add in transition and execute interfaces, and newrole sigchld interface
This commit is contained in:
parent
5eafc37492
commit
85bd7f1ffa
@ -1,5 +1,193 @@
|
|||||||
# Copyright (C) 2005 Tresys Technology, LLC
|
# Copyright (C) 2005 Tresys Technology, LLC
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_checkpolicy_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_checkpolicy_transition',`
|
||||||
|
requires_block_template(selinux_checkpolicy_transition_depend)
|
||||||
|
allow $1 checkpolicy_exec_t:file { getattr read execute };
|
||||||
|
allow $1 checkpolicy_t:process transition;
|
||||||
|
type_transition $1 checkpolicy_exec_t:file checkpolicy_t;
|
||||||
|
dontaudit $1 checkpolicy_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_checkpolicy_transition_depend',`
|
||||||
|
type checkpolicy_t, checkpolicy_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_checkpolicy_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_checkpolicy_execute',`
|
||||||
|
requires_block_template(selinux_checkpolicy_execute_depend)
|
||||||
|
allow $1 checkpolicy_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_checkpolicy_execute_depend',`
|
||||||
|
type checkpolicy_t, checkpolicy_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_load_policy_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_load_policy_transition',`
|
||||||
|
requires_block_template(selinux_load_policy_transition_depend)
|
||||||
|
allow $1 load_policy_exec_t:file { getattr read execute };
|
||||||
|
allow $1 load_policy_t:process transition;
|
||||||
|
type_transition $1 load_policy_exec_t:file load_policy_t;
|
||||||
|
dontaudit $1 load_policy_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_load_policy_transition_depend',`
|
||||||
|
type load_policy_t, load_policy_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_load_policy_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_load_policy_execute',`
|
||||||
|
requires_block_template(selinux_load_policy_execute_depend)
|
||||||
|
allow $1 load_policy_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_load_policy_execute_depend',`
|
||||||
|
type load_policy_t, load_policy_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_read_load_policy_binary(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_read_load_policy_binary',`
|
||||||
|
requires_block_template(selinux_read_load_policy_binary_depend)
|
||||||
|
allow $1 load_policy_exec_t:file { getattr read };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_read_load_policy_binary_depend',`
|
||||||
|
type load_policy_exec_t;
|
||||||
|
class file { getattr read };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# newrole_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_newrole_transition',`
|
||||||
|
requires_block_template(selinux_newrole_transition_depend)
|
||||||
|
allow $1 newrole_exec_t:file { getattr read execute };
|
||||||
|
allow $1 newrole_t:process transition;
|
||||||
|
type_transition $1 newrole_exec_t:file newrole_t;
|
||||||
|
dontaudit $1 newrole_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_newrole_transition_depend',`
|
||||||
|
type newrole_t, newrole_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_newrole_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_newrole_execute',`
|
||||||
|
requires_block_template(selinux_newrole_execute_depend)
|
||||||
|
allow $1 newrole_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_newrole_execute_depend',`
|
||||||
|
type newrole_t, newrole_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_newrole_sigchld(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_newrole_sigchld',`
|
||||||
|
requires_block_template(selinux_newrole_sigchld_depend)
|
||||||
|
allow $1 newrole_t:process sigchld;
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_newrole_sigchld_depend',`
|
||||||
|
type newrole_t;
|
||||||
|
class process sigchld;
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_restorecon_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_restorecon_transition',`
|
||||||
|
requires_block_template(selinux_restorecon_transition_depend)
|
||||||
|
allow $1 restorecon_exec_t:file { getattr read execute };
|
||||||
|
allow $1 restorecon_t:process transition;
|
||||||
|
type_transition $1 restorecon_exec_t:file restorecon_t;
|
||||||
|
dontaudit $1 restorecon_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_restorecon_transition_depend',`
|
||||||
|
type restorecon_t, restorecon_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_restorecon_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_restorecon_execute',`
|
||||||
|
requires_block_template(selinux_restorecon_execute_depend)
|
||||||
|
allow $1 restorecon_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_restorecon_execute_depend',`
|
||||||
|
type restorecon_t, restorecon_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_setfiles_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_setfiles_transition',`
|
||||||
|
requires_block_template(selinux_setfiles_transition_depend)
|
||||||
|
allow $1 setfiles_exec_t:file { getattr read execute };
|
||||||
|
allow $1 setfiles_t:process transition;
|
||||||
|
type_transition $1 setfiles_exec_t:file setfiles_t;
|
||||||
|
dontaudit $1 setfiles_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_setfiles_transition_depend',`
|
||||||
|
type setfiles_t, setfiles_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_setfiles_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_setfiles_execute',`
|
||||||
|
requires_block_template(selinux_setfiles_execute_depend)
|
||||||
|
allow $1 setfiles_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_setfiles_execute_depend',`
|
||||||
|
type setfiles_t, setfiles_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# selinux_read_config(domain,[`optional'])
|
# selinux_read_config(domain,[`optional'])
|
||||||
@ -83,17 +271,3 @@ attribute can_write_binary_policy;
|
|||||||
class dir { getattr search read write add_name remove_name };
|
class dir { getattr search read write add_name remove_name };
|
||||||
class file { getattr create write unlink };
|
class file { getattr create write unlink };
|
||||||
')
|
')
|
||||||
|
|
||||||
#######################################
|
|
||||||
#
|
|
||||||
# selinux_read_load_policy_binary(domain,[`optional'])
|
|
||||||
#
|
|
||||||
define(`selinux_read_load_policy_binary',`
|
|
||||||
requires_block_template(selinux_read_load_policy_binary_depend,$2)
|
|
||||||
allow $1 load_policy_exec_t:file { getattr read };
|
|
||||||
')
|
|
||||||
|
|
||||||
define(`selinux_read_load_policy_binary_depend',`
|
|
||||||
type load_policy_exec_t;
|
|
||||||
class file { getattr read };
|
|
||||||
')
|
|
||||||
|
@ -1,5 +1,193 @@
|
|||||||
# Copyright (C) 2005 Tresys Technology, LLC
|
# Copyright (C) 2005 Tresys Technology, LLC
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_checkpolicy_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_checkpolicy_transition',`
|
||||||
|
requires_block_template(selinux_checkpolicy_transition_depend)
|
||||||
|
allow $1 checkpolicy_exec_t:file { getattr read execute };
|
||||||
|
allow $1 checkpolicy_t:process transition;
|
||||||
|
type_transition $1 checkpolicy_exec_t:file checkpolicy_t;
|
||||||
|
dontaudit $1 checkpolicy_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_checkpolicy_transition_depend',`
|
||||||
|
type checkpolicy_t, checkpolicy_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_checkpolicy_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_checkpolicy_execute',`
|
||||||
|
requires_block_template(selinux_checkpolicy_execute_depend)
|
||||||
|
allow $1 checkpolicy_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_checkpolicy_execute_depend',`
|
||||||
|
type checkpolicy_t, checkpolicy_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_load_policy_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_load_policy_transition',`
|
||||||
|
requires_block_template(selinux_load_policy_transition_depend)
|
||||||
|
allow $1 load_policy_exec_t:file { getattr read execute };
|
||||||
|
allow $1 load_policy_t:process transition;
|
||||||
|
type_transition $1 load_policy_exec_t:file load_policy_t;
|
||||||
|
dontaudit $1 load_policy_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_load_policy_transition_depend',`
|
||||||
|
type load_policy_t, load_policy_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_load_policy_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_load_policy_execute',`
|
||||||
|
requires_block_template(selinux_load_policy_execute_depend)
|
||||||
|
allow $1 load_policy_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_load_policy_execute_depend',`
|
||||||
|
type load_policy_t, load_policy_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_read_load_policy_binary(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_read_load_policy_binary',`
|
||||||
|
requires_block_template(selinux_read_load_policy_binary_depend)
|
||||||
|
allow $1 load_policy_exec_t:file { getattr read };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_read_load_policy_binary_depend',`
|
||||||
|
type load_policy_exec_t;
|
||||||
|
class file { getattr read };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# newrole_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_newrole_transition',`
|
||||||
|
requires_block_template(selinux_newrole_transition_depend)
|
||||||
|
allow $1 newrole_exec_t:file { getattr read execute };
|
||||||
|
allow $1 newrole_t:process transition;
|
||||||
|
type_transition $1 newrole_exec_t:file newrole_t;
|
||||||
|
dontaudit $1 newrole_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_newrole_transition_depend',`
|
||||||
|
type newrole_t, newrole_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_newrole_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_newrole_execute',`
|
||||||
|
requires_block_template(selinux_newrole_execute_depend)
|
||||||
|
allow $1 newrole_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_newrole_execute_depend',`
|
||||||
|
type newrole_t, newrole_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_newrole_sigchld(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_newrole_sigchld',`
|
||||||
|
requires_block_template(selinux_newrole_sigchld_depend)
|
||||||
|
allow $1 newrole_t:process sigchld;
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_newrole_sigchld_depend',`
|
||||||
|
type newrole_t;
|
||||||
|
class process sigchld;
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_restorecon_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_restorecon_transition',`
|
||||||
|
requires_block_template(selinux_restorecon_transition_depend)
|
||||||
|
allow $1 restorecon_exec_t:file { getattr read execute };
|
||||||
|
allow $1 restorecon_t:process transition;
|
||||||
|
type_transition $1 restorecon_exec_t:file restorecon_t;
|
||||||
|
dontaudit $1 restorecon_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_restorecon_transition_depend',`
|
||||||
|
type restorecon_t, restorecon_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_restorecon_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_restorecon_execute',`
|
||||||
|
requires_block_template(selinux_restorecon_execute_depend)
|
||||||
|
allow $1 restorecon_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_restorecon_execute_depend',`
|
||||||
|
type restorecon_t, restorecon_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_setfiles_transition(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_setfiles_transition',`
|
||||||
|
requires_block_template(selinux_setfiles_transition_depend)
|
||||||
|
allow $1 setfiles_exec_t:file { getattr read execute };
|
||||||
|
allow $1 setfiles_t:process transition;
|
||||||
|
type_transition $1 setfiles_exec_t:file setfiles_t;
|
||||||
|
dontaudit $1 setfiles_t:process { noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_setfiles_transition_depend',`
|
||||||
|
type setfiles_t, setfiles_exec_t;
|
||||||
|
class file { getattr read execute };
|
||||||
|
class process { transition noatsecure siginh rlimitinh };
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# selinux_setfiles_execute(domain)
|
||||||
|
#
|
||||||
|
define(`selinux_setfiles_execute',`
|
||||||
|
requires_block_template(selinux_setfiles_execute_depend)
|
||||||
|
allow $1 setfiles_exec_t:file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
|
define(`selinux_setfiles_execute_depend',`
|
||||||
|
type setfiles_t, setfiles_exec_t;
|
||||||
|
class file { getattr read execute execute_no_trans };
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# selinux_read_config(domain,[`optional'])
|
# selinux_read_config(domain,[`optional'])
|
||||||
@ -83,17 +271,3 @@ attribute can_write_binary_policy;
|
|||||||
class dir { getattr search read write add_name remove_name };
|
class dir { getattr search read write add_name remove_name };
|
||||||
class file { getattr create write unlink };
|
class file { getattr create write unlink };
|
||||||
')
|
')
|
||||||
|
|
||||||
#######################################
|
|
||||||
#
|
|
||||||
# selinux_read_load_policy_binary(domain,[`optional'])
|
|
||||||
#
|
|
||||||
define(`selinux_read_load_policy_binary',`
|
|
||||||
requires_block_template(selinux_read_load_policy_binary_depend,$2)
|
|
||||||
allow $1 load_policy_exec_t:file { getattr read };
|
|
||||||
')
|
|
||||||
|
|
||||||
define(`selinux_read_load_policy_binary_depend',`
|
|
||||||
type load_policy_exec_t;
|
|
||||||
class file { getattr read };
|
|
||||||
')
|
|
||||||
|
Loading…
Reference in New Issue
Block a user