rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

clean up userdom_create_user_home()

This commit is contained in:
Chris PeBenito 2006-02-03 16:13:15 +00:00
parent ee9500ec86
commit 9417cb7ad1
11 changed files with 69 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
refpolicy/policy/modules/apps/irc.if
View File

@ -65,7 +65,7 @@ template(`irc_per_userdomain_template',`
allow $1_irc_t $1_irc_home_t:dir create_dir_perms;
allow $1_irc_t $1_irc_home_t:file create_file_perms;
allow $1_irc_t $1_irc_home_t:lnk_file create_lnk_perms;
userdom_create_user_home($1,$1_irc_t,{ dir file lnk_file },$1_irc_home_t)
userdom_filetrans_user_home_dir($1,$1_irc_t,$1_irc_home_t,{ dir file lnk_file })
# access files under /tmp
allow $1_irc_t $1_irc_tmp_t:dir create_dir_perms;

2
refpolicy/policy/modules/apps/java.if
View File

@ -126,12 +126,12 @@ template(`java_per_userdomain_template',`
userdom_dontaudit_use_user_terminals($1,$1_javaplugin_t)
userdom_dontaudit_setattr_user_home_files($1,$1_javaplugin_t)
userdom_dontaudit_exec_user_home_files($1,$1_javaplugin_t)
userdom_create_user_home($1,$1_javaplugin_t,{ file lnk_file sock_file fifo_file },$1_home_t)
userdom_manage_user_home_subdirs($1,$1_javaplugin_t)
userdom_manage_user_home_subdir_files($1,$1_javaplugin_t)
userdom_manage_user_home_subdir_symlinks($1,$1_javaplugin_t)
userdom_manage_user_home_subdir_pipes($1,$1_javaplugin_t)
userdom_manage_user_home_subdir_sockets($1,$1_javaplugin_t)
userdom_filetrans_user_home($1,$1_javaplugin_t,{ file lnk_file sock_file fifo_file })
# libdeploy.so legacy
tunable_policy(`allow_execmem',`

2
refpolicy/policy/modules/services/cron.if
View File

@ -142,7 +142,7 @@ template(`cron_per_userdomain_template',`
userdom_manage_user_home_subdir_symlinks($1,$1_crond_t)
userdom_manage_user_home_subdir_pipes($1,$1_crond_t)
userdom_manage_user_home_subdir_sockets($1,$1_crond_t)
# userdom_create_user_home($1,$1_crond_t,notdevfile_class_set)
# userdom_filetrans_user_home($1,$1_crond_t,notdevfile_class_set)
tunable_policy(`fcron_crond', `
allow crond_t $1_cron_spool_t:file create_file_perms;

2
refpolicy/policy/modules/services/cron.te
View File

@ -159,7 +159,7 @@ ifdef(`targeted_policy',`
userdom_manage_user_home_subdir_symlinks(user,crond_t)
userdom_manage_user_home_subdir_pipes(user,crond_t)
userdom_manage_user_home_subdir_sockets(user,crond_t)
userdom_create_user_home(user,crond_t,{ dir file lnk_file fifo_file sock_file })
userdom_filetrans_user_home(user,crond_t,{ dir file lnk_file fifo_file sock_file })
allow crond_t unconfined_t:dbus send_msg;
allow crond_t initrc_t:dbus send_msg;

6
refpolicy/policy/modules/services/ftp.if
View File

@ -22,16 +22,12 @@
## </param>
#
template(`ftp_per_userdomain_template',`
gen_require(`
type ftpd_t;
')
tunable_policy(`ftpd_is_daemon',`
userdom_manage_user_home_subdir_files($1,ftpd_t)
userdom_manage_user_home_subdir_symlinks($1,ftpd_t)
userdom_manage_user_home_subdir_sockets($1,ftpd_t)
userdom_manage_user_home_subdir_pipes($1,ftpd_t)
userdom_create_user_home($1,ftpd_t,{ dir file lnk_file sock_file fifo_file })
userdom_filetrans_user_home($1,ftpd_t,{ dir file lnk_file sock_file fifo_file })
')
')

2
refpolicy/policy/modules/services/ftp.te
View File

@ -142,7 +142,7 @@ ifdef(`targeted_policy',`
userdom_manage_user_home_subdir_symlinks(user,ftpd_t)
userdom_manage_user_home_subdir_sockets(user,ftpd_t)
userdom_manage_user_home_subdir_pipes(user,ftpd_t)
userdom_create_user_home(user,ftpd_t,{ dir file lnk_file sock_file fifo_file })
userdom_filetrans_user_home(user,ftpd_t,{ dir file lnk_file sock_file fifo_file })
')
')
')

19
refpolicy/policy/modules/services/mta.if
View File

@ -36,11 +36,6 @@ interface(`mta_stub',`
#
template(`mta_base_mail_template',`
gen_require(`
attribute user_mail_domain;
type sendmail_exec_t;
')
##############################
#
# $1_mail_t declarations
@ -175,11 +170,11 @@ template(`mta_base_mail_template',`
## </param>
#
template(`mta_per_userdomain_template',`
gen_require(`
attribute mailserver_domain, mta_user_agent;
attribute mailserver_delivery, user_mail_domain;
type sendmail_exec_t;
')
##############################
#
# Declarations
#
mta_base_mail_template($1)
role $3 types $1_mail_t;
@ -210,7 +205,7 @@ template(`mta_per_userdomain_template',`
userdom_use_user_terminals($1,mta_user_agent)
# Create dead.letter in user home directories.
userdom_manage_user_home_subdir_files($1,$1_mail_t)
userdom_create_user_home($1,$1_mail_t,file)
userdom_filetrans_user_home($1,$1_mail_t,file)
# for reading .forward - maybe we need a new type for it?
# also for delivering mail to maildir
userdom_manage_user_home_subdirs($1,mailserver_delivery)
@ -218,7 +213,7 @@ template(`mta_per_userdomain_template',`
userdom_manage_user_home_subdir_symlinks($1,mailserver_delivery)
userdom_manage_user_home_subdir_pipes($1,mailserver_delivery)
userdom_manage_user_home_subdir_sockets($1,mailserver_delivery)
userdom_create_user_home($1,mailserver_delivery,{ dir file lnk_file fifo_file sock_file })
userdom_filetrans_user_home($1,mailserver_delivery,{ dir file lnk_file fifo_file sock_file })
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files($1_mail_t)

2
refpolicy/policy/modules/services/mta.te
View File

@ -79,7 +79,7 @@ ifdef(`targeted_policy',`
userdom_manage_user_home_subdir_symlinks(user,mailserver_delivery)
userdom_manage_user_home_subdir_pipes(user,mailserver_delivery)
userdom_manage_user_home_subdir_sockets(user,mailserver_delivery)
userdom_create_user_home(user,mailserver_delivery,{ dir file lnk_file fifo_file sock_file })
userdom_filetrans_user_home(user,mailserver_delivery,{ dir file lnk_file fifo_file sock_file })
# cjp: another require-in-else to resolve
# optional_policy(`postfix',`',`

6
refpolicy/policy/modules/services/samba.if
View File

@ -26,16 +26,12 @@
## </param>
#
template(`samba_per_userdomain_template',`
gen_require(`
type smbd_t;
')
tunable_policy(`samba_enable_home_dirs',`
userdom_manage_user_home_subdir_files($1,smbd_t)
userdom_manage_user_home_subdir_symlinks($1,smbd_t)
userdom_manage_user_home_subdir_sockets($1,smbd_t)
userdom_manage_user_home_subdir_pipes($1,smbd_t)
userdom_create_user_home($1,smbd_t,{ dir file lnk_file sock_file fifo_file })
userdom_filetrans_user_home($1,smbd_t,{ dir file lnk_file sock_file fifo_file })
')
')

13
refpolicy/policy/modules/services/spamassassin.if
View File

@ -28,10 +28,11 @@
# cjp: when tunables are available, spamc stuff should be
# toggled on activation of spamc, and similarly for spamd.
template(`spamassassin_per_userdomain_template',`
gen_require(`
type spamd_t, spamd_tmp_t;
type spamc_exec_t, spamassassin_exec_t;
')
##############################
#
# Declarations
#
type $1_spamc_t;
domain_type($1_spamc_t)
@ -194,7 +195,7 @@ template(`spamassassin_per_userdomain_template',`
allow $1_spamassassin_t $1_spamassassin_home_t:lnk_file create_lnk_perms;
allow $1_spamassassin_t $1_spamassassin_home_t:sock_file create_file_perms;
allow $1_spamassassin_t $1_spamassassin_home_t:fifo_file create_file_perms;
userdom_create_user_home($1,$1_spamassassin_t,{ dir file lnk_file sock_file fifo_file },$1_spamassassin_home_t)
userdom_filetrans_user_home_dir($1,$1_spamassassin_t,$1_spamassassin_home_t,{ dir file lnk_file sock_file fifo_file })
allow $1_spamassassin_t $1_spamassassin_tmp_t:dir create_dir_perms;
allow $1_spamassassin_t $1_spamassassin_tmp_t:file create_file_perms;
@ -215,7 +216,7 @@ template(`spamassassin_per_userdomain_template',`
allow spamd_t $1_spamassassin_home_t:lnk_file create_lnk_perms;
allow spamd_t $1_spamassassin_home_t:sock_file create_file_perms;
allow spamd_t $1_spamassassin_home_t:fifo_file create_file_perms;
userdom_create_user_home($1,spamd_t,{ dir file lnk_file sock_file fifo_file },$1_spamassassin_home_t)
userdom_filetrans_user_home_dir($1,spamd_t,$1_spamassassin_home_t,{ dir file lnk_file sock_file fifo_file })
kernel_read_kernel_sysctls($1_spamassassin_t)

111
refpolicy/policy/modules/system/userdomain.if
View File

@ -1569,68 +1569,15 @@ template(`userdom_manage_user_home_subdir_sockets',`
########################################
## <summary>
##
## Create objects in a user home directory
## with an automatic type transition to
## a specified private type.
## </summary>
## <desc>
## <p>
## Create, read, write, and delete named sockets
## in a user home subdirectory.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </param>
## <param name="domain">
## Domain allowed access.
## </param>
## <param name="object_class" optional="true">
## The class of the object to be created. If not
## specified, file is used.
## </param>
## <param name="private_type" optional="true">
## The type of the object to create. If this is
## not specified, the regular home directory
## type is used.
## </param>
#
template(`userdom_create_user_home',`
gen_require(`
type $1_home_dir_t, $1_home_t;
')
files_search_home($2)
allow $2 $1_home_dir_t:dir rw_dir_perms;
ifelse(`$4',`',`
ifelse(`$3',`',`
type_transition $2 $1_home_dir_t:file $1_home_t;
',`
type_transition $2 $1_home_dir_t:$3 $1_home_t;
')
',`
ifelse(`$3',`',`
type_transition $2 $1_home_dir_t:file $4;
',`
type_transition $2 $1_home_dir_t:$3 $4;
')
')
')
########################################
## <summary>
## Create objects in a user home directory with
## a type transition to a specified type.
## </summary>
## <desc>
## <p>
## Create objects in a user home directory with
## a type transition to a specified type.
## Create objects in a user home directory
## with an automatic type transition to
## a specified private type.
## </p>
## <p>
## This is a templated interface, and should only
@ -1645,9 +1592,7 @@ template(`userdom_create_user_home',`
## Domain allowed access.
## </param>
## <param name="private_type">
## The type of the object to create. If this is
## not specified, the regular home directory
## type is used.
## The type of the object to create.
## </param>
## <param name="object_class">
## The class of the object to be created. If not
@ -1655,14 +1600,52 @@ template(`userdom_create_user_home',`
## </param>
#
template(`userdom_filetrans_user_home_dir',`
gen_require(`
type $1_home_dir_t;
')
files_search_home($2)
allow $2 $1_home_dir_t:dir rw_dir_perms;
type_transition $2 $1_home_dir_t:$4 $3;
')
########################################
## <summary>
## Create objects in a user home directory
## with an automatic type transition to
## the user home file type.
## </summary>
## <desc>
## <p>
## Create objects in a user home directory
## with an automatic type transition to
## the user home file type.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </param>
## <param name="domain">
## Domain allowed access.
## </param>
## <param name="object_class">
## The class of the object to be created. If not
## specified, file is used.
## </param>
#
template(`userdom_filetrans_user_home',`
gen_require(`
type $1_home_dir_t, $1_home_t;
')
files_search_home($2)
allow $2 $1_home_dir_t:dir rw_dir_perms;
type_transition $2 $1_home_dir_t:$4 $3;
type_transition $2 $1_home_dir_t:$3 $1_home_t;
')
########################################