rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

make transition on shell work

Browse Source
This commit is contained in:
Chris PeBenito 2005-05-23 15:48:45 +00:00
parent c4309768f1
commit 3000a31552
1 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
refpolicy/policy/modules/system/corecommands.if
View File

@ -1,4 +1,9 @@
# Copyright (C) 2005 Tresys Technology, LLC # Copyright (C) 2005 Tresys Technology, LLC
## <module name="corecommands" layer="system">
## <summary>
## Core policy for shells, and generic programs
## in /bin, /sbin, /usr/bin, and /usr/sbin.
## </summary>
####################################### #######################################
# #
@ -124,14 +129,27 @@ class file { getattr read execute execute_no_trans };
') ')
######################################## ########################################
# ## <interface name="corecommands_shell_transition">
# corecommands_shell_transition(domain) ## <description>
## Execute a shell in the target domain.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <parameter name="target_domain">
## The type of the shell process.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
# #
define(`corecommands_shell_transition',` define(`corecommands_shell_transition',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 bin_t:dir { getattr search read }; allow $1 bin_t:dir { getattr search read };
allow $1 bin_t:lnk_file { getattr read }; allow $1 bin_t:lnk_file { getattr read };
allow $1 shell_exec_t:file { getattr read execute }; allow $1 shell_exec_t:file { getattr read execute };
allow $1 $2:process transition;
type_transition $1 shell_exec_t:file $2;
dontaudit $1 $2:process { noatsecure siginh rlimitinh };
') ')
define(`corecommands_shell_transition_depend',` define(`corecommands_shell_transition_depend',`
@ -157,3 +175,5 @@ type chroot_exec_t;
class file { getattr read execute execute_no_trans }; class file { getattr read execute execute_no_trans };
class capability sys_chroot; class capability sys_chroot;
') ')
## </module>