rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

eliminate _depend macros

Browse Source
This commit is contained in:
Chris PeBenito 2005-06-16 20:30:59 +00:00
parent 8c2f3ac695
commit 77c124c8cd
1 changed files with 103 additions and 171 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

272
refpolicy/policy/modules/system/domain.if
View File

@ -6,27 +6,26 @@
# domain_base_domain_type(domain) # domain_base_domain_type(domain)
# #
define(`domain_base_domain_type',` define(`domain_base_domain_type',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class dir r_dir_perms;
class lnk_file r_file_perms;
class file rw_file_perms;
class process { fork sigchld };
')
# mark as a domain # mark as a domain
typeattribute $1 domain; typeattribute $1 domain;
# allow the domain to read its /proc/pid entries # allow the domain to read its /proc/pid entries
allow $1 self:dir r_dir_perms; allow $1 self:dir r_dir_perms;
allow $1 self:{ file lnk_file } rw_file_perms; allow $1 self:lnk_file r_file_perms;
allow $1 self:file rw_file_perms;
# allow $1 to create child processes in this domain # allow $1 to create child processes in this domain
allow $1 self:process { fork sigchld }; allow $1 self:process { fork sigchld };
') ')
define(`domain_base_domain_type_depend',`
attribute domain;
class dir r_dir_perms;
class file rw_file_perms;
class lnk_file r_file_perms;
')
######################################## ########################################
# #
# domain_type(domain) # domain_type(domain)
@ -58,33 +57,28 @@ define(`domain_type',`
# domain_entry_file(domain,entrypointfile) # domain_entry_file(domain,entrypointfile)
# #
define(`domain_entry_file',` define(`domain_entry_file',`
gen_require(`$0'_depend) gen_require(`
attribute entry_type;
class file entrypoint;
')
files_file_type($2) files_file_type($2)
allow $1 $2:file entrypoint; allow $1 $2:file entrypoint;
typeattribute $2 entry_type; typeattribute $2 entry_type;
') ')
define(`domain_entry_file_depend',`
attribute entry_type;
class file entrypoint;
')
######################################## ########################################
# #
# domain_wide_inherit_fd(domain) # domain_wide_inherit_fd(domain)
# #
define(`domain_wide_inherit_fd',` define(`domain_wide_inherit_fd',`
gen_require(`$0'_depend) gen_require(`
attribute privfd;
')
typeattribute $1 privfd; typeattribute $1 privfd;
') ')
define(`domain_wide_inherit_fd_depend',`
attribute privfd;
')
######################################## ########################################
## <interface name="domain_subj_id_change_exempt"> ## <interface name="domain_subj_id_change_exempt">
## <description> ## <description>
@ -97,15 +91,13 @@ define(`domain_wide_inherit_fd_depend',`
## </interface> ## </interface>
# #
define(`domain_subj_id_change_exempt',` define(`domain_subj_id_change_exempt',`
gen_require(`$0'_depend) gen_require(`
attribute can_change_process_identity;
')
typeattribute $1 can_change_process_identity; typeattribute $1 can_change_process_identity;
') ')
define(`domain_subj_id_change_exempt_depend',`
attribute can_change_process_identity;
')
######################################## ########################################
## <interface name="domain_role_change_exempt"> ## <interface name="domain_role_change_exempt">
## <description> ## <description>
@ -118,15 +110,13 @@ define(`domain_subj_id_change_exempt_depend',`
## </interface> ## </interface>
# #
define(`domain_role_change_exempt',` define(`domain_role_change_exempt',`
gen_require(`$0'_depend) gen_require(`
attribute can_change_process_role;
')
typeattribute $1 can_change_process_role; typeattribute $1 can_change_process_role;
') ')
define(`domain_role_change_exempt_depend',`
attribute can_change_process_role;
')
######################################## ########################################
## <interface name="domain_obj_id_change_exempt"> ## <interface name="domain_obj_id_change_exempt">
## <description> ## <description>
@ -139,63 +129,52 @@ define(`domain_role_change_exempt_depend',`
## </interface> ## </interface>
# #
define(`domain_obj_id_change_exempt',` define(`domain_obj_id_change_exempt',`
gen_require(`$0'_depend) gen_require(`
attribute can_change_object_identity;
')
typeattribute $1 can_change_object_identity; typeattribute $1 can_change_object_identity;
') ')
define(`domain_obj_id_change_exempt_depend',`
attribute can_change_object_identity;
')
######################################## ########################################
# #
# domain_use_wide_inherit_fd(domain) # domain_use_wide_inherit_fd(domain)
# #
define(`domain_use_wide_inherit_fd',` define(`domain_use_wide_inherit_fd',`
gen_require(`$0'_depend) gen_require(`
attribute privfd;
class fd use;
')
allow $1 privfd:fd use; allow $1 privfd:fd use;
') ')
define(`domain_use_wide_inherit_fd_depend',`
attribute privfd;
class fd use;
')
######################################## ########################################
# #
# domain_dontaudit_use_wide_inherit_fd(domain) # domain_dontaudit_use_wide_inherit_fd(domain)
# #
define(`domain_dontaudit_use_wide_inherit_fd',` define(`domain_dontaudit_use_wide_inherit_fd',`
gen_require(`$0'_depend) gen_require(`
attribute privfd;
class fd use;
')
dontaudit $1 privfd:fd use; dontaudit $1 privfd:fd use;
') ')
define(`domain_dontaudit_use_wide_inherit_fd_depend',`
attribute privfd;
class fd use;
')
######################################## ########################################
# #
# domain_setpriority_all_domains(domain) # domain_setpriority_all_domains(domain)
# #
define(`domain_setpriority_all_domains',` define(`domain_setpriority_all_domains',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class process setsched;
')
allow $1 domain:process setsched; allow $1 domain:process setsched;
') ')
define(`domain_setpriority_all_domains_depend',`
attribute domain;
class process setsched;
')
######################################## ########################################
## <interface name="domain_signal_all_domains"> ## <interface name="domain_signal_all_domains">
## <description> ## <description>
@ -207,17 +186,14 @@ define(`domain_setpriority_all_domains_depend',`
## </interface> ## </interface>
# #
define(`domain_signal_all_domains',` define(`domain_signal_all_domains',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class process signal;
')
allow $1 domain:process signal; allow $1 domain:process signal;
') ')
define(`domain_signal_all_domains_depend',`
attribute domain;
class process signal;
')
######################################## ########################################
## <interface name="domain_signull_all_domains"> ## <interface name="domain_signull_all_domains">
## <description> ## <description>
@ -229,17 +205,14 @@ define(`domain_signal_all_domains_depend',`
## </interface> ## </interface>
# #
define(`domain_signull_all_domains',` define(`domain_signull_all_domains',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class process signull;
')
allow $1 domain:process signull; allow $1 domain:process signull;
') ')
define(`domain_signull_all_domains_depend',`
attribute domain;
class process signull;
')
######################################## ########################################
## <interface name="domain_sigstop_all_domains"> ## <interface name="domain_sigstop_all_domains">
## <description> ## <description>
@ -251,17 +224,14 @@ define(`domain_signull_all_domains_depend',`
## </interface> ## </interface>
# #
define(`domain_sigstop_all_domains',` define(`domain_sigstop_all_domains',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class process sigstop;
')
allow $1 domain:process sigstop; allow $1 domain:process sigstop;
') ')
define(`domain_sigstop_all_domains_depend',`
attribute domain;
class process sigstop;
')
######################################## ########################################
## <interface name="domain_sigchld_all_domains"> ## <interface name="domain_sigchld_all_domains">
## <description> ## <description>
@ -273,17 +243,14 @@ define(`domain_sigstop_all_domains_depend',`
## </interface> ## </interface>
# #
define(`domain_sigchld_all_domains',` define(`domain_sigchld_all_domains',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class process sigchld;
')
allow $1 domain:process sigchld; allow $1 domain:process sigchld;
') ')
define(`domain_sigchld_all_domains_depend',`
attribute domain;
class process sigchld;
')
######################################## ########################################
## <interface name="domain_kill_all_domains"> ## <interface name="domain_kill_all_domains">
## <description> ## <description>
@ -295,19 +262,16 @@ define(`domain_sigchld_all_domains_depend',`
## </interface> ## </interface>
# #
define(`domain_kill_all_domains',` define(`domain_kill_all_domains',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class process sigkill;
class capability kill;
')
allow $1 domain:process sigkill; allow $1 domain:process sigkill;
allow $1 self:capability kill; allow $1 self:capability kill;
') ')
define(`domain_kill_all_domains_depend',`
attribute domain;
class process sigkill;
class capability kill;
')
######################################## ########################################
## <interface name="domain_read_all_domains_state"> ## <interface name="domain_read_all_domains_state">
## <description> ## <description>
@ -319,7 +283,13 @@ define(`domain_kill_all_domains_depend',`
## </interface> ## </interface>
# #
define(`domain_read_all_domains_state',` define(`domain_read_all_domains_state',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class dir r_dir_perms;
class lnk_file r_file_perms;
class file r_file_perms;
class process { getattr ptrace };
')
allow $1 domain:dir r_dir_perms; allow $1 domain:dir r_dir_perms;
allow $1 domain:lnk_file r_file_perms; allow $1 domain:lnk_file r_file_perms;
@ -333,15 +303,6 @@ define(`domain_read_all_domains_state',`
dontaudit $1 domain:process ptrace; dontaudit $1 domain:process ptrace;
') ')
define(`domain_read_all_domains_state_depend',`
attribute domain;
class dir r_dir_perms;
class lnk_file r_file_perms;
class file r_file_perms;
class process { getattr ptrace };
')
######################################## ########################################
## <interface name="domain_dontaudit_list_all_domains_proc"> ## <interface name="domain_dontaudit_list_all_domains_proc">
## <description> ## <description>
@ -354,18 +315,14 @@ define(`domain_read_all_domains_state_depend',`
## </interface> ## </interface>
# #
define(`domain_dontaudit_list_all_domains_proc',` define(`domain_dontaudit_list_all_domains_proc',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class dir r_dir_perms;
')
dontaudit $1 domain:dir r_dir_perms; dontaudit $1 domain:dir r_dir_perms;
') ')
define(`domain_dontaudit_list_all_domains_proc_depend',`
attribute domain;
class dir r_dir_perms;
')
######################################## ########################################
## <interface name="domain_getsession_all_domains"> ## <interface name="domain_getsession_all_domains">
## <description> ## <description>
@ -377,17 +334,14 @@ define(`domain_dontaudit_list_all_domains_proc_depend',`
## </interface> ## </interface>
# #
define(`domain_getsession_all_domains',` define(`domain_getsession_all_domains',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class process getsession;
')
allow $1 domain:process getsession; allow $1 domain:process getsession;
') ')
define(`domain_getsession_all_domains_depend',`
attribute domain;
class process getsession;
')
######################################## ########################################
## <interface name="domain_dontaudit_getattr_all_udp_sockets"> ## <interface name="domain_dontaudit_getattr_all_udp_sockets">
## <description> ## <description>
@ -400,17 +354,14 @@ define(`domain_getsession_all_domains_depend',`
## </interface> ## </interface>
# #
define(`domain_dontaudit_getattr_all_udp_sockets',` define(`domain_dontaudit_getattr_all_udp_sockets',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class udp_socket getattr;
')
dontaudit $1 domain:udp_socket getattr; dontaudit $1 domain:udp_socket getattr;
') ')
define(`domain_dontaudit_getattr_all_udp_sockets_depend',`
attribute domain;
class udp_socket getattr;
')
######################################## ########################################
## <interface name="domain_dontaudit_getattr_all_tcp_sockets"> ## <interface name="domain_dontaudit_getattr_all_tcp_sockets">
## <description> ## <description>
@ -423,17 +374,14 @@ define(`domain_dontaudit_getattr_all_udp_sockets_depend',`
## </interface> ## </interface>
# #
define(`domain_dontaudit_getattr_all_tcp_sockets',` define(`domain_dontaudit_getattr_all_tcp_sockets',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class tcp_socket getattr;
')
dontaudit $1 domain:tcp_socket getattr; dontaudit $1 domain:tcp_socket getattr;
') ')
define(`domain_dontaudit_getattr_all_tcp_sockets_depend',`
attribute domain;
class tcp_socket getattr;
')
######################################## ########################################
## <interface name="domain_dontaudit_getattr_all_unix_dgram_sockets"> ## <interface name="domain_dontaudit_getattr_all_unix_dgram_sockets">
## <description> ## <description>
@ -446,17 +394,14 @@ define(`domain_dontaudit_getattr_all_tcp_sockets_depend',`
## </interface> ## </interface>
# #
define(`domain_dontaudit_getattr_all_unix_dgram_sockets',` define(`domain_dontaudit_getattr_all_unix_dgram_sockets',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class unix_dgram_socket getattr;
')
dontaudit $1 domain:unix_dgram_socket getattr; dontaudit $1 domain:unix_dgram_socket getattr;
') ')
define(`domain_dontaudit_getattr_all_unix_dgram_sockets_depend',`
attribute domain;
class unix_dgram_socket getattr;
')
######################################## ########################################
## <interface name="domain_dontaudit_getattr_all_unnamed_pipes"> ## <interface name="domain_dontaudit_getattr_all_unnamed_pipes">
## <description> ## <description>
@ -469,32 +414,24 @@ define(`domain_dontaudit_getattr_all_unix_dgram_sockets_depend',`
## </interface> ## </interface>
# #
define(`domain_dontaudit_getattr_all_unnamed_pipes',` define(`domain_dontaudit_getattr_all_unnamed_pipes',`
gen_require(`$0'_depend) gen_require(`
attribute domain;
class fifo_file getattr;
')
dontaudit $1 domain:fifo_file getattr; dontaudit $1 domain:fifo_file getattr;
') ')
define(`domain_dontaudit_getattr_all_unnamed_pipes_depend',`
attribute domain;
class fifo_file getattr;
')
######################################## ########################################
# #
# domain_exec_all_entry_files(domain) # domain_exec_all_entry_files(domain)
# #
define(`domain_exec_all_entry_files',` define(`domain_exec_all_entry_files',`
gen_require(`$0'_depend) gen_require(`
attribute entry_type;
')
can_exec($1,entry_type) can_exec($1,entry_type)
')
define(`domain_exec_all_entry_files_depend',`
attribute entry_type;
class file { getattr read ioctl lock execute execute_no_trans };
') ')
######################################## ########################################
@ -502,25 +439,22 @@ define(`domain_exec_all_entry_files_depend',`
# domain_read_all_entry_files(domain) # domain_read_all_entry_files(domain)
# #
define(`domain_read_all_entry_files',` define(`domain_read_all_entry_files',`
gen_require(`$0'_depend) gen_require(`
attribute entry_type;
class file r_file_perms;
class lnk_file r_file_perms;
')
allow $1 entry_type:lnk_file r_file_perms; allow $1 entry_type:lnk_file r_file_perms;
allow $1 entry_type:file r_file_perms; allow $1 entry_type:file r_file_perms;
') ')
define(`domain_read_all_entry_files_depend',`
attribute entry_type;
class file r_file_perms;
class lnk_file r_file_perms;
')
## </module> ## </module>
# #
# These next macros are not interfaces, but actually are # These next macros are not interfaces, but actually are
# support macros. Due to the domain_ prefix, they # support macros. Due to the domain_ prefix, they
# are placed in this module. # are placed in this module, to try to prevent confusion.
# #
######################################## ########################################
@ -528,18 +462,16 @@ define(`domain_read_all_entry_files_depend',`
# domain_trans(source_domain,entrypoint_file,target_domain) # domain_trans(source_domain,entrypoint_file,target_domain)
# #
define(`domain_trans',` define(`domain_trans',`
gen_require(`$0'_depend) gen_require(`
class file rx_file_perms;
process { transition noatsecure siginh rlimitinh };
')
allow $1 $2:file rx_file_perms; allow $1 $2:file rx_file_perms;
allow $1 $3:process transition; allow $1 $3:process transition;
dontaudit $1 $3:process { noatsecure siginh rlimitinh }; dontaudit $1 $3:process { noatsecure siginh rlimitinh };
') ')
define(`domain_trans_depend',`
class file rx_file_perms;
process { transition noatsecure siginh rlimitinh };
')
######################################## ########################################
# #
# domain_auto_trans(source_domain,entrypoint_file,target_domain) # domain_auto_trans(source_domain,entrypoint_file,target_domain)