merge restorecon into setfiles
This commit is contained in:
parent
12217cc286
commit
762d2cb989
@ -1,3 +1,4 @@
|
|||||||
|
- Merge restorecon into setfiles.
|
||||||
- Patch to begin separating out hald helper programs from Dan Walsh.
|
- Patch to begin separating out hald helper programs from Dan Walsh.
|
||||||
- Fixes for squid, dovecot, and snmp from Dan Walsh.
|
- Fixes for squid, dovecot, and snmp from Dan Walsh.
|
||||||
- Miscellaneous consolekit fixes from Dan Walsh.
|
- Miscellaneous consolekit fixes from Dan Walsh.
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(dpkg,1.1.0)
|
policy_module(dpkg,1.1.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -194,7 +194,7 @@ miscfiles_read_localization(dpkg_t)
|
|||||||
modutils_domtrans_depmod(dpkg_t)
|
modutils_domtrans_depmod(dpkg_t)
|
||||||
modutils_domtrans_insmod(dpkg_t)
|
modutils_domtrans_insmod(dpkg_t)
|
||||||
seutil_domtrans_loadpolicy(dpkg_t)
|
seutil_domtrans_loadpolicy(dpkg_t)
|
||||||
seutil_domtrans_restorecon(dpkg_t)
|
seutil_domtrans_setfiles(dpkg_t)
|
||||||
userdom_use_all_users_fds(dpkg_t)
|
userdom_use_all_users_fds(dpkg_t)
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
mta_send_mail(dpkg_t)
|
mta_send_mail(dpkg_t)
|
||||||
@ -304,7 +304,7 @@ modutils_domtrans_depmod(dpkg_script_t)
|
|||||||
modutils_domtrans_insmod(dpkg_script_t)
|
modutils_domtrans_insmod(dpkg_script_t)
|
||||||
|
|
||||||
seutil_domtrans_loadpolicy(dpkg_script_t)
|
seutil_domtrans_loadpolicy(dpkg_script_t)
|
||||||
seutil_domtrans_restorecon(dpkg_script_t)
|
seutil_domtrans_setfiles(dpkg_script_t)
|
||||||
|
|
||||||
userdom_use_all_users_fds(dpkg_script_t)
|
userdom_use_all_users_fds(dpkg_script_t)
|
||||||
|
|
||||||
|
@ -74,7 +74,6 @@ interface(`rpm_run',`
|
|||||||
seutil_run_loadpolicy(rpm_script_t,$2,$3)
|
seutil_run_loadpolicy(rpm_script_t,$2,$3)
|
||||||
seutil_run_semanage(rpm_script_t,$2,$3)
|
seutil_run_semanage(rpm_script_t,$2,$3)
|
||||||
seutil_run_setfiles(rpm_script_t,$2,$3)
|
seutil_run_setfiles(rpm_script_t,$2,$3)
|
||||||
seutil_run_restorecon(rpm_script_t,$2,$3)
|
|
||||||
allow rpm_t $3:chr_file rw_term_perms;
|
allow rpm_t $3:chr_file rw_term_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(rpm,1.6.0)
|
policy_module(rpm,1.6.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -325,7 +325,7 @@ modutils_domtrans_depmod(rpm_script_t)
|
|||||||
modutils_domtrans_insmod(rpm_script_t)
|
modutils_domtrans_insmod(rpm_script_t)
|
||||||
|
|
||||||
seutil_domtrans_loadpolicy(rpm_script_t)
|
seutil_domtrans_loadpolicy(rpm_script_t)
|
||||||
seutil_domtrans_restorecon(rpm_script_t)
|
seutil_domtrans_setfiles(rpm_script_t)
|
||||||
seutil_domtrans_semanage(rpm_script_t)
|
seutil_domtrans_semanage(rpm_script_t)
|
||||||
|
|
||||||
userdom_use_all_users_fds(rpm_script_t)
|
userdom_use_all_users_fds(rpm_script_t)
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(usermanage,1.6.0)
|
policy_module(usermanage,1.6.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -507,7 +507,7 @@ seutil_read_config(useradd_t)
|
|||||||
seutil_read_file_contexts(useradd_t)
|
seutil_read_file_contexts(useradd_t)
|
||||||
seutil_read_default_contexts(useradd_t)
|
seutil_read_default_contexts(useradd_t)
|
||||||
seutil_domtrans_semanage(useradd_t)
|
seutil_domtrans_semanage(useradd_t)
|
||||||
seutil_domtrans_restorecon(useradd_t)
|
seutil_domtrans_setfiles(useradd_t)
|
||||||
|
|
||||||
userdom_use_unpriv_users_fds(useradd_t)
|
userdom_use_unpriv_users_fds(useradd_t)
|
||||||
# for when /root is the cwd
|
# for when /root is the cwd
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(cron,1.6.0)
|
policy_module(cron,1.6.1)
|
||||||
|
|
||||||
gen_require(`
|
gen_require(`
|
||||||
class passwd rootok;
|
class passwd rootok;
|
||||||
@ -394,7 +394,6 @@ ifdef(`targeted_policy',`
|
|||||||
|
|
||||||
tunable_policy(`cron_can_relabel',`
|
tunable_policy(`cron_can_relabel',`
|
||||||
seutil_domtrans_setfiles(system_crond_t)
|
seutil_domtrans_setfiles(system_crond_t)
|
||||||
seutil_domtrans_restorecon(system_crond_t)
|
|
||||||
',`
|
',`
|
||||||
selinux_get_fs_mount(system_crond_t)
|
selinux_get_fs_mount(system_crond_t)
|
||||||
selinux_validate_context(system_crond_t)
|
selinux_validate_context(system_crond_t)
|
||||||
|
@ -23,7 +23,7 @@
|
|||||||
# /sbin
|
# /sbin
|
||||||
#
|
#
|
||||||
/sbin/load_policy -- gen_context(system_u:object_r:load_policy_exec_t,s0)
|
/sbin/load_policy -- gen_context(system_u:object_r:load_policy_exec_t,s0)
|
||||||
/sbin/restorecon -- gen_context(system_u:object_r:restorecon_exec_t,s0)
|
/sbin/restorecon -- gen_context(system_u:object_r:setfiles_exec_t,s0)
|
||||||
/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0)
|
/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0)
|
||||||
|
|
||||||
#
|
#
|
||||||
|
@ -294,7 +294,7 @@ interface(`seutil_use_newrole_fds',`
|
|||||||
|
|
||||||
#######################################
|
#######################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Execute restorecon in the restorecon domain.
|
## Execute restorecon in the restorecon domain. (Deprecated)
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -303,19 +303,15 @@ interface(`seutil_use_newrole_fds',`
|
|||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`seutil_domtrans_restorecon',`
|
interface(`seutil_domtrans_restorecon',`
|
||||||
gen_require(`
|
refpolicywarn(`$0($*) has been deprecated, please use seutil_domtrans_setfiles() instead.')
|
||||||
type restorecon_t, restorecon_exec_t;
|
seutil_domtrans_setfiles($1)
|
||||||
')
|
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
|
||||||
domtrans_pattern($1,restorecon_exec_t,restorecon_t)
|
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Execute restorecon in the restorecon domain, and
|
## Execute restorecon in the restorecon domain, and
|
||||||
## allow the specified role the restorecon domain,
|
## allow the specified role the restorecon domain,
|
||||||
## and use the caller's terminal.
|
## and use the caller's terminal. (Deprecated)
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -335,18 +331,13 @@ interface(`seutil_domtrans_restorecon',`
|
|||||||
## <rolecap/>
|
## <rolecap/>
|
||||||
#
|
#
|
||||||
interface(`seutil_run_restorecon',`
|
interface(`seutil_run_restorecon',`
|
||||||
gen_require(`
|
refpolicywarn(`$0($*) has been deprecated, please use seutil_run_setfiles() instead.')
|
||||||
type restorecon_t;
|
seutil_run_setfiles($1,$2,$3)
|
||||||
')
|
|
||||||
|
|
||||||
seutil_domtrans_restorecon($1)
|
|
||||||
role $2 types restorecon_t;
|
|
||||||
allow restorecon_t $3:chr_file rw_term_perms;
|
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Execute restorecon in the caller domain.
|
## Execute restorecon in the caller domain. (Deprecated)
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -356,12 +347,8 @@ interface(`seutil_run_restorecon',`
|
|||||||
## <rolecap/>
|
## <rolecap/>
|
||||||
#
|
#
|
||||||
interface(`seutil_exec_restorecon',`
|
interface(`seutil_exec_restorecon',`
|
||||||
gen_require(`
|
refpolicywarn(`$0($*) has been deprecated, please use seutil_exec_setfiles() instead.')
|
||||||
type restorecon_t, restorecon_exec_t;
|
seutil_exec_setfiles($1)
|
||||||
')
|
|
||||||
|
|
||||||
corecmd_search_bin($1)
|
|
||||||
can_exec($1,restorecon_exec_t)
|
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(selinuxutil,1.5.0)
|
policy_module(selinuxutil,1.5.1)
|
||||||
|
|
||||||
ifdef(`strict_policy',`
|
ifdef(`strict_policy',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -79,12 +79,6 @@ neverallow ~can_relabelto_binary_policy policy_config_t:file relabelto;
|
|||||||
type policy_src_t;
|
type policy_src_t;
|
||||||
files_type(policy_src_t)
|
files_type(policy_src_t)
|
||||||
|
|
||||||
type restorecon_t, can_relabelto_binary_policy;
|
|
||||||
type restorecon_exec_t;
|
|
||||||
domain_obj_id_change_exemption(restorecon_t)
|
|
||||||
init_system_domain(restorecon_t,restorecon_exec_t)
|
|
||||||
role system_r types restorecon_t;
|
|
||||||
|
|
||||||
type restorecond_t;
|
type restorecond_t;
|
||||||
type restorecond_exec_t;
|
type restorecond_exec_t;
|
||||||
init_daemon_domain(restorecond_t,restorecond_exec_t)
|
init_daemon_domain(restorecond_t,restorecond_exec_t)
|
||||||
@ -120,13 +114,10 @@ files_tmp_file(semanage_tmp_t)
|
|||||||
type semanage_trans_lock_t;
|
type semanage_trans_lock_t;
|
||||||
files_type(semanage_trans_lock_t)
|
files_type(semanage_trans_lock_t)
|
||||||
|
|
||||||
type setfiles_t, can_relabelto_binary_policy;
|
type setfiles_t alias restorecon_t, can_relabelto_binary_policy;
|
||||||
|
type setfiles_exec_t alias restorecon_exec_t;
|
||||||
|
init_system_domain(setfiles_t,setfiles_exec_t)
|
||||||
domain_obj_id_change_exemption(setfiles_t)
|
domain_obj_id_change_exemption(setfiles_t)
|
||||||
domain_type(setfiles_t)
|
|
||||||
role system_r types setfiles_t;
|
|
||||||
|
|
||||||
type setfiles_exec_t;
|
|
||||||
domain_entry_file(setfiles_t,setfiles_exec_t)
|
|
||||||
|
|
||||||
ifdef(`distro_redhat',`
|
ifdef(`distro_redhat',`
|
||||||
init_system_domain(setfiles_t,setfiles_exec_t)
|
init_system_domain(setfiles_t,setfiles_exec_t)
|
||||||
@ -332,100 +323,6 @@ optional_policy(`
|
|||||||
nscd_socket_use(newrole_t)
|
nscd_socket_use(newrole_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
|
||||||
#
|
|
||||||
# Restorecon local policy
|
|
||||||
#
|
|
||||||
|
|
||||||
allow restorecon_t self:capability { dac_override dac_read_search fowner };
|
|
||||||
dontaudit restorecon_t self:capability sys_tty_config;
|
|
||||||
allow restorecon_t self:fifo_file rw_fifo_file_perms;
|
|
||||||
|
|
||||||
allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:dir r_dir_perms;
|
|
||||||
allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms;
|
|
||||||
allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms;
|
|
||||||
|
|
||||||
kernel_use_fds(restorecon_t)
|
|
||||||
kernel_rw_pipes(restorecon_t)
|
|
||||||
kernel_read_system_state(restorecon_t)
|
|
||||||
kernel_rw_unix_dgram_sockets(restorecon_t)
|
|
||||||
kernel_relabelfrom_unlabeled_dirs(restorecon_t)
|
|
||||||
kernel_relabelfrom_unlabeled_files(restorecon_t)
|
|
||||||
kernel_relabelfrom_unlabeled_symlinks(restorecon_t)
|
|
||||||
kernel_relabelfrom_unlabeled_pipes(restorecon_t)
|
|
||||||
kernel_relabelfrom_unlabeled_sockets(restorecon_t)
|
|
||||||
kernel_dontaudit_list_all_proc(restorecon_t)
|
|
||||||
kernel_dontaudit_list_all_sysctls(restorecon_t)
|
|
||||||
|
|
||||||
dev_relabel_all_dev_nodes(restorecon_t)
|
|
||||||
# cjp: why is this needed?
|
|
||||||
dev_rw_generic_files(restorecon_t)
|
|
||||||
|
|
||||||
fs_getattr_xattr_fs(restorecon_t)
|
|
||||||
fs_search_auto_mountpoints(restorecon_t)
|
|
||||||
fs_getattr_all_dirs(restorecon_t)
|
|
||||||
|
|
||||||
mls_file_read_up(restorecon_t)
|
|
||||||
mls_file_write_down(restorecon_t)
|
|
||||||
mls_file_upgrade(restorecon_t)
|
|
||||||
mls_file_downgrade(restorecon_t)
|
|
||||||
|
|
||||||
selinux_get_fs_mount(restorecon_t)
|
|
||||||
selinux_validate_context(restorecon_t)
|
|
||||||
selinux_compute_access_vector(restorecon_t)
|
|
||||||
selinux_compute_create_context(restorecon_t)
|
|
||||||
selinux_compute_relabel_context(restorecon_t)
|
|
||||||
selinux_compute_user_contexts(restorecon_t)
|
|
||||||
|
|
||||||
term_use_unallocated_ttys(restorecon_t)
|
|
||||||
term_use_all_user_ttys(restorecon_t)
|
|
||||||
term_use_all_user_ptys(restorecon_t)
|
|
||||||
|
|
||||||
init_use_fds(restorecon_t)
|
|
||||||
init_use_script_ptys(restorecon_t)
|
|
||||||
|
|
||||||
domain_use_interactive_fds(restorecon_t)
|
|
||||||
domain_dontaudit_search_all_domains_state(restorecon_t)
|
|
||||||
|
|
||||||
files_read_etc_runtime_files(restorecon_t)
|
|
||||||
files_read_etc_files(restorecon_t)
|
|
||||||
|
|
||||||
libs_use_ld_so(restorecon_t)
|
|
||||||
libs_use_shared_libs(restorecon_t)
|
|
||||||
|
|
||||||
logging_send_syslog_msg(restorecon_t)
|
|
||||||
|
|
||||||
userdom_use_all_users_fds(restorecon_t)
|
|
||||||
|
|
||||||
files_relabel_all_files(restorecon_t)
|
|
||||||
fs_relabelfrom_noxattr_fs(restorecon_t)
|
|
||||||
|
|
||||||
files_list_all(restorecon_t)
|
|
||||||
# this is to satisfy the assertion:
|
|
||||||
auth_relabelto_shadow(restorecon_t)
|
|
||||||
|
|
||||||
ifdef(`distro_redhat', `
|
|
||||||
fs_rw_tmpfs_chr_files(restorecon_t)
|
|
||||||
fs_rw_tmpfs_blk_files(restorecon_t)
|
|
||||||
fs_relabel_tmpfs_blk_file(restorecon_t)
|
|
||||||
fs_relabel_tmpfs_chr_file(restorecon_t)
|
|
||||||
')
|
|
||||||
|
|
||||||
ifdef(`hide_broken_symptoms',`
|
|
||||||
optional_policy(`
|
|
||||||
udev_dontaudit_rw_dgram_sockets(restorecon_t)
|
|
||||||
')
|
|
||||||
|
|
||||||
optional_policy(`
|
|
||||||
unconfined_dontaudit_rw_pipes(restorecon_t)
|
|
||||||
unconfined_dontaudit_rw_tcp_sockets(restorecon_t)
|
|
||||||
')
|
|
||||||
')
|
|
||||||
|
|
||||||
optional_policy(`
|
|
||||||
hotplug_use_fds(restorecon_t)
|
|
||||||
')
|
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# Restorecond local policy
|
# Restorecond local policy
|
||||||
@ -636,6 +533,7 @@ ifdef(`enable_mls',`
|
|||||||
#
|
#
|
||||||
|
|
||||||
allow setfiles_t self:capability { dac_override dac_read_search fowner };
|
allow setfiles_t self:capability { dac_override dac_read_search fowner };
|
||||||
|
dontaudit setfiles_t self:capability sys_tty_config;
|
||||||
allow setfiles_t self:fifo_file rw_file_perms;
|
allow setfiles_t self:fifo_file rw_file_perms;
|
||||||
|
|
||||||
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:dir r_dir_perms;
|
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:dir r_dir_perms;
|
||||||
@ -648,11 +546,18 @@ kernel_relabelfrom_unlabeled_files(setfiles_t)
|
|||||||
kernel_relabelfrom_unlabeled_symlinks(setfiles_t)
|
kernel_relabelfrom_unlabeled_symlinks(setfiles_t)
|
||||||
kernel_relabelfrom_unlabeled_pipes(setfiles_t)
|
kernel_relabelfrom_unlabeled_pipes(setfiles_t)
|
||||||
kernel_relabelfrom_unlabeled_sockets(setfiles_t)
|
kernel_relabelfrom_unlabeled_sockets(setfiles_t)
|
||||||
|
kernel_use_fds(setfiles_t)
|
||||||
|
kernel_rw_pipes(setfiles_t)
|
||||||
|
kernel_rw_unix_dgram_sockets(setfiles_t)
|
||||||
|
kernel_dontaudit_list_all_proc(setfiles_t)
|
||||||
|
kernel_dontaudit_list_all_sysctls(setfiles_t)
|
||||||
|
|
||||||
dev_relabel_all_dev_nodes(setfiles_t)
|
dev_relabel_all_dev_nodes(setfiles_t)
|
||||||
|
|
||||||
fs_getattr_xattr_fs(setfiles_t)
|
fs_getattr_xattr_fs(setfiles_t)
|
||||||
fs_list_all(setfiles_t)
|
fs_list_all(setfiles_t)
|
||||||
|
fs_search_auto_mountpoints(setfiles_t)
|
||||||
|
fs_relabelfrom_noxattr_fs(setfiles_t)
|
||||||
|
|
||||||
mls_file_read_up(setfiles_t)
|
mls_file_read_up(setfiles_t)
|
||||||
mls_file_write_down(setfiles_t)
|
mls_file_write_down(setfiles_t)
|
||||||
@ -679,6 +584,7 @@ init_use_script_ptys(setfiles_t)
|
|||||||
init_exec_script_files(setfiles_t)
|
init_exec_script_files(setfiles_t)
|
||||||
|
|
||||||
domain_use_interactive_fds(setfiles_t)
|
domain_use_interactive_fds(setfiles_t)
|
||||||
|
domain_dontaudit_search_all_domains_state(setfiles_t)
|
||||||
|
|
||||||
libs_use_ld_so(setfiles_t)
|
libs_use_ld_so(setfiles_t)
|
||||||
libs_use_shared_libs(setfiles_t)
|
libs_use_shared_libs(setfiles_t)
|
||||||
@ -687,7 +593,6 @@ files_read_etc_runtime_files(setfiles_t)
|
|||||||
files_read_etc_files(setfiles_t)
|
files_read_etc_files(setfiles_t)
|
||||||
files_list_all(setfiles_t)
|
files_list_all(setfiles_t)
|
||||||
files_relabel_all_files(setfiles_t)
|
files_relabel_all_files(setfiles_t)
|
||||||
fs_relabelfrom_noxattr_fs(setfiles_t)
|
|
||||||
|
|
||||||
logging_send_syslog_msg(setfiles_t)
|
logging_send_syslog_msg(setfiles_t)
|
||||||
|
|
||||||
@ -697,9 +602,25 @@ userdom_use_all_users_fds(setfiles_t)
|
|||||||
# for config files in a home directory
|
# for config files in a home directory
|
||||||
userdom_read_all_users_home_content_files(setfiles_t)
|
userdom_read_all_users_home_content_files(setfiles_t)
|
||||||
|
|
||||||
|
ifdef(`distro_redhat', `
|
||||||
|
fs_rw_tmpfs_chr_files(setfiles_t)
|
||||||
|
fs_rw_tmpfs_blk_files(setfiles_t)
|
||||||
|
fs_relabel_tmpfs_blk_file(setfiles_t)
|
||||||
|
fs_relabel_tmpfs_chr_file(setfiles_t)
|
||||||
|
')
|
||||||
|
|
||||||
ifdef(`hide_broken_symptoms',`
|
ifdef(`hide_broken_symptoms',`
|
||||||
|
optional_policy(`
|
||||||
|
udev_dontaudit_rw_dgram_sockets(setfiles_t)
|
||||||
|
')
|
||||||
|
|
||||||
# cjp: cover up stray file descriptors.
|
# cjp: cover up stray file descriptors.
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
unconfined_dontaudit_read_pipes(setfiles_t)
|
unconfined_dontaudit_read_pipes(setfiles_t)
|
||||||
|
unconfined_dontaudit_rw_tcp_sockets(setfiles_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
hotplug_use_fds(setfiles_t)
|
||||||
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(udev,1.6.0)
|
policy_module(udev,1.6.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -140,7 +140,7 @@ modutils_read_module_deps(udev_t)
|
|||||||
seutil_read_config(udev_t)
|
seutil_read_config(udev_t)
|
||||||
seutil_read_default_contexts(udev_t)
|
seutil_read_default_contexts(udev_t)
|
||||||
seutil_read_file_contexts(udev_t)
|
seutil_read_file_contexts(udev_t)
|
||||||
seutil_domtrans_restorecon(udev_t)
|
seutil_domtrans_setfiles(udev_t)
|
||||||
|
|
||||||
sysnet_domtrans_ifconfig(udev_t)
|
sysnet_domtrans_ifconfig(udev_t)
|
||||||
sysnet_domtrans_dhcpc(udev_t)
|
sysnet_domtrans_dhcpc(udev_t)
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(unconfined,1.6.0)
|
policy_module(unconfined,1.6.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -44,7 +44,7 @@ ifdef(`targeted_policy',`
|
|||||||
|
|
||||||
mount_domtrans_unconfined(unconfined_t)
|
mount_domtrans_unconfined(unconfined_t)
|
||||||
|
|
||||||
seutil_domtrans_restorecon(unconfined_t)
|
seutil_domtrans_setfiles(unconfined_t)
|
||||||
seutil_domtrans_semanage(unconfined_t)
|
seutil_domtrans_semanage(unconfined_t)
|
||||||
|
|
||||||
userdom_unconfined(unconfined_t)
|
userdom_unconfined(unconfined_t)
|
||||||
|
@ -1304,7 +1304,6 @@ template(`userdom_security_admin_template',`
|
|||||||
seutil_run_loadpolicy($1,$2,$3)
|
seutil_run_loadpolicy($1,$2,$3)
|
||||||
seutil_run_semanage($1,$2,$3)
|
seutil_run_semanage($1,$2,$3)
|
||||||
seutil_run_setfiles($1, $2, $3)
|
seutil_run_setfiles($1, $2, $3)
|
||||||
seutil_run_restorecon($1,$2,$3)
|
|
||||||
|
|
||||||
userdom_dontaudit_append_staff_home_content_files($1)
|
userdom_dontaudit_append_staff_home_content_files($1)
|
||||||
userdom_dontaudit_read_sysadm_home_content_files($1)
|
userdom_dontaudit_read_sysadm_home_content_files($1)
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(userdomain,2.2.1)
|
policy_module(userdomain,2.2.2)
|
||||||
|
|
||||||
gen_require(`
|
gen_require(`
|
||||||
role sysadm_r, staff_r, user_r;
|
role sysadm_r, staff_r, user_r;
|
||||||
@ -447,7 +447,7 @@ ifdef(`strict_policy',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
seutil_run_restorecon(sysadm_t,sysadm_r,admin_terminal)
|
seutil_run_setfiles(sysadm_t,sysadm_r,admin_terminal)
|
||||||
seutil_run_runinit(sysadm_t,sysadm_r,admin_terminal)
|
seutil_run_runinit(sysadm_t,sysadm_r,admin_terminal)
|
||||||
|
|
||||||
ifdef(`enable_mls',`
|
ifdef(`enable_mls',`
|
||||||
|
Loading…
Reference in New Issue
Block a user