rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

remove rules added to make sediff easier

Browse Source
This commit is contained in:
Chris PeBenito 2006-05-12 19:37:56 +00:00
parent e9a4084de1
commit 21d173a460
7 changed files with 5 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
refpolicy/policy/modules/services/apache.if
View File

@ -185,13 +185,6 @@ template(`apache_content_template',`
libs_read_lib_files(httpd_$1_script_t) libs_read_lib_files(httpd_$1_script_t)
miscfiles_read_localization(httpd_$1_script_t) miscfiles_read_localization(httpd_$1_script_t)
# added back to make sediff nicer
dev_rw_null(httpd_$1_script_t)
term_use_controlling_term(httpd_$1_script_t)
allow httpd_$1_script_t self:dir r_dir_perms;
allow httpd_$1_script_t self:file r_file_perms;
allow httpd_$1_script_t self:lnk_file read;
') ')
tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',` tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',`

8
refpolicy/policy/modules/services/apache.te
View File

@ -1,5 +1,5 @@
policy_module(apache,1.3.9) policy_module(apache,1.3.10)
# #
# NOTES: # NOTES:
@ -332,9 +332,6 @@ tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
allow httpd_t httpdcontent:dir create_dir_perms; allow httpd_t httpdcontent:dir create_dir_perms;
allow httpd_t httpdcontent:file create_file_perms; allow httpd_t httpdcontent:file create_file_perms;
allow httpd_t httpdcontent:lnk_file create_lnk_perms; allow httpd_t httpdcontent:lnk_file create_lnk_perms;
# make sediff easier
allow httpd_sys_script_t httpdcontent:file { rx_file_perms entrypoint };
') ')
tunable_policy(`httpd_enable_ftp_server',` tunable_policy(`httpd_enable_ftp_server',`
@ -591,9 +588,6 @@ tunable_policy(`httpd_enable_cgi',`
allow httpd_unconfined_script_t httpd_suexec_t:fd use; allow httpd_unconfined_script_t httpd_suexec_t:fd use;
allow httpd_unconfined_script_t httpd_suexec_t:fifo_file rw_file_perms; allow httpd_unconfined_script_t httpd_suexec_t:fifo_file rw_file_perms;
allow httpd_unconfined_script_t httpd_suexec_t:process sigchld; allow httpd_unconfined_script_t httpd_suexec_t:process sigchld;
# make sediff happy
allow httpd_unconfined_script_t httpd_unconfined_script_exec_t:file { ioctl read getattr lock execute entrypoint };
') ')
tunable_policy(`httpd_enable_cgi && httpd_unified',` tunable_policy(`httpd_enable_cgi && httpd_unified',`

6
refpolicy/policy/modules/services/inetd.if
View File

@ -59,9 +59,6 @@ interface(`inetd_core_service_domain',`
dontaudit inetd_t $1:process { noatsecure siginh rlimitinh }; dontaudit inetd_t $1:process { noatsecure siginh rlimitinh };
allow inetd_t $1:process sigkill; allow inetd_t $1:process sigkill;
# make sediff happy
allow $1 $2:file { rx_file_perms entrypoint };
} }
',` ',`
domain_auto_trans(inetd_t,$2,$1) domain_auto_trans(inetd_t,$2,$1)
@ -72,9 +69,6 @@ interface(`inetd_core_service_domain',`
dontaudit inetd_t $1:process { noatsecure siginh rlimitinh }; dontaudit inetd_t $1:process { noatsecure siginh rlimitinh };
allow inetd_t $1:process sigkill; allow inetd_t $1:process sigkill;
# make sediff happy
allow $1 $2:file { rx_file_perms entrypoint };
') ')
') ')

2
refpolicy/policy/modules/services/inetd.te
View File

@ -1,5 +1,5 @@
policy_module(inetd,1.1.0) policy_module(inetd,1.1.1)
######################################## ########################################
# #

6
refpolicy/policy/modules/system/init.if
View File

@ -93,9 +93,6 @@ interface(`init_daemon_domain',`
allow $1 initrc_t:fifo_file rw_file_perms; allow $1 initrc_t:fifo_file rw_file_perms;
allow $1 initrc_t:process sigchld; allow $1 initrc_t:process sigchld;
allow initrc_t $1:process { noatsecure siginh rlimitinh }; allow initrc_t $1:process { noatsecure siginh rlimitinh };
# make sediff happy
allow $1 $2:file { rx_file_perms entrypoint };
} }
',` ',`
domain_auto_trans(initrc_t,$2,$1) domain_auto_trans(initrc_t,$2,$1)
@ -104,9 +101,6 @@ interface(`init_daemon_domain',`
allow $1 initrc_t:fifo_file rw_file_perms; allow $1 initrc_t:fifo_file rw_file_perms;
allow $1 initrc_t:process sigchld; allow $1 initrc_t:process sigchld;
dontaudit initrc_t $1:process { noatsecure siginh rlimitinh }; dontaudit initrc_t $1:process { noatsecure siginh rlimitinh };
# make sediff happy
allow $1 $2:file { rx_file_perms entrypoint };
') ')
optional_policy(` optional_policy(`

2
refpolicy/policy/modules/system/init.te
View File

@ -1,5 +1,5 @@
policy_module(init,1.3.11) policy_module(init,1.3.12)
gen_require(` gen_require(`
class passwd rootok; class passwd rootok;

11
refpolicy/policy/modules/system/selinuxutil.te
View File

@ -1,5 +1,5 @@
policy_module(selinuxutil,1.2.5) policy_module(selinuxutil,1.2.6)
gen_require(` gen_require(`
bool secure_mode; bool secure_mode;
@ -306,14 +306,7 @@ userdom_use_unpriv_users_fds(newrole_t)
# for some PAM modules and for cwd # for some PAM modules and for cwd
userdom_dontaudit_search_all_users_home_content(newrole_t) userdom_dontaudit_search_all_users_home_content(newrole_t)
ifdef(`targeted_policy',` ifdef(`strict_policy',`
# newrole does not make any sense in
# the targeted policy. This is to
# make sediff easier.
if(!secure_mode) {
unconfined_domtrans(newrole_t)
}
',`
# if secure mode is enabled, then newrole # if secure mode is enabled, then newrole
# can only transition to unprivileged users # can only transition to unprivileged users
if(secure_mode) { if(secure_mode) {