Accountsd cleanup.
This commit is contained in:
parent
d0eebed0b7
commit
8da88970be
@ -18,6 +18,46 @@ interface(`accountsd_domtrans',`
|
||||
domtrans_pattern($1, accountsd_exec_t, accountsd_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to read and write Accounts Daemon
|
||||
## fifo file.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_dontaudit_rw_fifo_file',`
|
||||
gen_require(`
|
||||
type accountsd_t;
|
||||
')
|
||||
|
||||
dontaudit $1 accountsd_t:fifo_file rw_fifo_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Send and receive messages from
|
||||
## accountsd over dbus.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_dbus_chat',`
|
||||
gen_require(`
|
||||
type accountsd_t;
|
||||
class dbus send_msg;
|
||||
')
|
||||
|
||||
allow $1 accountsd_t:dbus send_msg;
|
||||
allow accountsd_t $1:dbus send_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search accountsd lib directories.
|
||||
@ -76,46 +116,6 @@ interface(`accountsd_manage_lib_files',`
|
||||
manage_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Send and receive messages from
|
||||
## accountsd over dbus.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_dbus_chat',`
|
||||
gen_require(`
|
||||
type accountsd_t;
|
||||
class dbus send_msg;
|
||||
')
|
||||
|
||||
allow $1 accountsd_t:dbus send_msg;
|
||||
allow accountsd_t $1:dbus send_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to read and write Accounts Daemon
|
||||
## fifo file.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_dontaudit_rw_fifo_file',`
|
||||
gen_require(`
|
||||
type accountsd_t;
|
||||
')
|
||||
|
||||
dontaudit $1 accountsd_t:fifo_file rw_inherited_fifo_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
@ -137,8 +137,9 @@ interface(`accountsd_admin',`
|
||||
gen_require(`
|
||||
type accountsd_t;
|
||||
')
|
||||
|
||||
allow $1 accountsd_t:process { ptrace signal_perms getattr };
|
||||
read_files_pattern($1, accountsd_t, accountsd_t)
|
||||
ps_process_pattern($1, accountsd_t)
|
||||
|
||||
accountsd_manage_lib_files($1)
|
||||
')
|
||||
|
@ -16,8 +16,8 @@ files_type(accountsd_var_lib_t)
|
||||
#
|
||||
# accountsd local policy
|
||||
#
|
||||
allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace };
|
||||
|
||||
allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace };
|
||||
allow accountsd_t self:fifo_file rw_fifo_file_perms;
|
||||
|
||||
manage_dirs_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t)
|
||||
|
Loading…
Reference in New Issue
Block a user