manage_file_perms;
|
allow $1_evolution_t $1_evolution_orbit_tmp_t:file manage_file_perms;
|
||||||
files_tmp_filetrans($1_evolution_t,$1_evolution_orbit_tmp_t,{ dir file })
|
files_tmp_filetrans($1_evolution_t, $1_evolution_orbit_tmp_t, { dir file })
|
||||||
|
|
||||||
allow $1_evolution_server_t $1_evolution_orbit_tmp_t:dir manage_dir_perms;
|
allow $1_evolution_server_t $1_evolution_orbit_tmp_t:dir manage_dir_perms;
|
||||||
allow $1_evolution_server_t $1_evolution_orbit_tmp_t:file manage_file_perms;
|
allow $1_evolution_server_t $1_evolution_orbit_tmp_t:file manage_file_perms;
|
||||||
files_tmp_filetrans($1_evolution_server_t,$1_evolution_orbit_tmp_t,{ dir file })
|
files_tmp_filetrans($1_evolution_server_t, $1_evolution_orbit_tmp_t, { dir file })
|
||||||
|
|
||||||
allow $1_evolution_t $1_evolution_server_t:dir search_dir_perms;
|
allow $1_evolution_t $1_evolution_server_t:dir search_dir_perms;
|
||||||
allow $1_evolution_t $1_evolution_server_t:file read;
|
allow $1_evolution_t $1_evolution_server_t:file read;
|
||||||
@ -134,14 +134,14 @@ template(`evolution_per_role_template',`
|
|||||||
allow $1_evolution_t $1_evolution_server_t:unix_stream_socket connectto;
|
allow $1_evolution_t $1_evolution_server_t:unix_stream_socket connectto;
|
||||||
allow $1_evolution_t $1_evolution_server_orbit_tmp_t:sock_file write;
|
allow $1_evolution_t $1_evolution_server_orbit_tmp_t:sock_file write;
|
||||||
|
|
||||||
can_exec($1_evolution_t,evolution_server_exec_t)
|
can_exec($1_evolution_t, evolution_server_exec_t)
|
||||||
|
|
||||||
allow $1_evolution_t $1_evolution_tmpfs_t:dir rw_dir_perms;
|
allow $1_evolution_t $1_evolution_tmpfs_t:dir rw_dir_perms;
|
||||||
allow $1_evolution_t $1_evolution_tmpfs_t:file manage_file_perms;
|
allow $1_evolution_t $1_evolution_tmpfs_t:file manage_file_perms;
|
||||||
allow $1_evolution_t $1_evolution_tmpfs_t:lnk_file manage_lnk_file_perms;
|
allow $1_evolution_t $1_evolution_tmpfs_t:lnk_file manage_lnk_file_perms;
|
||||||
allow $1_evolution_t $1_evolution_tmpfs_t:sock_file manage_sock_file_perms;
|
allow $1_evolution_t $1_evolution_tmpfs_t:sock_file manage_sock_file_perms;
|
||||||
allow $1_evolution_t $1_evolution_tmpfs_t:fifo_file manage_fifo_file_perms;
|
allow $1_evolution_t $1_evolution_tmpfs_t:fifo_file manage_fifo_file_perms;
|
||||||
fs_tmpfs_filetrans($1_evolution_t,$1_evolution_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_evolution_t, $1_evolution_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
allow $1_evolution_t $2:dir search;
|
allow $1_evolution_t $2:dir search;
|
||||||
allow $1_evolution_t $2:fd use;
|
allow $1_evolution_t $2:fd use;
|
||||||
@ -163,7 +163,7 @@ template(`evolution_per_role_template',`
|
|||||||
allow $2 $1_evolution_home_t:file manage_file_perms;
|
allow $2 $1_evolution_home_t:file manage_file_perms;
|
||||||
allow $2 $1_evolution_home_t:lnk_file manage_lnk_file_perms;
|
allow $2 $1_evolution_home_t:lnk_file manage_lnk_file_perms;
|
||||||
allow $2 $1_evolution_home_t:{ dir file lnk_file } { relabelfrom relabelto };
|
allow $2 $1_evolution_home_t:{ dir file lnk_file } { relabelfrom relabelto };
|
||||||
userdom_search_user_home_dirs($1,$1_evolution_t)
|
userdom_search_user_home_dirs($1, $1_evolution_t)
|
||||||
|
|
||||||
# Allow the user domain to signal/ps.
|
# Allow the user domain to signal/ps.
|
||||||
allow $2 $1_evolution_t:dir { search getattr read };
|
allow $2 $1_evolution_t:dir { search getattr read };
|
||||||
@ -235,19 +235,19 @@ template(`evolution_per_role_template',`
|
|||||||
|
|
||||||
udev_read_state($1_evolution_t)
|
udev_read_state($1_evolution_t)
|
||||||
|
|
||||||
userdom_rw_user_tmp_files($1,$1_evolution_t)
|
userdom_rw_user_tmp_files($1, $1_evolution_t)
|
||||||
userdom_manage_user_tmp_dirs($1,$1_evolution_t)
|
userdom_manage_user_tmp_dirs($1, $1_evolution_t)
|
||||||
userdom_manage_user_tmp_sockets($1,$1_evolution_t)
|
userdom_manage_user_tmp_sockets($1, $1_evolution_t)
|
||||||
userdom_manage_user_tmp_files($1,$1_evolution_t)
|
userdom_manage_user_tmp_files($1, $1_evolution_t)
|
||||||
userdom_use_user_terminals($1, $1_evolution_t)
|
userdom_use_user_terminals($1, $1_evolution_t)
|
||||||
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
||||||
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
||||||
# until properly implemented
|
# until properly implemented
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_t)
|
userdom_dontaudit_read_user_home_content_files($1, $1_evolution_t)
|
||||||
|
|
||||||
mta_read_config($1_evolution_t)
|
mta_read_config($1_evolution_t)
|
||||||
|
|
||||||
xserver_user_x_domain_template($1,$1_evolution,$1_evolution_t,$1_evolution_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_evolution, $1_evolution_t, $1_evolution_tmpfs_t)
|
||||||
xserver_read_xdm_tmp_files($1_evolution_t)
|
xserver_read_xdm_tmp_files($1_evolution_t)
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -288,12 +288,12 @@ template(`evolution_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`mail_read_content',`
|
tunable_policy(`mail_read_content',`
|
||||||
userdom_list_user_tmp($1,$1_evolution_t)
|
userdom_list_user_tmp($1, $1_evolution_t)
|
||||||
userdom_read_user_tmp_files($1,$1_evolution_t)
|
userdom_read_user_tmp_files($1, $1_evolution_t)
|
||||||
userdom_read_user_tmp_symlinks($1,$1_evolution_t)
|
userdom_read_user_tmp_symlinks($1, $1_evolution_t)
|
||||||
userdom_search_user_home_dirs($1,$1_evolution_t)
|
userdom_search_user_home_dirs($1, $1_evolution_t)
|
||||||
userdom_read_user_home_content_files($1,$1_evolution_t)
|
userdom_read_user_home_content_files($1, $1_evolution_t)
|
||||||
userdom_read_user_home_content_symlinks($1,$1_evolution_t)
|
userdom_read_user_home_content_symlinks($1, $1_evolution_t)
|
||||||
|
|
||||||
ifndef(`enable_mls',`
|
ifndef(`enable_mls',`
|
||||||
fs_search_removable($1_evolution_t)
|
fs_search_removable($1_evolution_t)
|
||||||
@ -325,20 +325,20 @@ template(`evolution_per_role_template',`
|
|||||||
files_list_home($1_evolution_t)
|
files_list_home($1_evolution_t)
|
||||||
userdom_search_user_home_dirs($1,$1_evolution_t)
|
userdom_search_user_home_dirs($1,$1_evolution_t)
|
||||||
|
|
||||||
userdom_list_user_untrusted_content($1,$1_evolution_t)
|
userdom_list_user_untrusted_content($1, $1_evolution_t)
|
||||||
userdom_read_user_untrusted_content_files($1,$1_evolution_t)
|
userdom_read_user_untrusted_content_files($1, $1_evolution_t)
|
||||||
userdom_read_user_untrusted_content_symlinks($1,$1_evolution_t)
|
userdom_read_user_untrusted_content_symlinks($1, $1_evolution_t)
|
||||||
userdom_list_user_tmp_untrusted_content($1,$1_evolution_t)
|
userdom_list_user_tmp_untrusted_content($1, $1_evolution_t)
|
||||||
userdom_read_user_tmp_untrusted_content_files($1,$1_evolution_t)
|
userdom_read_user_tmp_untrusted_content_files($1, $1_evolution_t)
|
||||||
userdom_read_user_tmp_untrusted_content_symlinks($1,$1_evolution_t)
|
userdom_read_user_tmp_untrusted_content_symlinks($1, $1_evolution_t)
|
||||||
',`
|
',`
|
||||||
files_dontaudit_list_tmp($1_evolution_t)
|
files_dontaudit_list_tmp($1_evolution_t)
|
||||||
files_dontaudit_list_home($1_evolution_t)
|
files_dontaudit_list_home($1_evolution_t)
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_evolution_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_evolution_t)
|
||||||
userdom_dontaudit_list_user_untrusted_content($1,$1_evolution_t)
|
userdom_dontaudit_list_user_untrusted_content($1, $1_evolution_t)
|
||||||
userdom_dontaudit_read_user_untrusted_content_files($1,$1_evolution_t)
|
userdom_dontaudit_read_user_untrusted_content_files($1, $1_evolution_t)
|
||||||
userdom_dontaudit_list_user_tmp_untrusted_content($1,$1_evolution_t)
|
userdom_dontaudit_list_user_tmp_untrusted_content($1, $1_evolution_t)
|
||||||
userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_evolution_t)
|
userdom_dontaudit_read_user_tmp_untrusted_content_files($1, $1_evolution_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`write_untrusted_content && use_nfs_home_dirs',`
|
tunable_policy(`write_untrusted_content && use_nfs_home_dirs',`
|
||||||
@ -370,15 +370,15 @@ template(`evolution_per_role_template',`
|
|||||||
tunable_policy(`write_untrusted_content',`
|
tunable_policy(`write_untrusted_content',`
|
||||||
files_search_home($1_evolution_t)
|
files_search_home($1_evolution_t)
|
||||||
|
|
||||||
userdom_manage_user_untrusted_content_files($1,$1_evolution_t)
|
userdom_manage_user_untrusted_content_files($1, $1_evolution_t)
|
||||||
userdom_user_home_dir_filetrans($1,$1_evolution_t,$1_untrusted_content_tmp_t, { file dir })
|
userdom_user_home_dir_filetrans($1, $1_evolution_t, $1_untrusted_content_tmp_t, { file dir })
|
||||||
userdom_user_home_content_filetrans($1,$1_evolution_t,$1_untrusted_content_tmp_t, { file dir })
|
userdom_user_home_content_filetrans($1, $1_evolution_t, $1_untrusted_content_tmp_t, { file dir })
|
||||||
|
|
||||||
',`
|
',`
|
||||||
files_dontaudit_list_home($1_evolution_t)
|
files_dontaudit_list_home($1_evolution_t)
|
||||||
files_dontaudit_list_tmp($1_evolution_t)
|
files_dontaudit_list_tmp($1_evolution_t)
|
||||||
|
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_evolution_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_evolution_t)
|
||||||
#userdom_dontaudit_manage_user_tmp($1,$1_evolution_t)
|
#userdom_dontaudit_manage_user_tmp($1,$1_evolution_t)
|
||||||
#userdom_dontaudit_manage_user_tmp_files($1,$1_evolution_t)
|
#userdom_dontaudit_manage_user_tmp_files($1,$1_evolution_t)
|
||||||
#userdom_dontaudit_manage_user_home_subdirs($1,$1_evolution_t)
|
#userdom_dontaudit_manage_user_home_subdirs($1,$1_evolution_t)
|
||||||
@ -394,8 +394,8 @@ template(`evolution_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
dbus_system_bus_client_template($1_evolution,$1_evolution_t)
|
dbus_system_bus_client_template($1_evolution, $1_evolution_t)
|
||||||
dbus_user_bus_client_template($1,$1_evolution,$1_evolution_t)
|
dbus_user_bus_client_template($1, $1_evolution, $1_evolution_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -404,12 +404,12 @@ template(`evolution_per_role_template',`
|
|||||||
|
|
||||||
# Encrypt mail
|
# Encrypt mail
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
gpg_domtrans_user_gpg($1,$1_evolution_t)
|
gpg_domtrans_user_gpg($1, $1_evolution_t)
|
||||||
gpg_signal_user_gpg($1,$1_evolution_t)
|
gpg_signal_user_gpg($1, $1_evolution_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
lpd_domtrans_user_lpr($1,$1_evolution_t)
|
lpd_domtrans_user_lpr($1, $1_evolution_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -429,8 +429,8 @@ template(`evolution_per_role_template',`
|
|||||||
### Junk mail filtering (start spamd)
|
### Junk mail filtering (start spamd)
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
spamassassin_exec_spamd($1_evolution_t)
|
spamassassin_exec_spamd($1_evolution_t)
|
||||||
spamassassin_domtrans_user_client($1,$1_evolution_t)
|
spamassassin_domtrans_user_client($1, $1_evolution_t)
|
||||||
spamassassin_domtrans_user_local_client($1,$1_evolution_t)
|
spamassassin_domtrans_user_local_client($1, $1_evolution_t)
|
||||||
# Allow evolution to signal the daemon
|
# Allow evolution to signal the daemon
|
||||||
# FIXME: Now evolution can read spamd temp files
|
# FIXME: Now evolution can read spamd temp files
|
||||||
spamassassin_read_spamd_tmp_files($1_evolution_t)
|
spamassassin_read_spamd_tmp_files($1_evolution_t)
|
||||||
@ -511,9 +511,9 @@ template(`evolution_per_role_template',`
|
|||||||
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
||||||
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
||||||
# until properly implemented
|
# until properly implemented
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_alarm_t)
|
userdom_dontaudit_read_user_home_content_files($1, $1_evolution_alarm_t)
|
||||||
|
|
||||||
xserver_user_x_domain_template($1,$1_evolution_alarm,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_evolution_alarm, $1_evolution_alarm_t, $1_evolution_alarm_tmpfs_t)
|
||||||
|
|
||||||
# Access evolution home
|
# Access evolution home
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -525,7 +525,7 @@ template(`evolution_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
dbus_user_bus_client_template($1,$1_evolution_alarm,$1_evolution_alarm_t)
|
dbus_user_bus_client_template($1, $1_evolution_alarm, $1_evolution_alarm_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -576,7 +576,7 @@ template(`evolution_per_role_template',`
|
|||||||
allow $1_evolution_exchange_t $1_evolution_exchange_tmpfs_t:lnk_file manage_lnk_file_perms;
|
allow $1_evolution_exchange_t $1_evolution_exchange_tmpfs_t:lnk_file manage_lnk_file_perms;
|
||||||
allow $1_evolution_exchange_t $1_evolution_exchange_tmpfs_t:sock_file manage_sock_file_perms;
|
allow $1_evolution_exchange_t $1_evolution_exchange_tmpfs_t:sock_file manage_sock_file_perms;
|
||||||
allow $1_evolution_exchange_t $1_evolution_exchange_tmpfs_t:fifo_file manage_fifo_file_perms;
|
allow $1_evolution_exchange_t $1_evolution_exchange_tmpfs_t:fifo_file manage_fifo_file_perms;
|
||||||
fs_tmpfs_filetrans($1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_evolution_exchange_t, $1_evolution_exchange_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
allow $1_evolution_exchange_t $2:unix_stream_socket connectto;
|
allow $1_evolution_exchange_t $2:unix_stream_socket connectto;
|
||||||
#FIXME, who should own this. I dont think this module should
|
#FIXME, who should own this. I dont think this module should
|
||||||
@ -609,13 +609,13 @@ template(`evolution_per_role_template',`
|
|||||||
miscfiles_read_localization($1_evolution_exchange_t)
|
miscfiles_read_localization($1_evolution_exchange_t)
|
||||||
|
|
||||||
# Access evolution home
|
# Access evolution home
|
||||||
userdom_search_user_home_dirs($1,$1_evolution_exchange_t)
|
userdom_search_user_home_dirs($1, $1_evolution_exchange_t)
|
||||||
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
||||||
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
||||||
# until properly implemented
|
# until properly implemented
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_exchange_t)
|
userdom_dontaudit_read_user_home_content_files($1, $1_evolution_exchange_t)
|
||||||
|
|
||||||
xserver_user_x_domain_template($1,$1_evolution_exchange,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_evolution_exchange, $1_evolution_exchange_t, $1_evolution_exchange_tmpfs_t)
|
||||||
|
|
||||||
# Access evolution home
|
# Access evolution home
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -706,11 +706,11 @@ template(`evolution_per_role_template',`
|
|||||||
sysnet_use_ldap($1_evolution_server_t)
|
sysnet_use_ldap($1_evolution_server_t)
|
||||||
|
|
||||||
# Access evolution home
|
# Access evolution home
|
||||||
userdom_search_user_home_dirs($1,$1_evolution_server_t)
|
userdom_search_user_home_dirs($1, $1_evolution_server_t)
|
||||||
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
||||||
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
||||||
# until properly implemented
|
# until properly implemented
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_server_t)
|
userdom_dontaudit_read_user_home_content_files($1, $1_evolution_server_t)
|
||||||
|
|
||||||
# Access evolution home
|
# Access evolution home
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -747,7 +747,7 @@ template(`evolution_per_role_template',`
|
|||||||
allow $1_evolution_webcal_t $1_evolution_webcal_tmpfs_t:lnk_file manage_lnk_file_perms;
|
allow $1_evolution_webcal_t $1_evolution_webcal_tmpfs_t:lnk_file manage_lnk_file_perms;
|
||||||
allow $1_evolution_webcal_t $1_evolution_webcal_tmpfs_t:sock_file manage_sock_file_perms;
|
allow $1_evolution_webcal_t $1_evolution_webcal_tmpfs_t:sock_file manage_sock_file_perms;
|
||||||
allow $1_evolution_webcal_t $1_evolution_webcal_tmpfs_t:fifo_file manage_fifo_file_perms;
|
allow $1_evolution_webcal_t $1_evolution_webcal_tmpfs_t:fifo_file manage_fifo_file_perms;
|
||||||
fs_tmpfs_filetrans($1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_evolution_webcal_t, $1_evolution_webcal_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
# Transition from user type
|
# Transition from user type
|
||||||
domain_auto_trans($2, evolution_webcal_exec_t, $1_evolution_webcal_t)
|
domain_auto_trans($2, evolution_webcal_exec_t, $1_evolution_webcal_t)
|
||||||
@ -770,13 +770,13 @@ template(`evolution_per_role_template',`
|
|||||||
sysnet_dns_name_resolve($1_evolution_webcal_t)
|
sysnet_dns_name_resolve($1_evolution_webcal_t)
|
||||||
|
|
||||||
# Search home directory (?)
|
# Search home directory (?)
|
||||||
userdom_search_user_home_dirs($1,$1_evolution_webcal_t)
|
userdom_search_user_home_dirs($1, $1_evolution_webcal_t)
|
||||||
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
# FIXME: suppress access to .local/.icons/.themes until properly implemented
|
||||||
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
|
||||||
# until properly implemented
|
# until properly implemented
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_webcal_t)
|
userdom_dontaudit_read_user_home_content_files($1, $1_evolution_webcal_t)
|
||||||
|
|
||||||
xserver_user_x_domain_template($1,$1_evolution_webcal,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_evolution_webcal, $1_evolution_webcal_t, $1_evolution_webcal_tmpfs_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
nscd_socket_use($1_evolution_webcal_t)
|
nscd_socket_use($1_evolution_webcal_t)
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(evolution,1.6.0)
|
policy_module(evolution, 1.6.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -44,7 +44,7 @@ template(`games_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_games_t;
|
type $1_games_t;
|
||||||
application_domain($1_games_t,games_exec_t)
|
application_domain($1_games_t, games_exec_t)
|
||||||
role $3 types $1_games_t;
|
role $3 types $1_games_t;
|
||||||
|
|
||||||
type $1_games_devpts_t;
|
type $1_games_devpts_t;
|
||||||
@ -65,21 +65,21 @@ template(`games_per_role_template',`
|
|||||||
allow $1_games_t self:tcp_socket create_stream_socket_perms;
|
allow $1_games_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow $1_games_t self:udp_socket create_socket_perms;
|
allow $1_games_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
manage_files_pattern($1_games_t,games_data_t,games_data_t)
|
manage_files_pattern($1_games_t, games_data_t, games_data_t)
|
||||||
manage_lnk_files_pattern($1_games_t,games_data_t,games_data_t)
|
manage_lnk_files_pattern($1_games_t, games_data_t, games_data_t)
|
||||||
|
|
||||||
allow $1_games_t $1_games_devpts_t:chr_file { rw_chr_file_perms setattr };
|
allow $1_games_t $1_games_devpts_t:chr_file { rw_chr_file_perms setattr };
|
||||||
term_create_pty($1_games_t,$1_games_devpts_t)
|
term_create_pty($1_games_t,$1_games_devpts_t)
|
||||||
|
|
||||||
manage_dirs_pattern($1_games_t,$1_games_tmp_t,$1_games_tmp_t)
|
manage_dirs_pattern($1_games_t, $1_games_tmp_t, $1_games_tmp_t)
|
||||||
manage_files_pattern($1_games_t,$1_games_tmp_t,$1_games_tmp_t)
|
manage_files_pattern($1_games_t, $1_games_tmp_t, $1_games_tmp_t)
|
||||||
files_tmp_filetrans($1_games_t, $1_games_tmp_t, { file dir })
|
files_tmp_filetrans($1_games_t, $1_games_tmp_t, { file dir })
|
||||||
|
|
||||||
manage_files_pattern($1_games_t,$1_games_tmpfs_t,$1_games_tmpfs_t)
|
manage_files_pattern($1_games_t, $1_games_tmpfs_t, $1_games_tmpfs_t)
|
||||||
manage_lnk_files_pattern($1_games_t,$1_games_tmpfs_t,$1_games_tmpfs_t)
|
manage_lnk_files_pattern($1_games_t, $1_games_tmpfs_t, $1_games_tmpfs_t)
|
||||||
manage_fifo_files_pattern($1_games_t,$1_games_tmpfs_t,$1_games_tmpfs_t)
|
manage_fifo_files_pattern($1_games_t, $1_games_tmpfs_t, $1_games_tmpfs_t)
|
||||||
manage_sock_files_pattern($1_games_t,$1_games_tmpfs_t,$1_games_tmpfs_t)
|
manage_sock_files_pattern($1_games_t, $1_games_tmpfs_t, $1_games_tmpfs_t)
|
||||||
fs_tmpfs_filetrans($1_games_t,$1_games_tmpfs_t,{ file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_games_t, $1_games_tmpfs_t, { file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
can_exec($1_games_t, games_exec_t)
|
can_exec($1_games_t, games_exec_t)
|
||||||
|
|
||||||
@ -146,7 +146,7 @@ template(`games_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_x_domain_template($1,$1_games,$1_games_t,$1_games_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_games, $1_games_t, $1_games_tmpfs_t)
|
||||||
xserver_create_xdm_tmp_sockets($1_games_t)
|
xserver_create_xdm_tmp_sockets($1_games_t)
|
||||||
xserver_read_xdm_lib_files($1_games_t)
|
xserver_read_xdm_lib_files($1_games_t)
|
||||||
')
|
')
|
||||||
|
@ -13,7 +13,7 @@ files_type(games_data_t)
|
|||||||
# games recovery scripts
|
# games recovery scripts
|
||||||
type games_t;
|
type games_t;
|
||||||
type games_exec_t;
|
type games_exec_t;
|
||||||
init_system_domain(games_t,games_exec_t)
|
init_system_domain(games_t, games_exec_t)
|
||||||
|
|
||||||
type games_var_run_t;
|
type games_var_run_t;
|
||||||
files_pid_file(games_var_run_t)
|
files_pid_file(games_var_run_t)
|
||||||
@ -26,11 +26,11 @@ files_pid_file(games_var_run_t)
|
|||||||
dontaudit games_t self:capability sys_tty_config;
|
dontaudit games_t self:capability sys_tty_config;
|
||||||
allow games_t self:process signal_perms;
|
allow games_t self:process signal_perms;
|
||||||
|
|
||||||
manage_files_pattern(games_t,games_data_t,games_data_t)
|
manage_files_pattern(games_t, games_data_t, games_data_t)
|
||||||
manage_lnk_files_pattern(games_t,games_data_t,games_data_t)
|
manage_lnk_files_pattern(games_t, games_data_t, games_data_t)
|
||||||
|
|
||||||
manage_files_pattern(games_t,games_var_run_t,games_var_run_t)
|
manage_files_pattern(games_t, games_var_run_t, games_var_run_t)
|
||||||
files_pid_filetrans(games_t,games_var_run_t,file)
|
files_pid_filetrans(games_t, games_var_run_t, file)
|
||||||
|
|
||||||
can_exec(games_t,games_exec_t)
|
can_exec(games_t,games_exec_t)
|
||||||
|
|
||||||
|
@ -40,18 +40,18 @@ template(`gift_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_gift_t;
|
type $1_gift_t;
|
||||||
application_domain($1_gift_t,gift_exec_t)
|
application_domain($1_gift_t, gift_exec_t)
|
||||||
role $3 types $1_gift_t;
|
role $3 types $1_gift_t;
|
||||||
|
|
||||||
type $1_gift_home_t alias $1_gift_rw_t;
|
type $1_gift_home_t alias $1_gift_rw_t;
|
||||||
files_poly_member($1_gift_home_t)
|
files_poly_member($1_gift_home_t)
|
||||||
userdom_user_home_content($1,$1_gift_home_t)
|
userdom_user_home_content($1, $1_gift_home_t)
|
||||||
|
|
||||||
type $1_gift_tmpfs_t;
|
type $1_gift_tmpfs_t;
|
||||||
files_tmpfs_file($1_gift_tmpfs_t)
|
files_tmpfs_file($1_gift_tmpfs_t)
|
||||||
|
|
||||||
type $1_giftd_t;
|
type $1_giftd_t;
|
||||||
application_domain($1_giftd_t,giftd_exec_t)
|
application_domain($1_giftd_t, giftd_exec_t)
|
||||||
role $3 types $1_giftd_t;
|
role $3 types $1_giftd_t;
|
||||||
|
|
||||||
##############################
|
##############################
|
||||||
@ -61,16 +61,16 @@ template(`gift_per_role_template',`
|
|||||||
|
|
||||||
allow $1_gift_t self:tcp_socket create_socket_perms;
|
allow $1_gift_t self:tcp_socket create_socket_perms;
|
||||||
|
|
||||||
manage_files_pattern($1_gift_t,$1_gift_tmpfs_t,$1_gift_tmpfs_t)
|
manage_files_pattern($1_gift_t, $1_gift_tmpfs_t, $1_gift_tmpfs_t)
|
||||||
manage_lnk_files_pattern($1_gift_t,$1_gift_tmpfs_t,$1_gift_tmpfs_t)
|
manage_lnk_files_pattern($1_gift_t, $1_gift_tmpfs_t, $1_gift_tmpfs_t)
|
||||||
manage_fifo_files_pattern($1_gift_t,$1_gift_tmpfs_t,$1_gift_tmpfs_t)
|
manage_fifo_files_pattern($1_gift_t, $1_gift_tmpfs_t, $1_gift_tmpfs_t)
|
||||||
manage_sock_files_pattern($1_gift_t,$1_gift_tmpfs_t,$1_gift_tmpfs_t)
|
manage_sock_files_pattern($1_gift_t, $1_gift_tmpfs_t, $1_gift_tmpfs_t)
|
||||||
fs_tmpfs_filetrans($1_gift_t,$1_gift_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_gift_t, $1_gift_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
manage_dirs_pattern($1_gift_t,$1_gift_home_t,$1_gift_home_t)
|
manage_dirs_pattern($1_gift_t, $1_gift_home_t, $1_gift_home_t)
|
||||||
manage_files_pattern($1_gift_t,$1_gift_home_t,$1_gift_home_t)
|
manage_files_pattern($1_gift_t, $1_gift_home_t, $1_gift_home_t)
|
||||||
manage_lnk_files_pattern($1_gift_t,$1_gift_home_t,$1_gift_home_t)
|
manage_lnk_files_pattern($1_gift_t, $1_gift_home_t, $1_gift_home_t)
|
||||||
userdom_user_home_dir_filetrans($1,$1_gift_t,$1_gift_home_t,dir)
|
userdom_user_home_dir_filetrans($1, $1_gift_t, $1_gift_home_t,dir)
|
||||||
|
|
||||||
# Launch gift daemon
|
# Launch gift daemon
|
||||||
domtrans_pattern($1_gift_t, giftd_exec_t, $1_giftd_t)
|
domtrans_pattern($1_gift_t, giftd_exec_t, $1_giftd_t)
|
||||||
@ -79,15 +79,15 @@ template(`gift_per_role_template',`
|
|||||||
domtrans_pattern($2, gift_exec_t, $1_gift_t)
|
domtrans_pattern($2, gift_exec_t, $1_gift_t)
|
||||||
|
|
||||||
# user managed content
|
# user managed content
|
||||||
manage_dirs_pattern($2,$1_gift_home_t,$1_gift_home_t)
|
manage_dirs_pattern($2, $1_gift_home_t, $1_gift_home_t)
|
||||||
manage_files_pattern($2,$1_gift_home_t,$1_gift_home_t)
|
manage_files_pattern($2, $1_gift_home_t, $1_gift_home_t)
|
||||||
manage_lnk_files_pattern($2,$1_gift_home_t,$1_gift_home_t)
|
manage_lnk_files_pattern($2, $1_gift_home_t, $1_gift_home_t)
|
||||||
relabel_dirs_pattern($2,$1_gift_home_t,$1_gift_home_t)
|
relabel_dirs_pattern($2, $1_gift_home_t, $1_gift_home_t)
|
||||||
relabel_files_pattern($2,$1_gift_home_t,$1_gift_home_t)
|
relabel_files_pattern($2, $1_gift_home_t, $1_gift_home_t)
|
||||||
relabel_lnk_files_pattern($2,$1_gift_home_t,$1_gift_home_t)
|
relabel_lnk_files_pattern($2, $1_gift_home_t, $1_gift_home_t)
|
||||||
|
|
||||||
# Allow the user domain to signal/ps.
|
# Allow the user domain to signal/ps.
|
||||||
ps_process_pattern($2,$1_gift_t)
|
ps_process_pattern($2, $1_gift_t)
|
||||||
allow $2 $1_gift_t:process signal_perms;
|
allow $2 $1_gift_t:process signal_perms;
|
||||||
|
|
||||||
# Read /proc/meminfo
|
# Read /proc/meminfo
|
||||||
@ -107,7 +107,7 @@ template(`gift_per_role_template',`
|
|||||||
sysnet_read_config($1_gift_t)
|
sysnet_read_config($1_gift_t)
|
||||||
|
|
||||||
# giftui looks in .icons, .themes.
|
# giftui looks in .icons, .themes.
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_gift_t)
|
userdom_dontaudit_read_user_home_content_files($1, $1_gift_t)
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
fs_manage_nfs_dirs($1_gift_t)
|
fs_manage_nfs_dirs($1_gift_t)
|
||||||
@ -130,7 +130,7 @@ template(`gift_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_x_domain_template($1,$1_gift,$1_gift_t,$1_gift_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_gift, $1_gift_t, $1_gift_tmpfs_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
##############################
|
##############################
|
||||||
@ -143,10 +143,10 @@ template(`gift_per_role_template',`
|
|||||||
allow $1_giftd_t self:tcp_socket create_stream_socket_perms;
|
allow $1_giftd_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow $1_giftd_t self:udp_socket create_socket_perms;
|
allow $1_giftd_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
manage_dirs_pattern($1_giftd_t,$1_gift_home_t,$1_gift_home_t)
|
manage_dirs_pattern($1_giftd_t, $1_gift_home_t, $1_gift_home_t)
|
||||||
manage_files_pattern($1_giftd_t,$1_gift_home_t,$1_gift_home_t)
|
manage_files_pattern($1_giftd_t, $1_gift_home_t, $1_gift_home_t)
|
||||||
manage_lnk_files_pattern($1_giftd_t,$1_gift_home_t,$1_gift_home_t)
|
manage_lnk_files_pattern($1_giftd_t, $1_gift_home_t, $1_gift_home_t)
|
||||||
userdom_user_home_dir_filetrans($1,$1_giftd_t,$1_gift_home_t,dir)
|
userdom_user_home_dir_filetrans($1, $1_giftd_t, $1_gift_home_t, dir)
|
||||||
|
|
||||||
domtrans_pattern($2, giftd_exec_t, $1_giftd_t)
|
domtrans_pattern($2, giftd_exec_t, $1_giftd_t)
|
||||||
|
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(gift,1.4.0)
|
policy_module(gift, 1.4.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -64,13 +64,13 @@ template(`gnome_per_role_template',`
|
|||||||
allow $1_gconfd_t self:process getsched;
|
allow $1_gconfd_t self:process getsched;
|
||||||
allow $1_gconfd_t self:fifo_file rw_fifo_file_perms;
|
allow $1_gconfd_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
|
||||||
manage_dirs_pattern($1_gconfd_t,$1_gconf_home_t,$1_gconf_home_t)
|
manage_dirs_pattern($1_gconfd_t, $1_gconf_home_t, $1_gconf_home_t)
|
||||||
manage_files_pattern($1_gconfd_t,$1_gconf_home_t,$1_gconf_home_t)
|
manage_files_pattern($1_gconfd_t, $1_gconf_home_t, $1_gconf_home_t)
|
||||||
userdom_user_home_dir_filetrans($1, $1_gconfd_t, $1_gconf_home_t, dir)
|
userdom_user_home_dir_filetrans($1, $1_gconfd_t, $1_gconf_home_t, dir)
|
||||||
|
|
||||||
manage_dirs_pattern($1_gconfd_t,$1_gconf_tmp_t,$1_gconf_tmp_t)
|
manage_dirs_pattern($1_gconfd_t, $1_gconf_tmp_t, $1_gconf_tmp_t)
|
||||||
manage_files_pattern($1_gconfd_t,$1_gconf_tmp_t,$1_gconf_tmp_t)
|
manage_files_pattern($1_gconfd_t, $1_gconf_tmp_t, $1_gconf_tmp_t)
|
||||||
userdom_user_tmp_filetrans($1,$1_gconfd_t,$1_gconf_tmp_t,{ dir file })
|
userdom_user_tmp_filetrans($1, $1_gconfd_t, $1_gconf_tmp_t, { dir file })
|
||||||
|
|
||||||
domain_auto_trans($2, gconfd_exec_t, $1_gconfd_t)
|
domain_auto_trans($2, gconfd_exec_t, $1_gconfd_t)
|
||||||
allow $1_gconfd_t $2:fd use;
|
allow $1_gconfd_t $2:fd use;
|
||||||
@ -78,9 +78,9 @@ template(`gnome_per_role_template',`
|
|||||||
allow $1_gconfd_t $2:unix_stream_socket connectto;
|
allow $1_gconfd_t $2:unix_stream_socket connectto;
|
||||||
|
|
||||||
allow $1_gconfd_t gconf_etc_t:dir list_dir_perms;
|
allow $1_gconfd_t gconf_etc_t:dir list_dir_perms;
|
||||||
read_files_pattern($1_gconfd_t,gconf_etc_t,gconf_etc_t)
|
read_files_pattern($1_gconfd_t, gconf_etc_t, gconf_etc_t)
|
||||||
|
|
||||||
ps_process_pattern($2,$1_gconfd_t)
|
ps_process_pattern($2, $1_gconfd_t)
|
||||||
|
|
||||||
dev_read_urand($1_gconfd_t)
|
dev_read_urand($1_gconfd_t)
|
||||||
|
|
||||||
@ -94,10 +94,10 @@ template(`gnome_per_role_template',`
|
|||||||
logging_send_syslog_msg($1_gconfd_t)
|
logging_send_syslog_msg($1_gconfd_t)
|
||||||
|
|
||||||
userdom_manage_user_tmp_sockets($1, $1_gconfd_t)
|
userdom_manage_user_tmp_sockets($1, $1_gconfd_t)
|
||||||
userdom_manage_user_tmp_dirs($1,$1_gconfd_t)
|
userdom_manage_user_tmp_dirs($1, $1_gconfd_t)
|
||||||
userdom_tmp_filetrans_user_tmp($1,$1_gconfd_t,dir)
|
userdom_tmp_filetrans_user_tmp($1, $1_gconfd_t,dir)
|
||||||
|
|
||||||
gnome_stream_connect_gconf_template($1,$2)
|
gnome_stream_connect_gconf_template($1, $2)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
nscd_dontaudit_search_pid($1_gconfd_t)
|
nscd_dontaudit_search_pid($1_gconfd_t)
|
||||||
@ -127,11 +127,10 @@ template(`gnome_per_role_template',`
|
|||||||
#
|
#
|
||||||
template(`gnome_stream_connect_gconf_template',`
|
template(`gnome_stream_connect_gconf_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type $1_gconfd_t;
|
type $1_gconfd_t, $1_gconf_tmp_t;
|
||||||
type $1_gconf_tmp_t;
|
|
||||||
')
|
')
|
||||||
|
|
||||||
read_files_pattern($2,$1_gconf_tmp_t,$1_gconf_tmp_t)
|
read_files_pattern($2, $1_gconf_tmp_t, $1_gconf_tmp_t)
|
||||||
allow $2 $1_gconfd_t:unix_stream_socket connectto;
|
allow $2 $1_gconfd_t:unix_stream_socket connectto;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -165,7 +164,7 @@ template(`gnome_domtrans_user_gconf',`
|
|||||||
type $1_gconfd_t, gconfd_exec_t;
|
type $1_gconfd_t, gconfd_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($2,gconfd_exec_t,$1_gconfd_t)
|
domtrans_pattern($2, gconfd_exec_t, $1_gconfd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(gnome,1.3.0)
|
policy_module(gnome, 1.3.0)
|
||||||
|
|
||||||
##############################
|
##############################
|
||||||
#
|
#
|
||||||
|
@ -36,8 +36,7 @@
|
|||||||
#
|
#
|
||||||
template(`gpg_per_role_template',`
|
template(`gpg_per_role_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type gpg_exec_t, gpg_helper_exec_t;
|
type gpg_exec_t, gpg_helper_exec_t, gpg_agent_exec_t, pinentry_exec_t;
|
||||||
type gpg_agent_exec_t, pinentry_exec_t;
|
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -46,25 +45,25 @@ template(`gpg_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_gpg_t;
|
type $1_gpg_t;
|
||||||
application_domain($1_gpg_t,gpg_exec_t)
|
application_domain($1_gpg_t, gpg_exec_t)
|
||||||
role $3 types $1_gpg_t;
|
role $3 types $1_gpg_t;
|
||||||
|
|
||||||
type $1_gpg_agent_t;
|
type $1_gpg_agent_t;
|
||||||
application_domain($1_gpg_agent_t,gpg_agent_exec_t)
|
application_domain($1_gpg_agent_t, gpg_agent_exec_t)
|
||||||
role $3 types $1_gpg_agent_t;
|
role $3 types $1_gpg_agent_t;
|
||||||
|
|
||||||
type $1_gpg_agent_tmp_t;
|
type $1_gpg_agent_tmp_t;
|
||||||
files_tmp_file($1_gpg_agent_tmp_t)
|
files_tmp_file($1_gpg_agent_tmp_t)
|
||||||
|
|
||||||
type $1_gpg_secret_t;
|
type $1_gpg_secret_t;
|
||||||
userdom_user_home_content($1,$1_gpg_secret_t)
|
userdom_user_home_content($1, $1_gpg_secret_t)
|
||||||
|
|
||||||
type $1_gpg_helper_t;
|
type $1_gpg_helper_t;
|
||||||
application_domain($1_gpg_helper_t,gpg_helper_exec_t)
|
application_domain($1_gpg_helper_t, gpg_helper_exec_t)
|
||||||
role $3 types $1_gpg_helper_t;
|
role $3 types $1_gpg_helper_t;
|
||||||
|
|
||||||
type $1_gpg_pinentry_t;
|
type $1_gpg_pinentry_t;
|
||||||
application_domain($1_gpg_pinentry_t,pinentry_exec_t)
|
application_domain($1_gpg_pinentry_t, pinentry_exec_t)
|
||||||
role $3 types $1_gpg_pinentry_t;
|
role $3 types $1_gpg_pinentry_t;
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -81,18 +80,18 @@ template(`gpg_per_role_template',`
|
|||||||
allow $1_gpg_t self:tcp_socket create_stream_socket_perms;
|
allow $1_gpg_t self:tcp_socket create_stream_socket_perms;
|
||||||
|
|
||||||
# transition from the gpg domain to the helper domain
|
# transition from the gpg domain to the helper domain
|
||||||
domtrans_pattern($1_gpg_t,gpg_helper_exec_t,$1_gpg_helper_t)
|
domtrans_pattern($1_gpg_t, gpg_helper_exec_t, $1_gpg_helper_t)
|
||||||
|
|
||||||
manage_files_pattern($1_gpg_t,$1_gpg_secret_t,$1_gpg_secret_t)
|
manage_files_pattern($1_gpg_t, $1_gpg_secret_t, $1_gpg_secret_t)
|
||||||
manage_lnk_files_pattern($1_gpg_t,$1_gpg_secret_t,$1_gpg_secret_t)
|
manage_lnk_files_pattern($1_gpg_t, $1_gpg_secret_t, $1_gpg_secret_t)
|
||||||
allow $1_gpg_t $1_gpg_secret_t:dir create_dir_perms;
|
allow $1_gpg_t $1_gpg_secret_t:dir create_dir_perms;
|
||||||
userdom_user_home_dir_filetrans($1, $1_gpg_t, $1_gpg_secret_t, dir)
|
userdom_user_home_dir_filetrans($1, $1_gpg_t, $1_gpg_secret_t, dir)
|
||||||
|
|
||||||
# transition from the userdomain to the derived domain
|
# transition from the userdomain to the derived domain
|
||||||
domtrans_pattern($2,gpg_exec_t,$1_gpg_t)
|
domtrans_pattern($2, gpg_exec_t, $1_gpg_t)
|
||||||
|
|
||||||
# allow ps to show gpg
|
# allow ps to show gpg
|
||||||
ps_process_pattern($2,$1_gpg_t)
|
ps_process_pattern($2, $1_gpg_t)
|
||||||
|
|
||||||
corenet_all_recvfrom_unlabeled($1_gpg_t)
|
corenet_all_recvfrom_unlabeled($1_gpg_t)
|
||||||
corenet_all_recvfrom_netlabel($1_gpg_t)
|
corenet_all_recvfrom_netlabel($1_gpg_t)
|
||||||
@ -125,7 +124,7 @@ template(`gpg_per_role_template',`
|
|||||||
|
|
||||||
sysnet_read_config($1_gpg_t)
|
sysnet_read_config($1_gpg_t)
|
||||||
|
|
||||||
userdom_use_user_terminals($1,$1_gpg_t)
|
userdom_use_user_terminals($1, $1_gpg_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
nis_use_ypbind($1_gpg_t)
|
nis_use_ypbind($1_gpg_t)
|
||||||
@ -208,29 +207,29 @@ template(`gpg_per_role_template',`
|
|||||||
allow $1_gpg_agent_t self:fifo_file rw_fifo_file_perms;
|
allow $1_gpg_agent_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
|
||||||
# Allow the gpg-agent to manage its tmp files (socket)
|
# Allow the gpg-agent to manage its tmp files (socket)
|
||||||
manage_dirs_pattern($1_gpg_agent_t,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
|
manage_dirs_pattern($1_gpg_agent_t, $1_gpg_agent_tmp_t, $1_gpg_agent_tmp_t)
|
||||||
manage_files_pattern($1_gpg_agent_t,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
|
manage_files_pattern($1_gpg_agent_t, $1_gpg_agent_tmp_t, $1_gpg_agent_tmp_t)
|
||||||
manage_sock_files_pattern($1_gpg_agent_t,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
|
manage_sock_files_pattern($1_gpg_agent_t, $1_gpg_agent_tmp_t, $1_gpg_agent_tmp_t)
|
||||||
files_tmp_filetrans($1_gpg_agent_t, $1_gpg_agent_tmp_t, { file sock_file dir })
|
files_tmp_filetrans($1_gpg_agent_t, $1_gpg_agent_tmp_t, { file sock_file dir })
|
||||||
|
|
||||||
# read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
|
# read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
|
||||||
manage_dirs_pattern($1_gpg_agent_t,$1_gpg_secret_t,$1_gpg_secret_t)
|
manage_dirs_pattern($1_gpg_agent_t, $1_gpg_secret_t, $1_gpg_secret_t)
|
||||||
manage_files_pattern($1_gpg_agent_t,$1_gpg_secret_t,$1_gpg_secret_t)
|
manage_files_pattern($1_gpg_agent_t, $1_gpg_secret_t, $1_gpg_secret_t)
|
||||||
manage_lnk_files_pattern($1_gpg_agent_t,$1_gpg_secret_t,$1_gpg_secret_t)
|
manage_lnk_files_pattern($1_gpg_agent_t, $1_gpg_secret_t, $1_gpg_secret_t)
|
||||||
|
|
||||||
# allow gpg to connect to the gpg agent
|
# allow gpg to connect to the gpg agent
|
||||||
stream_connect_pattern($1_gpg_t,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t,$1_gpg_agent_t)
|
stream_connect_pattern($1_gpg_t, $1_gpg_agent_tmp_t, $1_gpg_agent_tmp_t, $1_gpg_agent_t)
|
||||||
|
|
||||||
# allow ps to show gpg-agent
|
# allow ps to show gpg-agent
|
||||||
ps_process_pattern($2,$1_gpg_agent_t)
|
ps_process_pattern($2, $1_gpg_agent_t)
|
||||||
|
|
||||||
# Allow the user shell to signal the gpg-agent program.
|
# Allow the user shell to signal the gpg-agent program.
|
||||||
allow $2 $1_gpg_agent_t:process { signal sigkill signull };
|
allow $2 $1_gpg_agent_t:process { signal sigkill signull };
|
||||||
|
|
||||||
# Allow the user to manage gpg-agent tmp files (socket)
|
# Allow the user to manage gpg-agent tmp files (socket)
|
||||||
manage_dirs_pattern($2,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
|
manage_dirs_pattern($2, $1_gpg_agent_tmp_t, $1_gpg_agent_tmp_t)
|
||||||
manage_files_pattern($2,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
|
manage_files_pattern($2, $1_gpg_agent_tmp_t, $1_gpg_agent_tmp_t)
|
||||||
manage_sock_files_pattern($2,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
|
manage_sock_files_pattern($2, $1_gpg_agent_tmp_t, $1_gpg_agent_tmp_t)
|
||||||
|
|
||||||
# Transition from the user domain to the derived domain.
|
# Transition from the user domain to the derived domain.
|
||||||
domtrans_pattern($2, gpg_agent_exec_t, $1_gpg_agent_t)
|
domtrans_pattern($2, gpg_agent_exec_t, $1_gpg_agent_t)
|
||||||
@ -245,17 +244,17 @@ template(`gpg_per_role_template',`
|
|||||||
miscfiles_read_localization($1_gpg_agent_t)
|
miscfiles_read_localization($1_gpg_agent_t)
|
||||||
|
|
||||||
# Write to the user domain tty.
|
# Write to the user domain tty.
|
||||||
userdom_use_user_terminals($1,$1_gpg_agent_t)
|
userdom_use_user_terminals($1, $1_gpg_agent_t)
|
||||||
# read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
|
# read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
|
||||||
userdom_search_user_home_dirs($1,$1_gpg_agent_t)
|
userdom_search_user_home_dirs($1, $1_gpg_agent_t)
|
||||||
|
|
||||||
tunable_policy(`gpg_agent_env_file',`
|
tunable_policy(`gpg_agent_env_file',`
|
||||||
# write ~/.gpg-agent-info or a similar to the users home dir
|
# write ~/.gpg-agent-info or a similar to the users home dir
|
||||||
# or subdir (gpg-agent --write-env-file option)
|
# or subdir (gpg-agent --write-env-file option)
|
||||||
#
|
#
|
||||||
userdom_user_home_dir_filetrans_user_home_content($1,$1_gpg_agent_t,file)
|
userdom_user_home_dir_filetrans_user_home_content($1, $1_gpg_agent_t, file)
|
||||||
userdom_manage_user_home_content_dirs($1,$1_gpg_agent_t)
|
userdom_manage_user_home_content_dirs($1, $1_gpg_agent_t)
|
||||||
userdom_manage_user_home_content_files($1,$1_gpg_agent_t)
|
userdom_manage_user_home_content_files($1, $1_gpg_agent_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -280,7 +279,7 @@ template(`gpg_per_role_template',`
|
|||||||
|
|
||||||
# we need to allow gpg-agent to call pinentry so it can get the passphrase
|
# we need to allow gpg-agent to call pinentry so it can get the passphrase
|
||||||
# from the user.
|
# from the user.
|
||||||
domtrans_pattern($1_gpg_agent_t,pinentry_exec_t,$1_gpg_pinentry_t)
|
domtrans_pattern($1_gpg_agent_t, pinentry_exec_t, $1_gpg_pinentry_t)
|
||||||
|
|
||||||
# read /proc/meminfo
|
# read /proc/meminfo
|
||||||
kernel_read_system_state($1_gpg_pinentry_t)
|
kernel_read_system_state($1_gpg_pinentry_t)
|
||||||
@ -296,7 +295,7 @@ template(`gpg_per_role_template',`
|
|||||||
miscfiles_read_localization($1_gpg_pinentry_t)
|
miscfiles_read_localization($1_gpg_pinentry_t)
|
||||||
|
|
||||||
# for .Xauthority
|
# for .Xauthority
|
||||||
userdom_read_user_home_content_files($1,$1_gpg_pinentry_t)
|
userdom_read_user_home_content_files($1, $1_gpg_pinentry_t)
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
fs_read_nfs_files($1_gpg_pinentry_t)
|
fs_read_nfs_files($1_gpg_pinentry_t)
|
||||||
|
@ -43,18 +43,18 @@ template(`irc_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_irc_t;
|
type $1_irc_t;
|
||||||
application_domain($1_irc_t,irc_exec_t)
|
application_domain($1_irc_t, irc_exec_t)
|
||||||
role $3 types $1_irc_t;
|
role $3 types $1_irc_t;
|
||||||
|
|
||||||
type $1_irc_exec_t;
|
type $1_irc_exec_t;
|
||||||
userdom_user_home_content($1,$1_irc_exec_t)
|
userdom_user_home_content($1, $1_irc_exec_t)
|
||||||
application_domain($1_irc_t,$1_irc_exec_t)
|
application_domain($1_irc_t, $1_irc_exec_t)
|
||||||
|
|
||||||
type $1_irc_home_t;
|
type $1_irc_home_t;
|
||||||
userdom_user_home_content($1,$1_irc_home_t)
|
userdom_user_home_content($1, $1_irc_home_t)
|
||||||
|
|
||||||
type $1_irc_tmp_t;
|
type $1_irc_tmp_t;
|
||||||
userdom_user_home_content($1,$1_irc_tmp_t)
|
userdom_user_home_content($1, $1_irc_tmp_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -65,26 +65,26 @@ template(`irc_per_role_template',`
|
|||||||
allow $1_irc_t self:tcp_socket create_socket_perms;
|
allow $1_irc_t self:tcp_socket create_socket_perms;
|
||||||
allow $1_irc_t self:udp_socket create_socket_perms;
|
allow $1_irc_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
manage_dirs_pattern($1_irc_t,$1_irc_home_t,$1_irc_home_t)
|
manage_dirs_pattern($1_irc_t, $1_irc_home_t, $1_irc_home_t)
|
||||||
manage_files_pattern($1_irc_t,$1_irc_home_t,$1_irc_home_t)
|
manage_files_pattern($1_irc_t, $1_irc_home_t, $1_irc_home_t)
|
||||||
manage_lnk_files_pattern($1_irc_t,$1_irc_home_t,$1_irc_home_t)
|
manage_lnk_files_pattern($1_irc_t, $1_irc_home_t, $1_irc_home_t)
|
||||||
userdom_user_home_dir_filetrans($1,$1_irc_t,$1_irc_home_t,{ dir file lnk_file })
|
userdom_user_home_dir_filetrans($1, $1_irc_t, $1_irc_home_t,{ dir file lnk_file })
|
||||||
|
|
||||||
# access files under /tmp
|
# access files under /tmp
|
||||||
manage_dirs_pattern($1_irc_t,$1_irc_tmp_t,$1_irc_tmp_t)
|
manage_dirs_pattern($1_irc_t, $1_irc_tmp_t, $1_irc_tmp_t)
|
||||||
manage_files_pattern($1_irc_t,$1_irc_tmp_t,$1_irc_tmp_t)
|
manage_files_pattern($1_irc_t, $1_irc_tmp_t, $1_irc_tmp_t)
|
||||||
manage_lnk_files_pattern($1_irc_t,$1_irc_tmp_t,$1_irc_tmp_t)
|
manage_lnk_files_pattern($1_irc_t, $1_irc_tmp_t, $1_irc_tmp_t)
|
||||||
manage_fifo_files_pattern($1_irc_t,$1_irc_tmp_t,$1_irc_tmp_t)
|
manage_fifo_files_pattern($1_irc_t, $1_irc_tmp_t, $1_irc_tmp_t)
|
||||||
manage_sock_files_pattern($1_irc_t,$1_irc_tmp_t,$1_irc_tmp_t)
|
manage_sock_files_pattern($1_irc_t, $1_irc_tmp_t, $1_irc_tmp_t)
|
||||||
files_tmp_filetrans($1_irc_t,$1_irc_tmp_t,{ file dir lnk_file sock_file fifo_file })
|
files_tmp_filetrans($1_irc_t, $1_irc_tmp_t, { file dir lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
# Transition from the user domain to the derived domain.
|
# Transition from the user domain to the derived domain.
|
||||||
domtrans_pattern($2,irc_exec_t,$1_irc_t)
|
domtrans_pattern($2, irc_exec_t, $1_irc_t)
|
||||||
|
|
||||||
allow $2 $1_irc_exec_t:file { relabelfrom relabelto manage_file_perms };
|
allow $2 $1_irc_exec_t:file { relabelfrom relabelto manage_file_perms };
|
||||||
|
|
||||||
# allow ps to show irc
|
# allow ps to show irc
|
||||||
ps_process_pattern($2,$1_irc_t)
|
ps_process_pattern($2, $1_irc_t)
|
||||||
allow $2 $1_irc_t:process signal;
|
allow $2 $1_irc_t:process signal;
|
||||||
|
|
||||||
kernel_read_proc_symlinks($1_irc_t)
|
kernel_read_proc_symlinks($1_irc_t)
|
||||||
@ -130,7 +130,7 @@ template(`irc_per_role_template',`
|
|||||||
sysnet_read_config($1_irc_t)
|
sysnet_read_config($1_irc_t)
|
||||||
|
|
||||||
# Write to the user domain tty.
|
# Write to the user domain tty.
|
||||||
userdom_use_user_terminals($1,$1_irc_t)
|
userdom_use_user_terminals($1, $1_irc_t)
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
fs_manage_nfs_dirs($1_irc_t)
|
fs_manage_nfs_dirs($1_irc_t)
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(irc,1.4.0)
|
policy_module(irc, 1.4.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -43,7 +43,7 @@ template(`java_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_javaplugin_t;
|
type $1_javaplugin_t;
|
||||||
application_domain($1_javaplugin_t,java_exec_t)
|
application_domain($1_javaplugin_t, java_exec_t)
|
||||||
role $3 types $1_javaplugin_t;
|
role $3 types $1_javaplugin_t;
|
||||||
|
|
||||||
type $1_javaplugin_tmp_t;
|
type $1_javaplugin_tmp_t;
|
||||||
@ -64,20 +64,20 @@ template(`java_per_role_template',`
|
|||||||
|
|
||||||
allow $1_javaplugin_t $2:unix_stream_socket connectto;
|
allow $1_javaplugin_t $2:unix_stream_socket connectto;
|
||||||
allow $1_javaplugin_t $2:unix_stream_socket { read write };
|
allow $1_javaplugin_t $2:unix_stream_socket { read write };
|
||||||
userdom_write_user_tmp_sockets($1,$1_javaplugin_t)
|
userdom_write_user_tmp_sockets($1, $1_javaplugin_t)
|
||||||
|
|
||||||
manage_dirs_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t)
|
manage_dirs_pattern($1_javaplugin_t, $1_javaplugin_tmp_t, $1_javaplugin_tmp_t)
|
||||||
manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t)
|
manage_files_pattern($1_javaplugin_t, $1_javaplugin_tmp_t, $1_javaplugin_tmp_t)
|
||||||
files_tmp_filetrans($1_javaplugin_t,$1_javaplugin_tmp_t,{ file dir })
|
files_tmp_filetrans($1_javaplugin_t, $1_javaplugin_tmp_t, { file dir })
|
||||||
|
|
||||||
manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
|
manage_files_pattern($1_javaplugin_t, $1_javaplugin_tmpfs_t, $1_javaplugin_tmpfs_t)
|
||||||
manage_lnk_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
|
manage_lnk_files_pattern($1_javaplugin_t, $1_javaplugin_tmpfs_t, $1_javaplugin_tmpfs_t)
|
||||||
manage_fifo_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
|
manage_fifo_files_pattern($1_javaplugin_t, $1_javaplugin_tmpfs_t, $1_javaplugin_tmpfs_t)
|
||||||
manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
|
manage_sock_files_pattern($1_javaplugin_t, $1_javaplugin_tmpfs_t, $1_javaplugin_tmpfs_t)
|
||||||
fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_javaplugin_t, $1_javaplugin_tmpfs_t, { file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
rw_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t)
|
rw_files_pattern($1_javaplugin_t, $1_home_t, $1_home_t)
|
||||||
read_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t)
|
read_files_pattern($1_javaplugin_t, $1_home_t, $1_home_t)
|
||||||
|
|
||||||
can_exec($1_javaplugin_t, java_exec_t)
|
can_exec($1_javaplugin_t, java_exec_t)
|
||||||
|
|
||||||
@ -134,15 +134,15 @@ template(`java_per_role_template',`
|
|||||||
|
|
||||||
sysnet_read_config($1_javaplugin_t)
|
sysnet_read_config($1_javaplugin_t)
|
||||||
|
|
||||||
userdom_dontaudit_use_user_terminals($1,$1_javaplugin_t)
|
userdom_dontaudit_use_user_terminals($1, $1_javaplugin_t)
|
||||||
userdom_dontaudit_setattr_user_home_content_files($1,$1_javaplugin_t)
|
userdom_dontaudit_setattr_user_home_content_files($1, $1_javaplugin_t)
|
||||||
userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t)
|
userdom_dontaudit_exec_user_home_content_files($1, $1_javaplugin_t)
|
||||||
userdom_manage_user_home_content_dirs($1,$1_javaplugin_t)
|
userdom_manage_user_home_content_dirs($1, $1_javaplugin_t)
|
||||||
userdom_manage_user_home_content_files($1,$1_javaplugin_t)
|
userdom_manage_user_home_content_files($1, $1_javaplugin_t)
|
||||||
userdom_manage_user_home_content_symlinks($1,$1_javaplugin_t)
|
userdom_manage_user_home_content_symlinks($1, $1_javaplugin_t)
|
||||||
userdom_manage_user_home_content_pipes($1,$1_javaplugin_t)
|
userdom_manage_user_home_content_pipes($1, $1_javaplugin_t)
|
||||||
userdom_manage_user_home_content_sockets($1,$1_javaplugin_t)
|
userdom_manage_user_home_content_sockets($1, $1_javaplugin_t)
|
||||||
userdom_user_home_dir_filetrans_user_home_content($1,$1_javaplugin_t,{ file lnk_file sock_file fifo_file })
|
userdom_user_home_dir_filetrans_user_home_content($1, $1_javaplugin_t, { file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
tunable_policy(`allow_java_execstack',`
|
tunable_policy(`allow_java_execstack',`
|
||||||
allow $1_javaplugin_t self:process execstack;
|
allow $1_javaplugin_t self:process execstack;
|
||||||
@ -164,7 +164,7 @@ template(`java_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_x_domain_template($1,$1_javaplugin,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_javaplugin, $1_javaplugin_t, $1_javaplugin_tmpfs_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -198,7 +198,7 @@ template(`java_domtrans_user_javaplugin',`
|
|||||||
type $1_javaplugin_t, java_exec_t;
|
type $1_javaplugin_t, java_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($2,java_exec_t,$1_javaplugin_t)
|
domtrans_pattern($2, java_exec_t, $1_javaplugin_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(java,1.8.0)
|
policy_module(java, 1.8.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -11,11 +11,11 @@ policy_module(java,1.8.0)
|
|||||||
## Allow java executable stack
|
## Allow java executable stack
|
||||||
## </p>
|
## </p>
|
||||||
## </desc>
|
## </desc>
|
||||||
gen_tunable(allow_java_execstack,false)
|
gen_tunable(allow_java_execstack, false)
|
||||||
|
|
||||||
type java_t;
|
type java_t;
|
||||||
type java_exec_t;
|
type java_exec_t;
|
||||||
init_system_domain(java_t,java_exec_t)
|
init_system_domain(java_t, java_exec_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -65,5 +65,5 @@ interface(`loadkeys_exec',`
|
|||||||
type loadkeys_exec_t;
|
type loadkeys_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
can_exec($1,loadkeys_exec_t)
|
can_exec($1, loadkeys_exec_t)
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(loadkeys,1.4.0)
|
policy_module(loadkeys, 1.4.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -11,7 +11,7 @@ policy_module(loadkeys,1.4.0)
|
|||||||
# all user domain ttys
|
# all user domain ttys
|
||||||
type loadkeys_t;
|
type loadkeys_t;
|
||||||
type loadkeys_exec_t;
|
type loadkeys_exec_t;
|
||||||
init_system_domain(loadkeys_t,loadkeys_exec_t)
|
init_system_domain(loadkeys_t, loadkeys_exec_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -44,7 +44,7 @@ template(`lockdev_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_lockdev_t;
|
type $1_lockdev_t;
|
||||||
application_domain($1_lockdev_t,lockdev_exec_t)
|
application_domain($1_lockdev_t, lockdev_exec_t)
|
||||||
role $3 types $1_lockdev_t;
|
role $3 types $1_lockdev_t;
|
||||||
|
|
||||||
type $1_lockdev_lock_t;
|
type $1_lockdev_lock_t;
|
||||||
@ -63,7 +63,7 @@ template(`lockdev_per_role_template',`
|
|||||||
domtrans_pattern($2, lockdev_exec_t, $1_lockdev_t)
|
domtrans_pattern($2, lockdev_exec_t, $1_lockdev_t)
|
||||||
|
|
||||||
allow $1_lockdev_t $1_lockdev_lock_t:file manage_file_perms;
|
allow $1_lockdev_t $1_lockdev_lock_t:file manage_file_perms;
|
||||||
files_lock_filetrans($1_lockdev_t,$1_lockdev_lock_t,file)
|
files_lock_filetrans($1_lockdev_t, $1_lockdev_lock_t, file)
|
||||||
|
|
||||||
files_read_all_locks($1_lockdev_t)
|
files_read_all_locks($1_lockdev_t)
|
||||||
|
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(lockdev,1.2.0)
|
policy_module(lockdev, 1.2.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -8,7 +8,7 @@ policy_module(mono, 1.5.0)
|
|||||||
|
|
||||||
type mono_t;
|
type mono_t;
|
||||||
type mono_exec_t;
|
type mono_exec_t;
|
||||||
init_system_domain(mono_t,mono_exec_t)
|
init_system_domain(mono_t, mono_exec_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -42,12 +42,12 @@ template(`mozilla_per_role_template',`
|
|||||||
# Declarations
|
# Declarations
|
||||||
#
|
#
|
||||||
type $1_mozilla_t;
|
type $1_mozilla_t;
|
||||||
application_domain($1_mozilla_t,mozilla_exec_t)
|
application_domain($1_mozilla_t, mozilla_exec_t)
|
||||||
role $3 types $1_mozilla_t;
|
role $3 types $1_mozilla_t;
|
||||||
|
|
||||||
type $1_mozilla_home_t alias $1_mozilla_rw_t;
|
type $1_mozilla_home_t alias $1_mozilla_rw_t;
|
||||||
files_poly_member($1_mozilla_home_t)
|
files_poly_member($1_mozilla_home_t)
|
||||||
userdom_user_home_content($1,$1_mozilla_home_t)
|
userdom_user_home_content($1, $1_mozilla_home_t)
|
||||||
|
|
||||||
type $1_mozilla_tmpfs_t;
|
type $1_mozilla_tmpfs_t;
|
||||||
files_tmpfs_file($1_mozilla_tmpfs_t)
|
files_tmpfs_file($1_mozilla_tmpfs_t)
|
||||||
@ -72,10 +72,10 @@ template(`mozilla_per_role_template',`
|
|||||||
can_exec($1_mozilla_t, mozilla_exec_t)
|
can_exec($1_mozilla_t, mozilla_exec_t)
|
||||||
|
|
||||||
# X access, Home files
|
# X access, Home files
|
||||||
manage_dirs_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t)
|
manage_dirs_pattern($1_mozilla_t, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
manage_files_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t)
|
manage_files_pattern($1_mozilla_t, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
manage_lnk_files_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t)
|
manage_lnk_files_pattern($1_mozilla_t, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
userdom_search_user_home_dirs($1,$1_mozilla_t)
|
userdom_search_user_home_dirs($1, $1_mozilla_t)
|
||||||
|
|
||||||
# Mozpluggerrc
|
# Mozpluggerrc
|
||||||
allow $1_mozilla_t mozilla_conf_t:file read_file_perms;
|
allow $1_mozilla_t mozilla_conf_t:file read_file_perms;
|
||||||
@ -89,18 +89,18 @@ template(`mozilla_per_role_template',`
|
|||||||
allow $2 $1_mozilla_t:unix_stream_socket connectto;
|
allow $2 $1_mozilla_t:unix_stream_socket connectto;
|
||||||
|
|
||||||
# X access, Home files
|
# X access, Home files
|
||||||
manage_dirs_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
|
manage_dirs_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
manage_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
|
manage_files_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
manage_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
|
manage_lnk_files_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
relabel_dirs_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
|
relabel_dirs_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
|
relabel_files_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
|
relabel_lnk_files_pattern($2, $1_mozilla_home_t, $1_mozilla_home_t)
|
||||||
|
|
||||||
manage_files_pattern($1_mozilla_t,$1_mozilla_tmpfs_t,$1_mozilla_tmpfs_t)
|
manage_files_pattern($1_mozilla_t, $1_mozilla_tmpfs_t, $1_mozilla_tmpfs_t)
|
||||||
manage_lnk_files_pattern($1_mozilla_t,$1_mozilla_tmpfs_t,$1_mozilla_tmpfs_t)
|
manage_lnk_files_pattern($1_mozilla_t, $1_mozilla_tmpfs_t, $1_mozilla_tmpfs_t)
|
||||||
manage_fifo_files_pattern($1_mozilla_t,$1_mozilla_tmpfs_t,$1_mozilla_tmpfs_t)
|
manage_fifo_files_pattern($1_mozilla_t, $1_mozilla_tmpfs_t, $1_mozilla_tmpfs_t)
|
||||||
manage_sock_files_pattern($1_mozilla_t,$1_mozilla_tmpfs_t,$1_mozilla_tmpfs_t)
|
manage_sock_files_pattern($1_mozilla_t, $1_mozilla_tmpfs_t, $1_mozilla_tmpfs_t)
|
||||||
fs_tmpfs_filetrans($1_mozilla_t,$1_mozilla_tmpfs_t,{ file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_mozilla_t, $1_mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
allow $1_mozilla_t $2:process signull;
|
allow $1_mozilla_t $2:process signull;
|
||||||
|
|
||||||
@ -109,7 +109,7 @@ template(`mozilla_per_role_template',`
|
|||||||
allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
|
allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
|
||||||
|
|
||||||
# Allow the user domain to signal/ps.
|
# Allow the user domain to signal/ps.
|
||||||
ps_process_pattern($2,$1_mozilla_t)
|
ps_process_pattern($2, $1_mozilla_t)
|
||||||
allow $2 $1_mozilla_t:process signal_perms;
|
allow $2 $1_mozilla_t:process signal_perms;
|
||||||
|
|
||||||
kernel_read_kernel_sysctls($1_mozilla_t)
|
kernel_read_kernel_sysctls($1_mozilla_t)
|
||||||
@ -184,14 +184,14 @@ template(`mozilla_per_role_template',`
|
|||||||
sysnet_dns_name_resolve($1_mozilla_t)
|
sysnet_dns_name_resolve($1_mozilla_t)
|
||||||
sysnet_read_config($1_mozilla_t)
|
sysnet_read_config($1_mozilla_t)
|
||||||
|
|
||||||
userdom_manage_user_home_content_dirs($1,$1_mozilla_t)
|
userdom_manage_user_home_content_dirs($1, $1_mozilla_t)
|
||||||
userdom_manage_user_home_content_files($1,$1_mozilla_t)
|
userdom_manage_user_home_content_files($1, $1_mozilla_t)
|
||||||
userdom_manage_user_home_content_symlinks($1,$1_mozilla_t)
|
userdom_manage_user_home_content_symlinks($1, $1_mozilla_t)
|
||||||
userdom_manage_user_tmp_dirs($1,$1_mozilla_t)
|
userdom_manage_user_tmp_dirs($1, $1_mozilla_t)
|
||||||
userdom_manage_user_tmp_files($1,$1_mozilla_t)
|
userdom_manage_user_tmp_files($1, $1_mozilla_t)
|
||||||
userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
|
userdom_manage_user_tmp_sockets($1, $1_mozilla_t)
|
||||||
|
|
||||||
xserver_user_x_domain_template($1,$1_mozilla,$1_mozilla_t,$1_mozilla_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_mozilla, $1_mozilla_t, $1_mozilla_tmpfs_t)
|
||||||
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
|
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
|
||||||
xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t)
|
xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t)
|
||||||
|
|
||||||
@ -238,12 +238,12 @@ template(`mozilla_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`mozilla_read_content',`
|
tunable_policy(`mozilla_read_content',`
|
||||||
userdom_list_user_tmp($1,$1_mozilla_t)
|
userdom_list_user_tmp($1, $1_mozilla_t)
|
||||||
userdom_read_user_tmp_files($1,$1_mozilla_t)
|
userdom_read_user_tmp_files($1, $1_mozilla_t)
|
||||||
userdom_read_user_tmp_symlinks($1,$1_mozilla_t)
|
userdom_read_user_tmp_symlinks($1, $1_mozilla_t)
|
||||||
userdom_search_user_home_dirs($1,$1_mozilla_t)
|
userdom_search_user_home_dirs($1, $1_mozilla_t)
|
||||||
userdom_read_user_home_content_files($1,$1_mozilla_t)
|
userdom_read_user_home_content_files($1, $1_mozilla_t)
|
||||||
userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
|
userdom_read_user_home_content_symlinks($1, $1_mozilla_t)
|
||||||
|
|
||||||
ifdef(`enable_mls',`',`
|
ifdef(`enable_mls',`',`
|
||||||
fs_search_removable($1_mozilla_t)
|
fs_search_removable($1_mozilla_t)
|
||||||
@ -255,10 +255,10 @@ template(`mozilla_per_role_template',`
|
|||||||
files_dontaudit_list_home($1_mozilla_t)
|
files_dontaudit_list_home($1_mozilla_t)
|
||||||
fs_dontaudit_list_removable($1_mozilla_t)
|
fs_dontaudit_list_removable($1_mozilla_t)
|
||||||
fs_dontaudit_read_removable_files($1_mozilla_t)
|
fs_dontaudit_read_removable_files($1_mozilla_t)
|
||||||
userdom_dontaudit_list_user_tmp($1,$1_mozilla_t)
|
userdom_dontaudit_list_user_tmp($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_read_user_tmp_files($1,$1_mozilla_t)
|
userdom_dontaudit_read_user_tmp_files($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_mozilla_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_mozilla_t)
|
userdom_dontaudit_read_user_home_content_files($1, $1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`mozilla_read_content && read_default_t',`
|
tunable_policy(`mozilla_read_content && read_default_t',`
|
||||||
@ -273,22 +273,22 @@ template(`mozilla_per_role_template',`
|
|||||||
tunable_policy(`mozilla_read_content && read_untrusted_content',`
|
tunable_policy(`mozilla_read_content && read_untrusted_content',`
|
||||||
files_list_tmp($1_mozilla_t)
|
files_list_tmp($1_mozilla_t)
|
||||||
files_list_home($1_mozilla_t)
|
files_list_home($1_mozilla_t)
|
||||||
userdom_search_user_home_dirs($1,$1_mozilla_t)
|
userdom_search_user_home_dirs($1, $1_mozilla_t)
|
||||||
|
|
||||||
userdom_list_user_untrusted_content($1,$1_mozilla_t)
|
userdom_list_user_untrusted_content($1, $1_mozilla_t)
|
||||||
userdom_read_user_untrusted_content_files($1,$1_mozilla_t)
|
userdom_read_user_untrusted_content_files($1, $1_mozilla_t)
|
||||||
userdom_read_user_untrusted_content_symlinks($1,$1_mozilla_t)
|
userdom_read_user_untrusted_content_symlinks($1, $1_mozilla_t)
|
||||||
userdom_list_user_tmp_untrusted_content($1,$1_mozilla_t)
|
userdom_list_user_tmp_untrusted_content($1, $1_mozilla_t)
|
||||||
userdom_read_user_tmp_untrusted_content_files($1,$1_mozilla_t)
|
userdom_read_user_tmp_untrusted_content_files($1, $1_mozilla_t)
|
||||||
userdom_read_user_tmp_untrusted_content_symlinks($1,$1_mozilla_t)
|
userdom_read_user_tmp_untrusted_content_symlinks($1, $1_mozilla_t)
|
||||||
',`
|
',`
|
||||||
files_dontaudit_list_tmp($1_mozilla_t)
|
files_dontaudit_list_tmp($1_mozilla_t)
|
||||||
files_dontaudit_list_home($1_mozilla_t)
|
files_dontaudit_list_home($1_mozilla_t)
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_mozilla_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_list_user_untrusted_content($1,$1_mozilla_t)
|
userdom_dontaudit_list_user_untrusted_content($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_read_user_untrusted_content_files($1,$1_mozilla_t)
|
userdom_dontaudit_read_user_untrusted_content_files($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_list_user_tmp_untrusted_content($1,$1_mozilla_t)
|
userdom_dontaudit_list_user_tmp_untrusted_content($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_mozilla_t)
|
userdom_dontaudit_read_user_tmp_untrusted_content_files($1, $1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
# Save web pages
|
# Save web pages
|
||||||
@ -321,26 +321,26 @@ template(`mozilla_per_role_template',`
|
|||||||
tunable_policy(`write_untrusted_content',`
|
tunable_policy(`write_untrusted_content',`
|
||||||
files_search_home($1_mozilla_t)
|
files_search_home($1_mozilla_t)
|
||||||
userdom_manage_user_untrusted_content_tmp_files($1, $1_mozilla_t)
|
userdom_manage_user_untrusted_content_tmp_files($1, $1_mozilla_t)
|
||||||
files_tmp_filetrans($1_mozilla_t,$1_untrusted_content_tmp_t,file)
|
files_tmp_filetrans($1_mozilla_t, $1_untrusted_content_tmp_t, file)
|
||||||
files_tmp_filetrans($1_mozilla_t,$1_untrusted_content_tmp_t,dir)
|
files_tmp_filetrans($1_mozilla_t, $1_untrusted_content_tmp_t, dir)
|
||||||
|
|
||||||
userdom_manage_user_untrusted_content_files($1,$1_mozilla_t)
|
userdom_manage_user_untrusted_content_files($1, $1_mozilla_t)
|
||||||
userdom_user_home_dir_filetrans($1,$1_mozilla_t,$1_untrusted_content_tmp_t, { file dir })
|
userdom_user_home_dir_filetrans($1, $1_mozilla_t, $1_untrusted_content_tmp_t, { file dir })
|
||||||
userdom_user_home_content_filetrans($1,$1_mozilla_t,$1_untrusted_content_tmp_t, { file dir })
|
userdom_user_home_content_filetrans($1, $1_mozilla_t, $1_untrusted_content_tmp_t, { file dir })
|
||||||
',`
|
',`
|
||||||
files_dontaudit_list_home($1_mozilla_t)
|
files_dontaudit_list_home($1_mozilla_t)
|
||||||
files_dontaudit_list_tmp($1_mozilla_t)
|
files_dontaudit_list_tmp($1_mozilla_t)
|
||||||
|
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_mozilla_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_manage_user_tmp_dirs($1,$1_mozilla_t)
|
userdom_dontaudit_manage_user_tmp_dirs($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_manage_user_tmp_files($1,$1_mozilla_t)
|
userdom_dontaudit_manage_user_tmp_files($1, $1_mozilla_t)
|
||||||
userdom_dontaudit_manage_user_home_content_dirs($1,$1_mozilla_t)
|
userdom_dontaudit_manage_user_home_content_dirs($1, $1_mozilla_t)
|
||||||
|
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
apache_read_user_scripts($1,$1_mozilla_t)
|
apache_read_user_scripts($1, $1_mozilla_t)
|
||||||
apache_read_user_content($1,$1_mozilla_t)
|
apache_read_user_content($1, $1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -353,12 +353,12 @@ template(`mozilla_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
dbus_system_bus_client_template($1_mozilla,$1_mozilla_t)
|
dbus_system_bus_client_template($1_mozilla, $1_mozilla_t)
|
||||||
dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
|
dbus_user_bus_client_template($1, $1_mozilla, $1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
gnome_stream_connect_gconf_template($1,$1_mozilla_t)
|
gnome_stream_connect_gconf_template($1, $1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -366,7 +366,7 @@ template(`mozilla_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
lpd_domtrans_user_lpr($1,$1_mozilla_t)
|
lpd_domtrans_user_lpr($1, $1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -501,7 +501,7 @@ template(`mozilla_domtrans_user_mozilla',`
|
|||||||
type $1_mozilla_t, mozilla_exec_t;
|
type $1_mozilla_t, mozilla_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($2, mozilla_exec_t,$1_mozilla_t)
|
domtrans_pattern($2, mozilla_exec_t, $1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(mozilla,1.6.0)
|
policy_module(mozilla, 1.6.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -11,7 +11,7 @@ policy_module(mozilla,1.6.0)
|
|||||||
## Control mozilla content access
|
## Control mozilla content access
|
||||||
## </p>
|
## </p>
|
||||||
## </desc>
|
## </desc>
|
||||||
gen_tunable(mozilla_read_content,false)
|
gen_tunable(mozilla_read_content, false)
|
||||||
|
|
||||||
type mozilla_conf_t;
|
type mozilla_conf_t;
|
||||||
files_config_file(mozilla_conf_t)
|
files_config_file(mozilla_conf_t)
|
||||||
|
@ -43,11 +43,11 @@ template(`mplayer_per_role_template',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
type $1_mencoder_t;
|
type $1_mencoder_t;
|
||||||
application_domain($1_mencoder_t,mencoder_exec_t)
|
application_domain($1_mencoder_t, mencoder_exec_t)
|
||||||
role $3 types $1_mencoder_t;
|
role $3 types $1_mencoder_t;
|
||||||
|
|
||||||
type $1_mplayer_t;
|
type $1_mplayer_t;
|
||||||
application_domain($1_mplayer_t,mplayer_exec_t)
|
application_domain($1_mplayer_t, mplayer_exec_t)
|
||||||
role $3 types $1_mplayer_t;
|
role $3 types $1_mplayer_t;
|
||||||
|
|
||||||
type $1_mplayer_home_t alias $1_mplayer_rw_t;
|
type $1_mplayer_home_t alias $1_mplayer_rw_t;
|
||||||
@ -62,14 +62,14 @@ template(`mplayer_per_role_template',`
|
|||||||
# mencoder local policy
|
# mencoder local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
manage_dirs_pattern($1_mencoder_t,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_dirs_pattern($1_mencoder_t, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
manage_files_pattern($1_mencoder_t,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_files_pattern($1_mencoder_t, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
manage_lnk_files_pattern($1_mencoder_t,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_lnk_files_pattern($1_mencoder_t, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
|
|
||||||
# Read global config
|
# Read global config
|
||||||
allow $1_mencoder_t mplayer_etc_t:dir list_dir_perms;
|
allow $1_mencoder_t mplayer_etc_t:dir list_dir_perms;
|
||||||
read_files_pattern($1_mencoder_t,mplayer_etc_t,mplayer_etc_t)
|
read_files_pattern($1_mencoder_t, mplayer_etc_t, mplayer_etc_t)
|
||||||
read_lnk_files_pattern($1_mencoder_t,mplayer_etc_t,mplayer_etc_t)
|
read_lnk_files_pattern($1_mencoder_t, mplayer_etc_t, mplayer_etc_t)
|
||||||
|
|
||||||
# domain transition
|
# domain transition
|
||||||
domtrans_pattern($2, mencoder_exec_t, $1_mencoder_t)
|
domtrans_pattern($2, mencoder_exec_t, $1_mencoder_t)
|
||||||
@ -183,20 +183,20 @@ template(`mplayer_per_role_template',`
|
|||||||
files_list_tmp($1_mencoder_t)
|
files_list_tmp($1_mencoder_t)
|
||||||
files_list_home($1_mencoder_t)
|
files_list_home($1_mencoder_t)
|
||||||
|
|
||||||
userdom_list_user_untrusted_content($1,$1_mencoder_t)
|
userdom_list_user_untrusted_content($1, $1_mencoder_t)
|
||||||
userdom_read_user_untrusted_content_files($1,$1_mencoder_t)
|
userdom_read_user_untrusted_content_files($1, $1_mencoder_t)
|
||||||
userdom_read_user_untrusted_content_symlinks($1,$1_mencoder_t)
|
userdom_read_user_untrusted_content_symlinks($1, $1_mencoder_t)
|
||||||
userdom_list_user_tmp_untrusted_content($1,$1_mencoder_t)
|
userdom_list_user_tmp_untrusted_content($1, $1_mencoder_t)
|
||||||
userdom_read_user_tmp_untrusted_content_files($1,$1_mencoder_t)
|
userdom_read_user_tmp_untrusted_content_files($1, $1_mencoder_t)
|
||||||
userdom_read_user_tmp_untrusted_content_symlinks($1,$1_mencoder_t)
|
userdom_read_user_tmp_untrusted_content_symlinks($1, $1_mencoder_t)
|
||||||
',`
|
',`
|
||||||
files_dontaudit_list_tmp($1_mencoder_t)
|
files_dontaudit_list_tmp($1_mencoder_t)
|
||||||
files_dontaudit_list_home($1_mencoder_t)
|
files_dontaudit_list_home($1_mencoder_t)
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_mencoder_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_mencoder_t)
|
||||||
userdom_dontaudit_list_user_untrusted_content($1,$1_mencoder_t)
|
userdom_dontaudit_list_user_untrusted_content($1, $1_mencoder_t)
|
||||||
userdom_dontaudit_read_user_untrusted_content_files($1,$1_mencoder_t)
|
userdom_dontaudit_read_user_untrusted_content_files($1, $1_mencoder_t)
|
||||||
userdom_dontaudit_list_user_tmp_untrusted_content($1,$1_mencoder_t)
|
userdom_dontaudit_list_user_tmp_untrusted_content($1, $1_mencoder_t)
|
||||||
userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_mencoder_t)
|
userdom_dontaudit_read_user_tmp_untrusted_content_files($1, $1_mencoder_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`write_untrusted_content',`
|
tunable_policy(`write_untrusted_content',`
|
||||||
@ -232,18 +232,18 @@ template(`mplayer_per_role_template',`
|
|||||||
|
|
||||||
tunable_policy(`write_untrusted_content',`
|
tunable_policy(`write_untrusted_content',`
|
||||||
files_search_home($1_mencoder_t)
|
files_search_home($1_mencoder_t)
|
||||||
files_tmp_filetrans($1_mencoder_t,$1_untrusted_content_tmp_t,file)
|
files_tmp_filetrans($1_mencoder_t, $1_untrusted_content_tmp_t, file)
|
||||||
files_tmp_filetrans($1_mencoder_t,$1_untrusted_content_tmp_t,dir)
|
files_tmp_filetrans($1_mencoder_t, $1_untrusted_content_tmp_t ,dir)
|
||||||
|
|
||||||
userdom_manage_user_untrusted_content_dirs($1,$1_mencoder_t)
|
userdom_manage_user_untrusted_content_dirs($1, $1_mencoder_t)
|
||||||
userdom_manage_user_untrusted_content_files($1,$1_mencoder_t)
|
userdom_manage_user_untrusted_content_files($1, $1_mencoder_t)
|
||||||
',`
|
',`
|
||||||
files_dontaudit_list_home($1_mencoder_t)
|
files_dontaudit_list_home($1_mencoder_t)
|
||||||
files_dontaudit_list_tmp($1_mencoder_t)
|
files_dontaudit_list_tmp($1_mencoder_t)
|
||||||
|
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_mencoder_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_mencoder_t)
|
||||||
userdom_dontaudit_manage_user_tmp_files($1,$1_mencoder_t)
|
userdom_dontaudit_manage_user_tmp_files($1, $1_mencoder_t)
|
||||||
userdom_dontaudit_manage_user_home_content_dirs($1,$1_mencoder_t)
|
userdom_dontaudit_manage_user_home_content_dirs($1, $1_mencoder_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -255,29 +255,29 @@ template(`mplayer_per_role_template',`
|
|||||||
allow $1_mplayer_t self:fifo_file rw_fifo_file_perms;
|
allow $1_mplayer_t self:fifo_file rw_fifo_file_perms;
|
||||||
allow $1_mplayer_t self:sem create_sem_perms;
|
allow $1_mplayer_t self:sem create_sem_perms;
|
||||||
|
|
||||||
manage_dirs_pattern($1_mplayer_t,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_dirs_pattern($1_mplayer_t, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
manage_files_pattern($1_mplayer_t,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_files_pattern($1_mplayer_t, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
manage_lnk_files_pattern($1_mplayer_t,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_lnk_files_pattern($1_mplayer_t, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
userdom_search_user_home_dirs($1,$1_mplayer_t)
|
userdom_search_user_home_dirs($1, $1_mplayer_t)
|
||||||
|
|
||||||
manage_files_pattern($1_mplayer_t,$1_mplayer_tmpfs_t,$1_mplayer_tmpfs_t)
|
manage_files_pattern($1_mplayer_t, $1_mplayer_tmpfs_t, $1_mplayer_tmpfs_t)
|
||||||
manage_lnk_files_pattern($1_mplayer_t,$1_mplayer_tmpfs_t,$1_mplayer_tmpfs_t)
|
manage_lnk_files_pattern($1_mplayer_t, $1_mplayer_tmpfs_t, $1_mplayer_tmpfs_t)
|
||||||
manage_fifo_files_pattern($1_mplayer_t,$1_mplayer_tmpfs_t,$1_mplayer_tmpfs_t)
|
manage_fifo_files_pattern($1_mplayer_t, $1_mplayer_tmpfs_t, $1_mplayer_tmpfs_t)
|
||||||
manage_sock_files_pattern($1_mplayer_t,$1_mplayer_tmpfs_t,$1_mplayer_tmpfs_t)
|
manage_sock_files_pattern($1_mplayer_t, $1_mplayer_tmpfs_t, $1_mplayer_tmpfs_t)
|
||||||
fs_tmpfs_filetrans($1_mplayer_t,$1_mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_mplayer_t, $1_mplayer_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
||||||
|
|
||||||
# Read global config
|
# Read global config
|
||||||
allow $1_mplayer_t mplayer_etc_t:dir list_dir_perms;
|
allow $1_mplayer_t mplayer_etc_t:dir list_dir_perms;
|
||||||
read_files_pattern($1_mplayer_t,mplayer_etc_t,mplayer_etc_t)
|
read_files_pattern($1_mplayer_t, mplayer_etc_t, mplayer_etc_t)
|
||||||
read_lnk_files_pattern($1_mplayer_t,mplayer_etc_t,mplayer_etc_t)
|
read_lnk_files_pattern($1_mplayer_t, mplayer_etc_t, mplayer_etc_t)
|
||||||
|
|
||||||
# Home access
|
# Home access
|
||||||
manage_dirs_pattern($2,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_dirs_pattern($2, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
manage_files_pattern($2,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_files_pattern($2, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
manage_lnk_files_pattern($2,$1_mplayer_home_t,$1_mplayer_home_t)
|
manage_lnk_files_pattern($2, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
relabel_dirs_pattern($2,$1_mplayer_home_t,$1_mplayer_home_t)
|
relabel_dirs_pattern($2, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
relabel_files_pattern($2,$1_mplayer_home_t,$1_mplayer_home_t)
|
relabel_files_pattern($2, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
relabel_lnk_files_pattern($2,$1_mplayer_home_t,$1_mplayer_home_t)
|
relabel_lnk_files_pattern($2, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
|
|
||||||
# domain transition
|
# domain transition
|
||||||
domtrans_pattern($2, mplayer_exec_t, $1_mplayer_t)
|
domtrans_pattern($2, mplayer_exec_t, $1_mplayer_t)
|
||||||
@ -333,15 +333,15 @@ template(`mplayer_per_role_template',`
|
|||||||
miscfiles_read_localization($1_mplayer_t)
|
miscfiles_read_localization($1_mplayer_t)
|
||||||
miscfiles_read_fonts($1_mplayer_t)
|
miscfiles_read_fonts($1_mplayer_t)
|
||||||
|
|
||||||
userdom_use_user_terminals($1,$1_mplayer_t)
|
userdom_use_user_terminals($1, $1_mplayer_t)
|
||||||
# Read media files
|
# Read media files
|
||||||
userdom_list_user_tmp($1,$1_mplayer_t)
|
userdom_list_user_tmp($1, $1_mplayer_t)
|
||||||
userdom_read_user_tmp_files($1,$1_mplayer_t)
|
userdom_read_user_tmp_files($1, $1_mplayer_t)
|
||||||
userdom_read_user_tmp_symlinks($1,$1_mplayer_t)
|
userdom_read_user_tmp_symlinks($1, $1_mplayer_t)
|
||||||
userdom_read_user_home_content_files($1,$1_mplayer_t)
|
userdom_read_user_home_content_files($1, $1_mplayer_t)
|
||||||
userdom_read_user_home_content_symlinks($1,$1_mplayer_t)
|
userdom_read_user_home_content_symlinks($1, $1_mplayer_t)
|
||||||
|
|
||||||
xserver_user_x_domain_template($1,$1_mplayer,$1_mplayer_t,$1_mplayer_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_mplayer, $1_mplayer_t, $1_mplayer_tmpfs_t)
|
||||||
|
|
||||||
# Read songs
|
# Read songs
|
||||||
ifdef(`enable_mls',`',`
|
ifdef(`enable_mls',`',`
|
||||||
@ -417,20 +417,20 @@ template(`mplayer_per_role_template',`
|
|||||||
files_list_tmp($1_mplayer_t)
|
files_list_tmp($1_mplayer_t)
|
||||||
files_list_home($1_mplayer_t)
|
files_list_home($1_mplayer_t)
|
||||||
|
|
||||||
userdom_list_user_untrusted_content($1,$1_mplayer_t)
|
userdom_list_user_untrusted_content($1, $1_mplayer_t)
|
||||||
userdom_read_user_untrusted_content_files($1,$1_mplayer_t)
|
userdom_read_user_untrusted_content_files($1, $1_mplayer_t)
|
||||||
userdom_read_user_untrusted_content_symlinks($1,$1_mplayer_t)
|
userdom_read_user_untrusted_content_symlinks($1, $1_mplayer_t)
|
||||||
userdom_list_user_tmp_untrusted_content($1,$1_mplayer_t)
|
userdom_list_user_tmp_untrusted_content($1, $1_mplayer_t)
|
||||||
userdom_read_user_tmp_untrusted_content_files($1,$1_mplayer_t)
|
userdom_read_user_tmp_untrusted_content_files($1, $1_mplayer_t)
|
||||||
userdom_read_user_tmp_untrusted_content_symlinks($1,$1_mplayer_t)
|
userdom_read_user_tmp_untrusted_content_symlinks($1, $1_mplayer_t)
|
||||||
',`
|
',`
|
||||||
files_dontaudit_list_tmp($1_mplayer_t)
|
files_dontaudit_list_tmp($1_mplayer_t)
|
||||||
files_dontaudit_list_home($1_mplayer_t)
|
files_dontaudit_list_home($1_mplayer_t)
|
||||||
userdom_dontaudit_list_user_home_dirs($1,$1_mplayer_t)
|
userdom_dontaudit_list_user_home_dirs($1, $1_mplayer_t)
|
||||||
userdom_dontaudit_list_user_untrusted_content($1,$1_mplayer_t)
|
userdom_dontaudit_list_user_untrusted_content($1, $1_mplayer_t)
|
||||||
userdom_dontaudit_read_user_untrusted_content_files($1,$1_mplayer_t)
|
userdom_dontaudit_read_user_untrusted_content_files($1, $1_mplayer_t)
|
||||||
userdom_dontaudit_list_user_tmp_untrusted_content($1,$1_mplayer_t)
|
userdom_dontaudit_list_user_tmp_untrusted_content($1, $1_mplayer_t)
|
||||||
userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_mplayer_t)
|
userdom_dontaudit_read_user_tmp_untrusted_content_files($1, $1_mplayer_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -472,7 +472,7 @@ template(`mplayer_domtrans_user_mplayer',`
|
|||||||
type $1_mplayer_t, mplayer_exec_t;
|
type $1_mplayer_t, mplayer_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
domtrans_pattern($2, mplayer_exec_t,$1_mplayer_t)
|
domtrans_pattern($2, mplayer_exec_t, $1_mplayer_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -505,5 +505,5 @@ template(`mplayer_read_user_home_files',`
|
|||||||
type $1_mplayer_home_t;
|
type $1_mplayer_home_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
read_files_pattern($2,$1_mplayer_home_t,$1_mplayer_home_t)
|
read_files_pattern($2, $1_mplayer_home_t, $1_mplayer_home_t)
|
||||||
')
|
')
|
||||||
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user