rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

use role dominance in targeted for compatability with strict

Browse Source
This commit is contained in:
Chris PeBenito 2005-11-10 16:55:56 +00:00
parent 1904b01047
commit 37c85212a1
3 changed files with 8 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
refpolicy/policy/modules/system/unconfined.if
View File

@ -246,22 +246,6 @@ interface(`unconfined_dontaudit_rw_tcp_socket',`
dontaudit $1 unconfined_t:tcp_socket { read write }; dontaudit $1 unconfined_t:tcp_socket { read write };
') ')
########################################
## <summary>
## Add the unconfined domain to the specified role.
## </summary>
## <param name="domain">
## Domain allowed access.
## </param>
#
interface(`unconfined_role',`
gen_require(`
type unconfined_t;
')
role $1 types unconfined_t;
')
######################################## ########################################
## <summary> ## <summary>
## Add an alias type to the unconfined domain. ## Add an alias type to the unconfined domain.

8
refpolicy/policy/modules/system/unconfined.te
View File

@ -25,6 +25,12 @@ unconfined_domain_template(unconfined_t)
logging_send_syslog_msg(unconfined_t) logging_send_syslog_msg(unconfined_t)
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
# compatibility for switching from strict
dominance { role secadm_r { role system_r; }}
dominance { role sysadm_r { role system_r; }}
dominance { role user_r { role system_r; }}
dominance { role staff_r { role system_r; }}
allow unconfined_t self:system syslog_read; allow unconfined_t self:system syslog_read;
dontaudit unconfined_t self:capability sys_module; dontaudit unconfined_t self:capability sys_module;
@ -120,5 +126,7 @@ ifdef(`targeted_policy',`
') ')
') dnl end TODO ') dnl end TODO
# FIXME:
typeattribute unconfined_t direct_run_init; typeattribute unconfined_t direct_run_init;
') ')

3
refpolicy/policy/modules/system/userdomain.te
View File

@ -64,9 +64,6 @@ ifdef(`targeted_policy',`
files_associate_tmp(user_home_dir_t) files_associate_tmp(user_home_dir_t)
fs_associate_tmpfs(user_home_dir_t) fs_associate_tmpfs(user_home_dir_t)
unconfined_role(user_r)
unconfined_role(sysadm_r)
# dont need to use the full role_change() # dont need to use the full role_change()
allow sysadm_r system_r; allow sysadm_r system_r;
allow sysadm_r user_r; allow sysadm_r user_r;