Update f14
This commit is contained in:
Dan Walsh
parent
83eff061a3
commit
a947daf6df
@ -1,3 +0,0 @@
|
||||
/usr/libexec/accounts-daemon -- gen_context(system_u:object_r:accountsd_exec_t,s0)
|
||||
|
||||
/var/lib/AccountsService(/.*)? gen_context(system_u:object_r:accountsd_var_lib_t,s0)
|
||||
@ -1,173 +0,0 @@
|
||||
## <summary>Accountsservice D-Bus interfaces for querying and manipulating user account information.</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to
|
||||
## run Account Service daemon.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_domtrans',`
|
||||
gen_require(`
|
||||
type accountsd_t, accountsd_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1, accountsd_exec_t, accountsd_t)
|
||||
corecmd_search_bin($1)
|
||||
files_search_usr($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search Accounts Service daemon
|
||||
## lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_search_lib',`
|
||||
gen_require(`
|
||||
type accountsd_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 accountsd_var_lib_t:dir search_dir_perms;
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read Accounts Service daemon
|
||||
## lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_read_lib_files',`
|
||||
gen_require(`
|
||||
type accountsd_var_lib_t;
|
||||
')
|
||||
|
||||
read_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage Account Service daemon
|
||||
## lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_manage_lib_files',`
|
||||
gen_require(`
|
||||
type accountsd_var_lib_t;
|
||||
')
|
||||
|
||||
manage_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage Account Service daemon
|
||||
## lib content.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_manage_var_lib',`
|
||||
gen_require(`
|
||||
type accountsd_var_lib_t;
|
||||
')
|
||||
|
||||
manage_dirs_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
|
||||
manage_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
|
||||
manage_lnk_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Send and receive messages from
|
||||
## Account Service daemon over dbus.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_dbus_chat',`
|
||||
gen_require(`
|
||||
type accountsd_t;
|
||||
class dbus send_msg;
|
||||
')
|
||||
|
||||
allow $1 accountsd_t:dbus send_msg;
|
||||
allow accountsd_t $1:dbus send_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to read and
|
||||
## write Account Service daemon pipes.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`accountsd_dontaudit_rw_fifo_file',`
|
||||
gen_require(`
|
||||
type accountsd_t;
|
||||
')
|
||||
|
||||
dontaudit $1 accountsd_t:fifo_file rw_inherited_fifo_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an Account Service daemon environment.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`accountsd_admin',`
|
||||
gen_require(`
|
||||
type accountsd_t, accountsd_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 accountsd_t:process { ptrace signal_perms };
|
||||
read_files_pattern($1, accountsd_t, accountsd_t)
|
||||
|
||||
admin_pattern($1, accountsd_var_lib_t)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
@ -35,71 +35,13 @@ interface(`gnome_role',`
|
||||
allow $2 gconfd_t:unix_stream_socket connectto;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute gconf programs in
|
||||
## in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`gnome_exec_gconf',`
|
||||
gen_require(`
|
||||
type gconfd_exec_t;
|
||||
')
|
||||
|
||||
can_exec($1, gconfd_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read gconf config files.
|
||||
## </summary>
|
||||
## <param name="user_domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
template(`gnome_read_gconf_config',`
|
||||
gen_require(`
|
||||
type gconf_etc_t;
|
||||
')
|
||||
|
||||
allow $1 gconf_etc_t:dir list_dir_perms;
|
||||
read_files_pattern($1, gconf_etc_t, gconf_etc_t)
|
||||
files_search_etc($1)
|
||||
')
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete gconf config files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`gnome_manage_gconf_config',`
|
||||
gen_require(`
|
||||
type gconf_etc_t;
|
||||
')
|
||||
|
||||
manage_files_pattern($1, gconf_etc_t, gconf_etc_t)
|
||||
files_search_etc($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## gconf connection template.
|
||||
## </summary>
|
||||
## <param name="user_domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## The type of the user domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
@ -132,22 +74,41 @@ interface(`gnome_domtrans_gconfd',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read gnome homedir content (.config)
|
||||
## Dontaudit search gnome homedir content (.config)
|
||||
## </summary>
|
||||
## <param name="user_domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## The type of the user domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
template(`gnome_read_config',`
|
||||
interface(`gnome_dontaudit_search_config',`
|
||||
gen_require(`
|
||||
attribute gnome_home_type;
|
||||
')
|
||||
|
||||
list_dirs_pattern($1, gnome_home_type, gnome_home_type)
|
||||
read_files_pattern($1, gnome_home_type, gnome_home_type)
|
||||
read_lnk_files_pattern($1, gnome_home_type, gnome_home_type)
|
||||
dontaudit $1 gnome_home_type:dir search_dir_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## manage gnome homedir content (.config)
|
||||
## </summary>
|
||||
## <param name="user_domain">
|
||||
## <summary>
|
||||
## The type of the user domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`gnome_manage_config',`
|
||||
gen_require(`
|
||||
attribute gnome_home_type;
|
||||
')
|
||||
|
||||
allow $1 gnome_home_type:dir manage_dir_perms;
|
||||
allow $1 gnome_home_type:file manage_file_perms;
|
||||
allow $1 gnome_home_type:lnk_file manage_lnk_file_perms;
|
||||
userdom_search_user_home_dirs($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -256,6 +217,45 @@ interface(`gnome_write_generic_cache_files',`
|
||||
userdom_search_user_home_dirs($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## read gnome homedir content (.config)
|
||||
## </summary>
|
||||
## <param name="user_domain">
|
||||
## <summary>
|
||||
## The type of the user domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
template(`gnome_read_config',`
|
||||
gen_require(`
|
||||
attribute gnome_home_type;
|
||||
')
|
||||
|
||||
list_dirs_pattern($1, gnome_home_type, gnome_home_type)
|
||||
read_files_pattern($1, gnome_home_type, gnome_home_type)
|
||||
read_lnk_files_pattern($1, gnome_home_type, gnome_home_type)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Set attributes of Gnome config dirs.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`gnome_setattr_config_dirs',`
|
||||
gen_require(`
|
||||
type gnome_home_t;
|
||||
')
|
||||
|
||||
setattr_dirs_pattern($1, gnome_home_t, gnome_home_t)
|
||||
files_search_home($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create objects in a Gnome gconf home directory
|
||||
@ -525,62 +525,3 @@ interface(`gnome_dbus_chat_gconfdefault',`
|
||||
allow $1 gconfdefaultsm_t:dbus send_msg;
|
||||
allow gconfdefaultsm_t $1:dbus send_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Dontaudit search gnome homedir content (.config)
|
||||
## </summary>
|
||||
## <param name="user_domain">
|
||||
## <summary>
|
||||
## The type of the user domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`gnome_dontaudit_search_config',`
|
||||
gen_require(`
|
||||
attribute gnome_home_type;
|
||||
')
|
||||
|
||||
dontaudit $1 gnome_home_type:dir search_dir_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Set attributes of Gnome config dirs.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`gnome_setattr_config_dirs',`
|
||||
gen_require(`
|
||||
type gnome_home_t;
|
||||
')
|
||||
|
||||
setattr_dirs_pattern($1, gnome_home_t, gnome_home_t)
|
||||
files_search_home($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## manage gnome homedir content (.config)
|
||||
## </summary>
|
||||
## <param name="user_domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`gnome_manage_config',`
|
||||
gen_require(`
|
||||
attribute gnome_home_type;
|
||||
')
|
||||
|
||||
allow $1 gnome_home_type:dir manage_dir_perms;
|
||||
allow $1 gnome_home_type:file manage_file_perms;
|
||||
allow $1 gnome_home_type:lnk_file manage_lnk_file_perms;
|
||||
userdom_search_user_home_dirs($1)
|
||||
')
|
||||
|
||||
|
||||
@ -50,8 +50,8 @@ manage_dirs_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
|
||||
manage_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
|
||||
manage_sock_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
|
||||
exec_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
|
||||
files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file})
|
||||
userdom_user_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file})
|
||||
files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file })
|
||||
userdom_user_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file })
|
||||
userdom_dontaudit_setattr_user_tmp(telepathy_msn_t)
|
||||
|
||||
corenet_sendrecv_http_client_packets(telepathy_msn_t)
|
||||
|
||||
@ -5308,25 +5308,6 @@ interface(`files_getattr_generic_locks',`
|
||||
getattr_files_pattern($1, var_lock_t, var_lock_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Delete generic lock files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`files_delete_generic_locks',`
|
||||
gen_require(`
|
||||
type var_t, var_lock_t;
|
||||
')
|
||||
|
||||
allow $1 var_t:dir search_dir_perms;
|
||||
delete_files_pattern($1, var_lock_t, var_lock_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete generic
|
||||
|
||||
@ -1233,11 +1233,13 @@ interface(`term_dontaudit_use_unallocated_ttys',`
|
||||
#
|
||||
interface(`term_getattr_all_ttys',`
|
||||
gen_require(`
|
||||
type tty_device_t;
|
||||
attribute ttynode;
|
||||
')
|
||||
|
||||
dev_list_all_dev_nodes($1)
|
||||
allow $1 ttynode:chr_file getattr;
|
||||
allow $1 tty_device_t:chr_file getattr;
|
||||
')
|
||||
|
||||
########################################
|
||||
|
||||
@ -5,52 +5,15 @@ policy_module(dbadm, 1.0.0)
|
||||
# Declarations
|
||||
#
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow dbadm to manage files in users home directories
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(dbadm_manage_user_files, false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow dbadm to read files in users home directories
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(dbadm_read_user_files, false)
|
||||
|
||||
role dbadm_r;
|
||||
|
||||
userdom_base_user_template(dbadm)
|
||||
userdom_unpriv_user_template(dbadm)
|
||||
|
||||
########################################
|
||||
#
|
||||
# database admin local policy
|
||||
#
|
||||
|
||||
allow dbadm_t self:capability { dac_override dac_read_search sys_ptrace };
|
||||
|
||||
files_dontaudit_search_all_dirs(dbadm_t)
|
||||
files_delete_generic_locks(dbadm_t)
|
||||
files_list_var(dbadm_t)
|
||||
|
||||
selinux_get_enforce_mode(dbadm_t)
|
||||
|
||||
logging_send_syslog_msg(dbadm_t)
|
||||
|
||||
userdom_dontaudit_search_user_home_dirs(dbadm_t)
|
||||
|
||||
tunable_policy(`dbadm_manage_user_files',`
|
||||
userdom_manage_user_home_content_files(dbadm_t)
|
||||
userdom_read_user_tmp_files(dbadm_t)
|
||||
userdom_write_user_tmp_files(dbadm_t)
|
||||
')
|
||||
|
||||
tunable_policy(`dbadm_read_user_files',`
|
||||
userdom_read_user_home_content_files(dbadm_t)
|
||||
userdom_read_user_tmp_files(dbadm_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
mysql_admin(dbadm_t, dbadm_r)
|
||||
')
|
||||
@ -58,3 +21,12 @@ optional_policy(`
|
||||
optional_policy(`
|
||||
postgresql_admin(dbadm_t, dbadm_r)
|
||||
')
|
||||
|
||||
# For starting up daemon processes
|
||||
optional_policy(`
|
||||
su_role_template(dbadm, dbadm_r, dbadm_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
sudo_role_template(dbadm, dbadm_r, dbadm_t)
|
||||
')
|
||||
|
||||
@ -8,6 +8,8 @@ policy_module(accountsd, 1.0.0)
|
||||
type accountsd_t;
|
||||
type accountsd_exec_t;
|
||||
dbus_system_domain(accountsd_t, accountsd_exec_t)
|
||||
init_daemon_domain(accountsd_t, accountsd_exec_t)
|
||||
role system_r types accountsd_t;
|
||||
|
||||
type accountsd_var_lib_t;
|
||||
files_type(accountsd_var_lib_t)
|
||||
@ -55,3 +57,8 @@ optional_policy(`
|
||||
optional_policy(`
|
||||
policykit_dbus_chat(accountsd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_dbus_chat_xdm(accountsd_t)
|
||||
xserver_manage_xdm_etc_files(accountsd_t)
|
||||
')
|
||||
|
||||
@ -678,6 +678,7 @@ list_dirs_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
|
||||
rw_dirs_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
|
||||
read_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
|
||||
read_lnk_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
|
||||
allow cronjob_t user_cron_spool_t:file create_lnk_perms;
|
||||
|
||||
tunable_policy(`fcron_crond', `
|
||||
allow crond_t user_cron_spool_t:file manage_file_perms;
|
||||
|
||||
@ -446,7 +446,9 @@ files_mounton_default(initrc_t)
|
||||
files_manage_mnt_dirs(initrc_t)
|
||||
files_manage_mnt_files(initrc_t)
|
||||
|
||||
fs_write_cgroup_files(initrc_t)
|
||||
fs_delete_cgroup_dirs(initrc_t)
|
||||
fs_list_cgroup_dirs(initrc_t)
|
||||
fs_rw_cgroup_files(initrc_t)
|
||||
fs_list_inotifyfs(initrc_t)
|
||||
fs_register_binary_executable_type(initrc_t)
|
||||
# rhgb-console writes to ramfs
|
||||
|
||||
Loading…
Reference in New Issue
Block a user