diff --git a/policy/modules/services/plymouthd.if b/policy/modules/services/plymouthd.if index fecc0dc3..90b64479 100644 --- a/policy/modules/services/plymouthd.if +++ b/policy/modules/services/plymouthd.if @@ -5,12 +5,12 @@ ## Execute a domain transition to run plymouthd. ## ## -## +## ## Domain allowed to transition. -## +## ## # -interface(`plymouthd_domtrans', ` +interface(`plymouthd_domtrans',` gen_require(` type plymouthd_t, plymouthd_exec_t; ') @@ -23,12 +23,12 @@ interface(`plymouthd_domtrans', ` ## Execute the plymoth daemon in the current domain ## ## -## +## ## Domain allowed access. -## +## ## # -interface(`plymouthd_exec', ` +interface(`plymouthd_exec',` gen_require(` type plymouthd_exec_t; ') @@ -47,7 +47,7 @@ interface(`plymouthd_exec', ` ## ## # -interface(`plymouthd_stream_connect', ` +interface(`plymouthd_stream_connect',` gen_require(` type plymouthd_t; ') @@ -60,12 +60,12 @@ interface(`plymouthd_stream_connect', ` ## Execute the plymoth command in the current domain ## ## -## +## ## Domain allowed access. -## +## ## # -interface(`plymouthd_exec_plymouth', ` +interface(`plymouthd_exec_plymouth',` gen_require(` type plymouth_exec_t; ') @@ -78,12 +78,12 @@ interface(`plymouthd_exec_plymouth', ` ## Execute a domain transition to run plymouthd. ## ## -## +## ## Domain allowed to transition. -## +## ## # -interface(`plymouthd_domtrans_plymouth', ` +interface(`plymouthd_domtrans_plymouth',` gen_require(` type plymouth_t, plymouth_exec_t; ') @@ -101,7 +101,7 @@ interface(`plymouthd_domtrans_plymouth', ` ## ## # -interface(`plymouthd_search_spool', ` +interface(`plymouthd_search_spool',` gen_require(` type plymouthd_spool_t; ') @@ -120,7 +120,7 @@ interface(`plymouthd_search_spool', ` ## ## # -interface(`plymouthd_read_spool_files', ` +interface(`plymouthd_read_spool_files',` gen_require(` type plymouthd_spool_t; ') @@ -140,7 +140,7 @@ interface(`plymouthd_read_spool_files', ` ## ## # -interface(`plymouthd_manage_spool_files', ` +interface(`plymouthd_manage_spool_files',` gen_require(` type plymouthd_spool_t; ') @@ -159,7 +159,7 @@ interface(`plymouthd_manage_spool_files', ` ## ## # -interface(`plymouthd_search_lib', ` +interface(`plymouthd_search_lib',` gen_require(` type plymouthd_var_lib_t; ') @@ -178,7 +178,7 @@ interface(`plymouthd_search_lib', ` ## ## # -interface(`plymouthd_read_lib_files', ` +interface(`plymouthd_read_lib_files',` gen_require(` type plymouthd_var_lib_t; ') @@ -198,7 +198,7 @@ interface(`plymouthd_read_lib_files', ` ## ## # -interface(`plymouthd_manage_lib_files', ` +interface(`plymouthd_manage_lib_files',` gen_require(` type plymouthd_var_lib_t; ') @@ -217,7 +217,7 @@ interface(`plymouthd_manage_lib_files', ` ## ## # -interface(`plymouthd_read_pid_files', ` +interface(`plymouthd_read_pid_files',` gen_require(` type plymouthd_var_run_t; ') @@ -243,7 +243,7 @@ interface(`plymouthd_read_pid_files', ` ## ## # -interface(`plymouthd_admin', ` +interface(`plymouthd_admin',` gen_require(` type plymouthd_t, plymouthd_spool_t, plymouthd_var_lib_t; type plymouthd_var_run_t; diff --git a/policy/modules/services/policykit.if b/policy/modules/services/policykit.if index 29c99068..c5d6c1bb 100644 --- a/policy/modules/services/policykit.if +++ b/policy/modules/services/policykit.if @@ -51,9 +51,9 @@ interface(`policykit_dbus_chat_auth',` ## Execute a domain transition to run polkit_auth. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`policykit_domtrans_auth',` @@ -97,9 +97,9 @@ interface(`policykit_run_auth',` ## Execute a domain transition to run polkit_grant. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`policykit_domtrans_grant',` @@ -183,9 +183,9 @@ interface(`policykit_rw_reload',` ## Execute a domain transition to run polkit_resolve. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`policykit_domtrans_resolve',` @@ -261,14 +261,15 @@ template(`policykit_role',` policykit_read_reload($2) policykit_dbus_chat($2) ') + ######################################## ## ## Send generic signal to policy_auth ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`policykit_signal_auth',` diff --git a/policy/modules/services/portreserve.if b/policy/modules/services/portreserve.if index 7f6e277f..44168663 100644 --- a/policy/modules/services/portreserve.if +++ b/policy/modules/services/portreserve.if @@ -28,7 +28,7 @@ interface(`portreserve_domtrans',` ## ## # -interface(`portreserve_initrc_domtrans', ` +interface(`portreserve_initrc_domtrans',` gen_require(` type portreserve_initrc_exec_t; ') @@ -99,7 +99,7 @@ interface(`portreserve_manage_config',` ## ## # -interface(`portreserve_admin', ` +interface(`portreserve_admin',` gen_require(` type portreserve_t, portreserve_etc_t, portreserve_var_run_t; type portreserve_initrc_exec_t; @@ -107,7 +107,7 @@ interface(`portreserve_admin', ` allow $1 portreserve_t:process { ptrace signal_perms }; ps_process_pattern($1, portreserve_t) - + portreserve_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 portreserve_initrc_exec_t system_r; diff --git a/policy/modules/services/postfix.if b/policy/modules/services/postfix.if index b220a9c5..3691cf85 100644 --- a/policy/modules/services/postfix.if +++ b/policy/modules/services/postfix.if @@ -678,11 +678,11 @@ interface(`postfix_domtrans_user_mail_handler',` ## ## # -interface(`postfix_admin', ` +interface(`postfix_admin',` gen_require(` attribute postfix_spool_type; - type postfix_bounce_t, postfix_cleanup_t, postfix_local_t; - type postfix_master_t, postfix_pickup_t, postfix_qmgr_t; + type postfix_bounce_t, postfix_cleanup_t, postfix_local_t; + type postfix_master_t, postfix_pickup_t, postfix_qmgr_t; type postfix_initrc_exec_t, postfix_data_t, postfix_etc_t; type postfix_map_tmp_t, postfix_prng_t, postfix_public_t; type postfix_smtpd_t, postfix_var_run_t; @@ -711,7 +711,7 @@ interface(`postfix_admin', ` postfix_run_map($1,$2) postfix_run_postdrop($1,$2) - + postfix_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 postfix_initrc_exec_t system_r; @@ -723,7 +723,7 @@ interface(`postfix_admin', ` admin_pattern($1, postfix_etc_t) files_search_spool($1) - admin_pattern($1,postfix_spool_type) + admin_pattern($1,postfix_spool_type) admin_pattern($1, postfix_var_run_t) @@ -754,4 +754,3 @@ interface(`postfix_run_postdrop',` postfix_domtrans_postdrop($1) role $2 types postfix_postdrop_t; ') -