rpms/selinux-policy
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Whitespace, newline and tab fixes.

Browse Source 
Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.
This commit is contained in:
Dominick Grift 2010-09-17 11:46:20 +02:00
parent 3c484f5bdc
commit 4b1644f447
11 changed files with 81 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

84
policy/modules/services/apache.if
View File

@ -312,21 +312,21 @@ interface(`apache_domtrans',`
###################################### ######################################
## <summary> ## <summary>
## Allow the specified domain to execute apache ## Allow the specified domain to execute apache
## in the caller domain. ## in the caller domain.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`apache_exec',` interface(`apache_exec',`
gen_require(` gen_require(`
type httpd_exec_t; type httpd_exec_t;
') ')
can_exec($1, httpd_exec_t) can_exec($1, httpd_exec_t)
') ')
####################################### #######################################
@ -901,45 +901,45 @@ interface(`apache_manage_sys_content',`
###################################### ######################################
## <summary> ## <summary>
## Allow the specified domain to read ## Allow the specified domain to read
## apache system content rw files. ## apache system content rw files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
## <rolecap/> ## <rolecap/>
# #
interface(`apache_read_sys_content_rw_files',` interface(`apache_read_sys_content_rw_files',`
gen_require(` gen_require(`
type httpd_sys_rw_content_t; type httpd_sys_rw_content_t;
') ')
read_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) read_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
') ')
###################################### ######################################
## <summary> ## <summary>
## Allow the specified domain to manage ## Allow the specified domain to manage
## apache system content rw files. ## apache system content rw files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
## <rolecap/> ## <rolecap/>
# #
interface(`apache_manage_sys_content_rw',` interface(`apache_manage_sys_content_rw',`
gen_require(` gen_require(`
type httpd_sys_rw_content_t; type httpd_sys_rw_content_t;
') ')
files_search_var($1) files_search_var($1)
manage_dirs_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) manage_dirs_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
manage_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) manage_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
manage_lnk_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) manage_lnk_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
') ')
######################################## ########################################
@ -1219,21 +1219,21 @@ interface(`apache_read_tmp_files',`
###################################### ######################################
## <summary> ## <summary>
## Dontaudit attempts to read and write ## Dontaudit attempts to read and write
## apache tmp files. ## apache tmp files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain to not audit. ## Domain to not audit.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`apache_dontaudit_rw_tmp_files',` interface(`apache_dontaudit_rw_tmp_files',`
gen_require(` gen_require(`
type httpd_tmp_t; type httpd_tmp_t;
') ')
dontaudit $1 httpd_tmp_t:file { read write }; dontaudit $1 httpd_tmp_t:file { read write };
') ')
######################################## ########################################
@ -1361,12 +1361,12 @@ interface(`apache_admin',`
admin_pattern($1, httpd_php_tmp_t) admin_pattern($1, httpd_php_tmp_t)
admin_pattern($1, httpd_suexec_tmp_t) admin_pattern($1, httpd_suexec_tmp_t)
ifdef(`TODO',` ifdef(`TODO',`
apache_set_booleans($1, $2, $3, httpd_bool_t ) apache_set_booleans($1, $2, $3, httpd_bool_t)
seutil_setsebool_role_template($1, $3, $2) seutil_setsebool_role_template($1, $3, $2)
allow httpd_setsebool_t httpd_bool_t:dir list_dir_perms; allow httpd_setsebool_t httpd_bool_t:dir list_dir_perms;
allow httpd_setsebool_t httpd_bool_t:file rw_file_perms; allow httpd_setsebool_t httpd_bool_t:file rw_file_perms;
') ')
') ')
######################################## ########################################
@ -1385,7 +1385,7 @@ interface(`apache_dontaudit_leaks',`
') ')
dontaudit $1 httpd_t:fifo_file rw_inherited_fifo_file_perms; dontaudit $1 httpd_t:fifo_file rw_inherited_fifo_file_perms;
dontaudit $1 httpd_t:tcp_socket { read write }; dontaudit $1 httpd_t:tcp_socket { read write };
dontaudit $1 httpd_t:unix_dgram_socket { read write }; dontaudit $1 httpd_t:unix_dgram_socket { read write };
dontaudit $1 httpd_t:unix_stream_socket { read write }; dontaudit $1 httpd_t:unix_stream_socket { read write };
') ')

4
policy/modules/services/cyphesis.if
View File

@ -5,9 +5,9 @@
## Execute a domain transition to run cyphesis. ## Execute a domain transition to run cyphesis.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed to transition. ## Domain allowed to transition.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`cyphesis_domtrans',` interface(`cyphesis_domtrans',`

7
policy/modules/services/dbus.if
View File

@ -117,7 +117,7 @@ template(`dbus_role_template',`
dev_read_urand($1_dbusd_t) dev_read_urand($1_dbusd_t)
domain_use_interactive_fds($1_dbusd_t) domain_use_interactive_fds($1_dbusd_t)
domain_read_all_domains_state($1_dbusd_t) domain_read_all_domains_state($1_dbusd_t)
files_read_etc_files($1_dbusd_t) files_read_etc_files($1_dbusd_t)
@ -155,7 +155,7 @@ template(`dbus_role_template',`
userdom_manage_user_home_content_files($1_dbusd_t) userdom_manage_user_home_content_files($1_dbusd_t)
userdom_user_home_dir_filetrans_user_home_content($1_dbusd_t, { dir file }) userdom_user_home_dir_filetrans_user_home_content($1_dbusd_t, { dir file })
ifdef(`hide_broken_symptoms', ` ifdef(`hide_broken_symptoms',`
dontaudit $3 $1_dbusd_t:netlink_selinux_socket { read write }; dontaudit $3 $1_dbusd_t:netlink_selinux_socket { read write };
') ')
@ -462,7 +462,7 @@ interface(`dbus_system_domain',`
unconfined_dbus_send($1) unconfined_dbus_send($1)
') ')
ifdef(`hide_broken_symptoms', ` ifdef(`hide_broken_symptoms',`
dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write }; dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
') ')
') ')
@ -522,4 +522,3 @@ interface(`dbus_delete_pid_files',`
files_search_pids($1) files_search_pids($1)
delete_files_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t) delete_files_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t)
') ')

10
policy/modules/services/denyhosts.if
View File

@ -13,12 +13,12 @@
## Execute a domain transition to run denyhosts. ## Execute a domain transition to run denyhosts.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed to transition. ## Domain allowed to transition.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`denyhosts_domtrans', ` interface(`denyhosts_domtrans',`
gen_require(` gen_require(`
type denyhosts_t, denyhosts_exec_t; type denyhosts_t, denyhosts_exec_t;
') ')
@ -36,7 +36,7 @@ interface(`denyhosts_domtrans', `
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`denyhosts_initrc_domtrans', ` interface(`denyhosts_initrc_domtrans',`
gen_require(` gen_require(`
type denyhosts_initrc_exec_t; type denyhosts_initrc_exec_t;
') ')
@ -61,7 +61,7 @@ interface(`denyhosts_initrc_domtrans', `
## </param> ## </param>
## <rolecap/> ## <rolecap/>
# #
interface(`denyhosts_admin', ` interface(`denyhosts_admin',`
gen_require(` gen_require(`
type denyhosts_t, denyhosts_var_lib_t, denyhosts_var_lock_t; type denyhosts_t, denyhosts_var_lib_t, denyhosts_var_lock_t;
type denyhosts_var_log_t, denyhosts_initrc_exec_t; type denyhosts_var_log_t, denyhosts_initrc_exec_t;

4
policy/modules/services/devicekit.if
View File

@ -5,9 +5,9 @@
## Execute a domain transition to run devicekit. ## Execute a domain transition to run devicekit.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed to transition. ## Domain allowed to transition.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`devicekit_domtrans',` interface(`devicekit_domtrans',`

8
policy/modules/services/dnsmasq.if
View File

@ -101,9 +101,9 @@ interface(`dnsmasq_kill',`
## Read dnsmasq config files. ## Read dnsmasq config files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`dnsmasq_read_config',` interface(`dnsmasq_read_config',`
@ -120,9 +120,9 @@ interface(`dnsmasq_read_config',`
## Write to dnsmasq config files. ## Write to dnsmasq config files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`dnsmasq_write_config',` interface(`dnsmasq_write_config',`

16
policy/modules/services/exim.if
View File

@ -5,9 +5,9 @@
## Execute a domain transition to run exim. ## Execute a domain transition to run exim.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed to transition. ## Domain allowed to transition.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`exim_domtrans',` interface(`exim_domtrans',`
@ -28,7 +28,7 @@ interface(`exim_domtrans',`
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`exim_initrc_domtrans', ` interface(`exim_initrc_domtrans',`
gen_require(` gen_require(`
type exim_initrc_exec_t; type exim_initrc_exec_t;
') ')
@ -119,9 +119,9 @@ interface(`exim_read_log',`
## exim log files. ## exim log files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`exim_append_log',` interface(`exim_append_log',`
@ -229,10 +229,10 @@ interface(`exim_manage_spool_files',`
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`exim_admin', ` interface(`exim_admin',`
gen_require(` gen_require(`
type exim_t, exim_initrc_exec_t, exim_log_t; type exim_t, exim_initrc_exec_t, exim_log_t;
type exim_tmp_t, exim_spool_t, exim_var_run_t; type exim_tmp_t, exim_spool_t, exim_var_run_t;
') ')
allow $1 exim_t:process { ptrace signal_perms }; allow $1 exim_t:process { ptrace signal_perms };

8
policy/modules/services/fail2ban.if
View File

@ -5,9 +5,9 @@
## Execute a domain transition to run fail2ban. ## Execute a domain transition to run fail2ban.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed to transition. ## Domain allowed to transition.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`fail2ban_domtrans',` interface(`fail2ban_domtrans',`
@ -102,9 +102,9 @@ interface(`fail2ban_read_log',`
## fail2ban log files. ## fail2ban log files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`fail2ban_append_log',` interface(`fail2ban_append_log',`

5
policy/modules/services/fprintd.if
View File

@ -5,9 +5,9 @@
## Execute a domain transition to run fprintd. ## Execute a domain transition to run fprintd.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## Domain allowed to transition. ## Domain allowed to transition.
## </summary> ## </summary>
## </param> ## </param>
# #
interface(`fprintd_domtrans',` interface(`fprintd_domtrans',`
@ -38,4 +38,3 @@ interface(`fprintd_dbus_chat',`
allow $1 fprintd_t:dbus send_msg; allow $1 fprintd_t:dbus send_msg;
allow fprintd_t $1:dbus send_msg; allow fprintd_t $1:dbus send_msg;
') ')

10
policy/modules/services/git.fc
View File

@ -1,10 +1,10 @@
HOME_DIR/public_git(/.*)? gen_context(system_u:object_r:git_session_content_t, s0) HOME_DIR/public_git(/.*)? gen_context(system_u:object_r:git_session_content_t,s0)
HOME_DIR/\.gitaliases -- gen_context(system_u:object_r:git_session_content_t, s0) HOME_DIR/\.gitaliases -- gen_context(system_u:object_r:git_session_content_t,s0)
HOME_DIR/\.gitconfig -- gen_context(system_u:object_r:git_session_content_t, s0) HOME_DIR/\.gitconfig -- gen_context(system_u:object_r:git_session_content_t,s0)
/srv/git(/.*)? gen_context(system_u:object_r:git_system_content_t, s0) /srv/git(/.*)? gen_context(system_u:object_r:git_system_content_t,s0)
/usr/libexec/git-core/git-daemon -- gen_context(system_u:object_r:gitd_exec_t, s0) /usr/libexec/git-core/git-daemon -- gen_context(system_u:object_r:gitd_exec_t,s0)
/var/cache/cgit(/.*)? gen_context(system_u:object_r:httpd_git_rw_content_t,s0) /var/cache/cgit(/.*)? gen_context(system_u:object_r:httpd_git_rw_content_t,s0)
/var/lib/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0) /var/lib/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0)

11
policy/modules/services/git.if
View File

@ -1,10 +1,10 @@
## <summary>Fast Version Control System.</summary> ## <summary>Fast Version Control System.</summary>
## <desc> ## <desc>
## <p> ## <p>
## A really simple TCP git daemon that normally listens on ## A really simple TCP git daemon that normally listens on
## port DEFAULT_GIT_PORT aka 9418. It waits for a ## port DEFAULT_GIT_PORT aka 9418. It waits for a
## connection asking for a service, and will serve that ## connection asking for a service, and will serve that
## service if it is enabled. ## service if it is enabled.
## </p> ## </p>
## </desc> ## </desc>
@ -58,7 +58,6 @@ interface(`git_session_role',`
## </param> ## </param>
# #
template(`git_content_template',` template(`git_content_template',`
gen_require(` gen_require(`
attribute git_system_content, git_content; attribute git_system_content, git_content;
') ')
@ -84,7 +83,6 @@ template(`git_content_template',`
## </param> ## </param>
# #
template(`git_role_template',` template(`git_role_template',`
gen_require(` gen_require(`
class context contains; class context contains;
role system_r; role system_r;
@ -520,4 +518,3 @@ interface(`git_relabel_session_content',`
relabel_files_pattern($1, git_session_content_t, git_session_content_t) relabel_files_pattern($1, git_session_content_t, git_session_content_t)
userdom_search_user_home_dirs($1) userdom_search_user_home_dirs($1)
') ')