rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

move make_{daemon,init,system}_domain to init to fix type_transition'ing

Browse Source
This commit is contained in:
Chris PeBenito 2005-05-13 20:21:50 +00:00
parent 24a7ae1a5a
commit ff31386090
26 changed files with 125 additions and 179 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
refpolicy/policy/modules/admin/consoletype.te
View File

@ -9,8 +9,8 @@ policy_module(consoletype, 1.0)
type consoletype_t;
type consoletype_exec_t;
domain_make_init_domain(consoletype_t,consoletype_exec_t)
domain_make_system_domain(consoletype_t,consoletype_exec_t)
init_make_init_domain(consoletype_t,consoletype_exec_t)
init_make_system_domain(consoletype_t,consoletype_exec_t)
role system_r types consoletype_t;
########################################

6
refpolicy/policy/modules/admin/netutils.te
View File

@ -9,7 +9,7 @@ policy_module(devices,1.0)
type netutils_t;
type netutils_exec_t;
domain_make_system_domain(netutils_t,netutils_exec_t)
init_make_system_domain(netutils_t,netutils_exec_t)
role system_r types netutils_t;
type netutils_tmp_t;
@ -17,12 +17,12 @@ files_make_temporary_file(netutils_tmp_t)
type ping_t; #, nscd_client_domain;
type ping_exec_t;
domain_make_system_domain(ping_t,ping_exec_t)
init_make_system_domain(ping_t,ping_exec_t)
role system_r types ping_t;
type traceroute_t; #, nscd_client_domain;
type traceroute_exec_t;
domain_make_system_domain(traceroute_t,traceroute_exec_t)
init_make_system_domain(traceroute_t,traceroute_exec_t)
role system_r types traceroute_t;
#

4
refpolicy/policy/modules/admin/usermanage.te
View File

@ -33,7 +33,7 @@ files_make_temporary_file(crack_tmp_t)
type groupadd_t; #, nscd_client_domain;
type groupadd_exec_t;
kernel_make_object_identity_change_constraint_exception(groupadd_t)
domain_make_system_domain(groupadd_t,groupadd_exec_t)
init_make_system_domain(groupadd_t,groupadd_exec_t)
role system_r types groupadd_t;
type passwd_t;
@ -55,7 +55,7 @@ files_make_file(sysadm_passwd_tmp_t)
type useradd_t; # nscd_client_domain;
type useradd_exec_t;
kernel_make_object_identity_change_constraint_exception(useradd_t)
domain_make_system_domain(useradd_t,useradd_exec_t)
init_make_system_domain(useradd_t,useradd_exec_t)
role system_r types useradd_t;
########################################

36
refpolicy/policy/modules/kernel/kernel.if
View File

@ -1,5 +1,23 @@
# Copyright (C) 2005 Tresys Technology, LLC
########################################
#
# kernel_make_userland_entrypoint(domain,entrypoint)
#
define(`kernel_make_userland_entrypoint',`
requires_block_template(`$0'_depend)
allow kernel_t $2:file { getattr read execute };
allow kernel_t $1:process transition;
type_transition kernel_t $2:process $1;
dontaudit kernel_t $1:process { noatsecure siginh rlimitinh };
')
define(`kernel_make_userland_entrypoint_depend',`
type kernel_t;
class process { transition noatsecure siginh rlimitinh };
class file { getattr read execute };
')
########################################
#
# kernel_share_state(domain)
@ -1069,24 +1087,6 @@ class lnk_file { getattr read };
# #
###################################################################
########################################
#
# kernel_transition_from(domain,entrypoint)
#
define(`kernel_transition_from',`
requires_block_template(`$0'_depend)
allow kernel_t $2:file { getattr read execute };
allow kernel_t $1:process transition;
type_transition kernel_t $2:process $1;
dontaudit kernel_t $1:process { noatsecure siginh rlimitinh };
')
define(`kernel_transition_from_depend',`
type kernel_t;
class file { getattr read execute };
class process transition;
')
########################################
#
# kernel_sigchld_from(domain)

4
refpolicy/policy/modules/services/cron.te
View File

@ -18,7 +18,7 @@ files_make_file(cron_spool_t)
type crond_t; #, privmail, nscd_client_domain
type crond_exec_t;
domain_make_daemon_domain(crond_t,crond_exec_t)
init_make_daemon_domain(crond_t,crond_exec_t)
domain_make_file_descriptors_widely_inheritable(crond_t)
type crond_log_t;
@ -35,7 +35,7 @@ files_make_file(crontab_exec_t)
type system_cron_spool_t;
type system_crond_t; #, privmail, nscd_client_domain;
domain_make_daemon_domain(system_crond_t,anacron_exec_t)
init_make_daemon_domain(system_crond_t,anacron_exec_t)
corecommands_make_shell_entrypoint(system_crond_t)
role system_r types system_crond_t;

2
refpolicy/policy/modules/services/mta.if
View File

@ -142,7 +142,7 @@ define(`mta_per_userdomain_template_depend',`
#
define(`mta_make_mailserver_domain',`
requires_block_template(`$0'_depend)
domain_make_daemon_domain($1,$2)
init_make_daemon_domain($1,$2)
typeattribute $1 mailserver_domain;
')

2
refpolicy/policy/modules/services/mta.te
View File

@ -32,7 +32,7 @@ tunable_policy(`targeted_policy',`',`
optional_policy(`sendmail.te', `
domain_make_entrypoint_file(system_mail_t,sendmail_exec_t)
', `
domain_make_system_domain(system_mail_t,sendmail_exec_t)
init_make_system_domain(system_mail_t,sendmail_exec_t)
') dnl end if sendmail
') dnl end targeted_policy

2
refpolicy/policy/modules/system/authlogin.te
View File

@ -25,7 +25,7 @@ files_make_file(login_exec_t)
type pam_console_t;
type pam_console_exec_t;
domain_make_system_domain(pam_console_t,pam_console_exec_t)
init_make_system_domain(pam_console_t,pam_console_exec_t)
role system_r types pam_console_t;
domain_make_entrypoint_file(pam_console_t,pam_console_exec_t)

2
refpolicy/policy/modules/system/clock.te
View File

@ -12,7 +12,7 @@ files_make_file(adjtime_t)
type hwclock_t;
type hwclock_exec_t;
domain_make_system_domain(hwclock_t,hwclock_exec_t)
init_make_system_domain(hwclock_t,hwclock_exec_t)
role system_r types hwclock_t;
########################################

108
refpolicy/policy/modules/system/domain.if
View File

@ -62,60 +62,6 @@ attribute entry_type;
class file entrypoint;
')
########################################
#
# domain_make_init_domain(domain,entrypointfile)
#
define(`domain_make_init_domain',`
requires_block_template(`$0'_depend)
domain_make_domain($1)
domain_make_entrypoint_file($1,$2)
typeattribute $1 init_domain;
typeattribute $2 init_domain_entry;
role system_r types $1;
')
define(`domain_make_init_domain_depend',`
attribute init_domain, init_domain_entry;
role system_r;
')
########################################
#
# domain_make_daemon_domain(domain,entrypointfile)
#
define(`domain_make_daemon_domain',`
requires_block_template(`$0'_depend)
domain_make_domain($1)
domain_make_entrypoint_file($1,$2)
typeattribute $1 daemon_domain;
typeattribute $2 daemon_domain_entry;
role system_r types $1;
')
define(`domain_make_daemon_domain_depend',`
attribute init_domain, init_domain_entry;
role system_r;
')
########################################
#
# domain_make_system_domain(domain,entrypointfile)
#
define(`domain_make_system_domain',`
requires_block_template(`$0'_depend)
domain_make_domain($1)
domain_make_entrypoint_file($1,$2)
typeattribute $1 system_domain;
typeattribute $2 system_domain_entry;
role system_r types $1;
')
define(`domain_make_system_domain_depend',`
attribute system_domain, system_domain_entry;
role system_r;
')
########################################
#
# domain_make_file_descriptors_widely_inheritable(domain)
@ -157,60 +103,6 @@ attribute privfd;
class fd use;
')
########################################
#
# domain_all_init_domains_transition(domain)
#
define(`domain_all_init_domains_transition',`
requires_block_template(`$0'_depend)
allow $1 init_domain:process transition;
allow $1 init_domain_entry:file { getattr read execute };
dontaudit $1 init_domain:process { noatsecure siginh rlimitinh };
')
define(`domain_all_init_domains_transition_depend',`
attribute init_domain, init_domain_entry;
class process { transition noatsecure siginh rlimitinh };
class file { getattr read execute };
')
########################################
#
# domain_all_daemon_domains_transition(domain)
#
define(`domain_all_daemon_domains_transition',`
requires_block_template(`$0'_depend)
allow $1 daemon_domain:process transition;
allow $1 daemon_domain_entry:file { getattr read execute };
allow daemon_domain $1:fd use;
allow $1 daemon_domain:process { noatsecure siginh rlimitinh };
')
define(`domain_all_daemon_domains_transition_depend',`
attribute daemon_domain, daemon_domain_entry;
class process { transition noatsecure siginh rlimitinh };
class file { getattr read execute };
')
########################################
#
# domain_all_system_domains_transition(domain)
#
define(`domain_all_system_domains_transition',`
requires_block_template(`$0'_depend)
allow $1 system_domain:process transition;
allow $1 system_domain_entry:file { getattr read execute };
allow system_domain $1:fd use;
allow $1 system_domain:process { noatsecure siginh rlimitinh };
')
define(`domain_all_system_domains_transition_depend',`
attribute system_domain, system_domain_entry;
class process { transition noatsecure siginh rlimitinh };
class file { getattr read execute };
')
########################################
#
# domain_signal_all_domains(domain)

14
refpolicy/policy/modules/system/domain.te
View File

@ -8,20 +8,6 @@ attribute domain;
# entrypoint executables
attribute entry_type;
# processes started by init itself
attribute init_domain;
attribute init_domain_entry;
# short running processes started by init scripts,
# such as mount, usually for initializing the system
attribute system_domain;
attribute system_domain_entry;
# long running application processes started by
# init scripts, such as sshd
attribute daemon_domain;
attribute daemon_domain_entry;
# widely-inheritable file descriptors
attribute privfd;

2
refpolicy/policy/modules/system/getty.te
View File

@ -4,7 +4,7 @@ policy_module(getty,1.0)
type getty_t;
type getty_exec_t;
domain_make_init_domain(getty_t,getty_exec_t)
init_make_init_domain(getty_t,getty_exec_t)
domain_make_file_descriptors_widely_inheritable(getty_t)
type getty_etc_t;

2
refpolicy/policy/modules/system/hostname.te
View File

@ -9,7 +9,7 @@ policy_module(hostname,1.0)
type hostname_t;
type hostname_exec_t;
domain_make_system_domain(hostname_t,hostname_exec_t)
init_make_system_domain(hostname_t,hostname_exec_t)
role system_r types hostname_t;

4
refpolicy/policy/modules/system/hotplug.te
View File

@ -9,7 +9,8 @@ policy_module(hotplug, 1.0)
type hotplug_t;
type hotplug_exec_t;
domain_make_system_domain(hotplug_t,hotplug_exec_t)
kernel_make_userland_entrypoint(hotplug_t,hotplug_exec_t)
init_make_system_domain(hotplug_t,hotplug_exec_t)
type hotplug_etc_t; #, usercanread;
files_make_file(hotplug_etc_t)
@ -46,7 +47,6 @@ kernel_read_kernel_sysctl(hotplug_t)
kernel_read_hardware_state(hotplug_t)
kernel_read_network_sysctl(hotplug_t)
kernel_read_usb_hardware_state(hotplug_t)
kernel_transition_from(hotplug_t,hotplug_exec_t)
bootloader_read_kernel_modules(hotplug_t)

72
refpolicy/policy/modules/system/init.if
View File

@ -1,5 +1,77 @@
# Copyright (C) 2005 Tresys Technology, LLC
########################################
#
# init_make_init_domain(domain,entrypointfile)
#
define(`init_make_init_domain',`
requires_block_template(`$0'_depend)
domain_make_domain($1)
domain_make_entrypoint_file($1,$2)
role system_r types $1;
allow init_t $1:process transition;
allow init_t $2:file { getattr read execute };
dontaudit init_t $1:process { noatsecure siginh rlimitinh };
type_transition init_t $2:process $1;
')
define(`init_make_init_domain_depend',`
type init_t;
class file { getattr read execute };
class fd use;
class process { transition noatsecure siginh rlimitinh };
role system_r;
')
########################################
#
# init_make_daemon_domain(domain,entrypointfile)
#
define(`init_make_daemon_domain',`
requires_block_template(`$0'_depend)
domain_make_domain($1)
domain_make_entrypoint_file($1,$2)
role system_r types $1;
allow initrc_t $1:process transition;
allow initrc_t $2:file { getattr read execute };
dontaudit initrc_t $1:process { noatsecure siginh rlimitinh };
allow $1 initrc_t:fd use;
type_transition initrc_t $2:process $1;
')
define(`init_make_daemon_domain_depend',`
type initrc_t;
class file { getattr read execute };
class fd use;
class process { transition noatsecure siginh rlimitinh };
role system_r;
')
########################################
#
# init_make_system_domain(domain,entrypointfile)
#
define(`init_make_system_domain',`
requires_block_template(`$0'_depend)
domain_make_domain($1)
domain_make_entrypoint_file($1,$2)
role system_r types $1;
allow initrc_t $1:process transition;
allow initrc_t $2:file { getattr read execute };
dontaudit initrc_t $1:process { noatsecure siginh rlimitinh };
allow $1 initrc_t:fd use;
type_transition initrc_t $2:process $1;
')
define(`init_make_system_domain_depend',`
type initrc_t;
class file { getattr read execute };
class fd use;
class process { transition noatsecure siginh rlimitinh };
role system_r;
')
########################################
#
# init_transition(domain)

5
refpolicy/policy/modules/system/init.te
View File

@ -18,6 +18,7 @@ role system_r types init_t;
# init_exec_t is the type of the init program.
#
type init_exec_t;
kernel_make_userland_entrypoint(init_t,init_exec_t)
domain_make_entrypoint_file(init_t,init_exec_t)
#
@ -82,7 +83,6 @@ allow init_t initrc_exec_t:file { getattr read execute };
allow init_t self:fifo_file { read write ioctl };
kernel_transition_from(init_t,init_exec_t)
kernel_sigchld_from(init_t)
# If you load a new policy that removes active domains, processes can
@ -100,7 +100,6 @@ terminal_use_all_terminals(init_t)
domain_signal_all_domains(init_t)
domain_kill_all_domains(init_t)
domain_all_init_domains_transition(init_t)
files_modify_system_runtime_data(init_t)
@ -233,8 +232,6 @@ bootloader_read_kernel_symbol_table(initrc_t)
domain_kill_all_domains(initrc_t)
domain_read_all_domains_process_state(initrc_t)
domain_all_daemon_domains_transition(initrc_t)
domain_all_system_domains_transition(initrc_t)
domain_use_widely_inheritable_file_descriptors(initrc_t)
libraries_modify_dynamic_loader_cache(initrc_t)

2
refpolicy/policy/modules/system/iptables.te
View File

@ -9,7 +9,7 @@ policy_module(iptables, 1.0)
type iptables_t;
type iptables_exec_t;
domain_make_system_domain(iptables_t,iptables_exec_t)
init_make_system_domain(iptables_t,iptables_exec_t)
role system_r types iptables_t;
type iptables_tmp_t;

4
refpolicy/policy/modules/system/locallogin.te
View File

@ -24,8 +24,8 @@ type sulogin_exec_t;
kernel_make_object_identity_change_constraint_exception(sulogin_t)
kernel_make_process_identity_change_constraint_exception(sulogin_t)
kernel_make_role_change_constraint_exception(sulogin_t)
domain_make_init_domain(sulogin_t,sulogin_exec_t)
domain_make_system_domain(sulogin_t,sulogin_exec_t)
init_make_init_domain(sulogin_t,sulogin_exec_t)
init_make_system_domain(sulogin_t,sulogin_exec_t)
domain_make_file_descriptors_widely_inheritable(sulogin_t)
role system_r types sulogin_t;

4
refpolicy/policy/modules/system/logging.te
View File

@ -9,7 +9,7 @@ files_make_file(devlog_t)
type klogd_t;
type klogd_exec_t;
domain_make_daemon_domain(klogd_t,klogd_exec_t)
init_make_daemon_domain(klogd_t,klogd_exec_t)
type klogd_tmp_t;
files_make_temporary_file(klogd_tmp_t)
@ -19,7 +19,7 @@ files_make_daemon_runtime_file(klogd_var_run_t)
type syslogd_t;
type syslogd_exec_t;
domain_make_daemon_domain(syslogd_t,syslogd_exec_t)
init_make_daemon_domain(syslogd_t,syslogd_exec_t)
type syslogd_tmp_t;
files_make_temporary_file(syslogd_tmp_t)

2
refpolicy/policy/modules/system/lvm.te
View File

@ -9,7 +9,7 @@ policy_module(lvm,1.0)
type lvm_t;
type lvm_exec_t;
domain_make_system_domain(lvm_t,lvm_exec_t)
init_make_system_domain(lvm_t,lvm_exec_t)
# needs privowner because it assigns the identity system_u to device nodes
# but runs as the identity of the sysadmin
kernel_make_object_identity_change_constraint_exception(lvm_t)

9
refpolicy/policy/modules/system/modutils.te
View File

@ -17,17 +17,18 @@ files_make_file(modules_dep_t)
type insmod_t;
type insmod_exec_t;
domain_make_system_domain(insmod_t,insmod_exec_t)
kernel_make_userland_entrypoint(insmod_t,insmod_exec_t)
init_make_system_domain(insmod_t,insmod_exec_t)
role system_r types insmod_t;
type depmod_t;
type depmod_exec_t;
domain_make_system_domain(depmod_t,depmod_exec_t)
init_make_system_domain(depmod_t,depmod_exec_t)
role system_r types depmod_t;
type update_modules_t;
type update_modules_exec_t;
domain_make_system_domain(update_modules_t,update_modules_exec_t)
init_make_system_domain(update_modules_t,update_modules_exec_t)
role system_r types update_modules_t;
type update_modules_tmp_t;
@ -49,8 +50,6 @@ allow insmod_t { modules_conf_t modules_dep_t }:file { getattr read };
allow insmod_t insmod_exec_t:file { getattr read execute execute_no_trans };
kernel_transition_from(insmod_t,insmod_exec_t)
kernel_load_module(insmod_t)
# Rules for /proc/sys/kernel/tainted

2
refpolicy/policy/modules/system/mount.te
View File

@ -2,7 +2,7 @@
type mount_t;
type mount_exec_t;
domain_make_system_domain(mount_t,mount_exec_t)
init_make_system_domain(mount_t,mount_exec_t)
role system_r types mount_t;
type mount_tmp_t;

2
refpolicy/policy/modules/system/selinux.te
View File

@ -67,7 +67,7 @@ files_make_file(policy_src_t)
type restorecon_t, can_relabelto_binary_policy;
type restorecon_exec_t;
kernel_make_object_identity_change_constraint_exception(restorecon_t)
domain_make_system_domain(restorecon_t,restorecon_exec_t)
init_make_system_domain(restorecon_t,restorecon_exec_t)
role system_r types restorecon_t;
#

2
refpolicy/policy/modules/system/selinuxutil.te
View File

@ -67,7 +67,7 @@ files_make_file(policy_src_t)
type restorecon_t, can_relabelto_binary_policy;
type restorecon_exec_t;
kernel_make_object_identity_change_constraint_exception(restorecon_t)
domain_make_system_domain(restorecon_t,restorecon_exec_t)
init_make_system_domain(restorecon_t,restorecon_exec_t)
role system_r types restorecon_t;
#

4
refpolicy/policy/modules/system/sysnetwork.te
View File

@ -9,7 +9,7 @@ policy_module(sysnetwork,1.0)
type dhcpc_t;
type dhcpc_exec_t;
domain_make_daemon_domain(dhcpc_t,dhcpc_exec_t)
init_make_daemon_domain(dhcpc_t,dhcpc_exec_t)
role system_r types dhcpc_t;
type dhcpc_state_t;
@ -23,7 +23,7 @@ files_make_daemon_runtime_file(dhcpc_var_run_t)
type ifconfig_t;
type ifconfig_exec_t;
domain_make_system_domain(ifconfig_t, ifconfig_exec_t)
init_make_system_domain(ifconfig_t, ifconfig_exec_t)
role system_r types ifconfig_t;
type net_conf_t alias resolv_conf_t;

4
refpolicy/policy/modules/system/udev.te
View File

@ -10,8 +10,9 @@ policy_module(udev,1.0)
type udev_t; # nscd_client_domain
type udev_exec_t;
type udev_helper_exec_t;
kernel_make_userland_entrypoint(udev_t,udev_exec_t)
kernel_make_object_identity_change_constraint_exception(udev_t)
domain_make_daemon_domain(udev_t,udev_exec_t)
init_make_daemon_domain(udev_t,udev_exec_t)
domain_make_entrypoint_file(udev_t,udev_helper_exec_t)
domain_make_file_descriptors_widely_inheritable(udev_t)
@ -74,7 +75,6 @@ kernel_compute_selinux_av(udev_t)
kernel_compute_create(udev_t)
kernel_compute_relabel(udev_t)
kernel_compute_reachable_user_contexts(udev_t)
kernel_transition_from(udev_t,udev_exec_t)
devices_manage_device_nodes(udev_t)