diff --git a/refpolicy/policy/modules/system/selinux.if b/refpolicy/policy/modules/system/selinux.if index 87e5ac6e..c41ee7cb 100644 --- a/refpolicy/policy/modules/system/selinux.if +++ b/refpolicy/policy/modules/system/selinux.if @@ -1,5 +1,193 @@ # Copyright (C) 2005 Tresys Technology, LLC +####################################### +# +# selinux_checkpolicy_transition(domain) +# +define(`selinux_checkpolicy_transition',` +requires_block_template(selinux_checkpolicy_transition_depend) +allow $1 checkpolicy_exec_t:file { getattr read execute }; +allow $1 checkpolicy_t:process transition; +type_transition $1 checkpolicy_exec_t:file checkpolicy_t; +dontaudit $1 checkpolicy_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_checkpolicy_transition_depend',` +type checkpolicy_t, checkpolicy_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_checkpolicy_execute(domain) +# +define(`selinux_checkpolicy_execute',` +requires_block_template(selinux_checkpolicy_execute_depend) +allow $1 checkpolicy_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_checkpolicy_execute_depend',` +type checkpolicy_t, checkpolicy_exec_t; +class file { getattr read execute execute_no_trans }; +') + +####################################### +# +# selinux_load_policy_transition(domain) +# +define(`selinux_load_policy_transition',` +requires_block_template(selinux_load_policy_transition_depend) +allow $1 load_policy_exec_t:file { getattr read execute }; +allow $1 load_policy_t:process transition; +type_transition $1 load_policy_exec_t:file load_policy_t; +dontaudit $1 load_policy_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_load_policy_transition_depend',` +type load_policy_t, load_policy_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_load_policy_execute(domain) +# +define(`selinux_load_policy_execute',` +requires_block_template(selinux_load_policy_execute_depend) +allow $1 load_policy_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_load_policy_execute_depend',` +type load_policy_t, load_policy_exec_t; +class file { getattr read execute execute_no_trans }; +') + +####################################### +# +# selinux_read_load_policy_binary(domain) +# +define(`selinux_read_load_policy_binary',` +requires_block_template(selinux_read_load_policy_binary_depend) +allow $1 load_policy_exec_t:file { getattr read }; +') + +define(`selinux_read_load_policy_binary_depend',` +type load_policy_exec_t; +class file { getattr read }; +') + +####################################### +# +# newrole_transition(domain) +# +define(`selinux_newrole_transition',` +requires_block_template(selinux_newrole_transition_depend) +allow $1 newrole_exec_t:file { getattr read execute }; +allow $1 newrole_t:process transition; +type_transition $1 newrole_exec_t:file newrole_t; +dontaudit $1 newrole_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_newrole_transition_depend',` +type newrole_t, newrole_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_newrole_execute(domain) +# +define(`selinux_newrole_execute',` +requires_block_template(selinux_newrole_execute_depend) +allow $1 newrole_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_newrole_execute_depend',` +type newrole_t, newrole_exec_t; +class file { getattr read execute execute_no_trans }; +') + +####################################### +# +# selinux_newrole_sigchld(domain) +# +define(`selinux_newrole_sigchld',` +requires_block_template(selinux_newrole_sigchld_depend) +allow $1 newrole_t:process sigchld; +') + +define(`selinux_newrole_sigchld_depend',` +type newrole_t; +class process sigchld; +') + +####################################### +# +# selinux_restorecon_transition(domain) +# +define(`selinux_restorecon_transition',` +requires_block_template(selinux_restorecon_transition_depend) +allow $1 restorecon_exec_t:file { getattr read execute }; +allow $1 restorecon_t:process transition; +type_transition $1 restorecon_exec_t:file restorecon_t; +dontaudit $1 restorecon_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_restorecon_transition_depend',` +type restorecon_t, restorecon_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_restorecon_execute(domain) +# +define(`selinux_restorecon_execute',` +requires_block_template(selinux_restorecon_execute_depend) +allow $1 restorecon_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_restorecon_execute_depend',` +type restorecon_t, restorecon_exec_t; +class file { getattr read execute execute_no_trans }; +') + +####################################### +# +# selinux_setfiles_transition(domain) +# +define(`selinux_setfiles_transition',` +requires_block_template(selinux_setfiles_transition_depend) +allow $1 setfiles_exec_t:file { getattr read execute }; +allow $1 setfiles_t:process transition; +type_transition $1 setfiles_exec_t:file setfiles_t; +dontaudit $1 setfiles_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_setfiles_transition_depend',` +type setfiles_t, setfiles_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_setfiles_execute(domain) +# +define(`selinux_setfiles_execute',` +requires_block_template(selinux_setfiles_execute_depend) +allow $1 setfiles_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_setfiles_execute_depend',` +type setfiles_t, setfiles_exec_t; +class file { getattr read execute execute_no_trans }; +') + ######################################## # # selinux_read_config(domain,[`optional']) @@ -83,17 +271,3 @@ attribute can_write_binary_policy; class dir { getattr search read write add_name remove_name }; class file { getattr create write unlink }; ') - -####################################### -# -# selinux_read_load_policy_binary(domain,[`optional']) -# -define(`selinux_read_load_policy_binary',` -requires_block_template(selinux_read_load_policy_binary_depend,$2) -allow $1 load_policy_exec_t:file { getattr read }; -') - -define(`selinux_read_load_policy_binary_depend',` -type load_policy_exec_t; -class file { getattr read }; -') diff --git a/refpolicy/policy/modules/system/selinuxutil.if b/refpolicy/policy/modules/system/selinuxutil.if index 87e5ac6e..c41ee7cb 100644 --- a/refpolicy/policy/modules/system/selinuxutil.if +++ b/refpolicy/policy/modules/system/selinuxutil.if @@ -1,5 +1,193 @@ # Copyright (C) 2005 Tresys Technology, LLC +####################################### +# +# selinux_checkpolicy_transition(domain) +# +define(`selinux_checkpolicy_transition',` +requires_block_template(selinux_checkpolicy_transition_depend) +allow $1 checkpolicy_exec_t:file { getattr read execute }; +allow $1 checkpolicy_t:process transition; +type_transition $1 checkpolicy_exec_t:file checkpolicy_t; +dontaudit $1 checkpolicy_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_checkpolicy_transition_depend',` +type checkpolicy_t, checkpolicy_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_checkpolicy_execute(domain) +# +define(`selinux_checkpolicy_execute',` +requires_block_template(selinux_checkpolicy_execute_depend) +allow $1 checkpolicy_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_checkpolicy_execute_depend',` +type checkpolicy_t, checkpolicy_exec_t; +class file { getattr read execute execute_no_trans }; +') + +####################################### +# +# selinux_load_policy_transition(domain) +# +define(`selinux_load_policy_transition',` +requires_block_template(selinux_load_policy_transition_depend) +allow $1 load_policy_exec_t:file { getattr read execute }; +allow $1 load_policy_t:process transition; +type_transition $1 load_policy_exec_t:file load_policy_t; +dontaudit $1 load_policy_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_load_policy_transition_depend',` +type load_policy_t, load_policy_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_load_policy_execute(domain) +# +define(`selinux_load_policy_execute',` +requires_block_template(selinux_load_policy_execute_depend) +allow $1 load_policy_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_load_policy_execute_depend',` +type load_policy_t, load_policy_exec_t; +class file { getattr read execute execute_no_trans }; +') + +####################################### +# +# selinux_read_load_policy_binary(domain) +# +define(`selinux_read_load_policy_binary',` +requires_block_template(selinux_read_load_policy_binary_depend) +allow $1 load_policy_exec_t:file { getattr read }; +') + +define(`selinux_read_load_policy_binary_depend',` +type load_policy_exec_t; +class file { getattr read }; +') + +####################################### +# +# newrole_transition(domain) +# +define(`selinux_newrole_transition',` +requires_block_template(selinux_newrole_transition_depend) +allow $1 newrole_exec_t:file { getattr read execute }; +allow $1 newrole_t:process transition; +type_transition $1 newrole_exec_t:file newrole_t; +dontaudit $1 newrole_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_newrole_transition_depend',` +type newrole_t, newrole_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_newrole_execute(domain) +# +define(`selinux_newrole_execute',` +requires_block_template(selinux_newrole_execute_depend) +allow $1 newrole_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_newrole_execute_depend',` +type newrole_t, newrole_exec_t; +class file { getattr read execute execute_no_trans }; +') + +####################################### +# +# selinux_newrole_sigchld(domain) +# +define(`selinux_newrole_sigchld',` +requires_block_template(selinux_newrole_sigchld_depend) +allow $1 newrole_t:process sigchld; +') + +define(`selinux_newrole_sigchld_depend',` +type newrole_t; +class process sigchld; +') + +####################################### +# +# selinux_restorecon_transition(domain) +# +define(`selinux_restorecon_transition',` +requires_block_template(selinux_restorecon_transition_depend) +allow $1 restorecon_exec_t:file { getattr read execute }; +allow $1 restorecon_t:process transition; +type_transition $1 restorecon_exec_t:file restorecon_t; +dontaudit $1 restorecon_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_restorecon_transition_depend',` +type restorecon_t, restorecon_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_restorecon_execute(domain) +# +define(`selinux_restorecon_execute',` +requires_block_template(selinux_restorecon_execute_depend) +allow $1 restorecon_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_restorecon_execute_depend',` +type restorecon_t, restorecon_exec_t; +class file { getattr read execute execute_no_trans }; +') + +####################################### +# +# selinux_setfiles_transition(domain) +# +define(`selinux_setfiles_transition',` +requires_block_template(selinux_setfiles_transition_depend) +allow $1 setfiles_exec_t:file { getattr read execute }; +allow $1 setfiles_t:process transition; +type_transition $1 setfiles_exec_t:file setfiles_t; +dontaudit $1 setfiles_t:process { noatsecure siginh rlimitinh }; +') + +define(`selinux_setfiles_transition_depend',` +type setfiles_t, setfiles_exec_t; +class file { getattr read execute }; +class process { transition noatsecure siginh rlimitinh }; +') + +####################################### +# +# selinux_setfiles_execute(domain) +# +define(`selinux_setfiles_execute',` +requires_block_template(selinux_setfiles_execute_depend) +allow $1 setfiles_exec_t:file { getattr read execute execute_no_trans }; +') + +define(`selinux_setfiles_execute_depend',` +type setfiles_t, setfiles_exec_t; +class file { getattr read execute execute_no_trans }; +') + ######################################## # # selinux_read_config(domain,[`optional']) @@ -83,17 +271,3 @@ attribute can_write_binary_policy; class dir { getattr search read write add_name remove_name }; class file { getattr create write unlink }; ') - -####################################### -# -# selinux_read_load_policy_binary(domain,[`optional']) -# -define(`selinux_read_load_policy_binary',` -requires_block_template(selinux_read_load_policy_binary_depend,$2) -allow $1 load_policy_exec_t:file { getattr read }; -') - -define(`selinux_read_load_policy_binary_depend',` -type load_policy_exec_t; -class file { getattr read }; -')