925 Commits

Author	SHA1	Message	Date
Dominick Grift	1b39decc10	The process and capability IPC goes on top of local policy. ... The process and capability IPC goes on top of local policy.	2010-09-23 14:59:22 +02:00
Dominick Grift	8725d6334d	This permission is already allowed by included mmap_file_perms.	2010-09-23 14:55:33 +02:00
Dominick Grift	11ad1dae65	Source is postdrop and not local. Moving to postdrop local policy section.	2010-09-23 14:55:33 +02:00
Dominick Grift	a7b40a9c25	Internal interaction goes before external interface calls.	2010-09-23 14:55:33 +02:00
Dominick Grift	f6e8660dcb	These are not declarations move them to local policy section.	2010-09-23 14:55:33 +02:00
Dominick Grift	9bd88470ac	Redundant: All domains are allowed this access by default.	2010-09-23 14:52:41 +02:00
Dominick Grift	a8fbd94d6c	Reduntant: Included init_daemon_domain already has this.	2010-09-23 14:48:05 +02:00
Dan Walsh	5d82597463	Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy	2010-09-22 16:46:04 -04:00
Dan Walsh	6ed3f15e82	Allow domains with different mcs levels to send each other signals as long as they are not identified as mcsconstrainproc ... Allow shutdown to write utmp and search /var/log Allow mozilla_plugin to send nsplugin signals Split out samba_run_unconfined_net from unconfined_domain stuff. TO allow unconfined.pp module to be removed Allow nrpe to send signal and sigkill to the plugins Fix up xguest to allow it to read hwdata and gconf_etc_t Allow initrc_t to manage faillog	2010-09-22 16:42:32 -04:00
Dominick Grift	148e08d34f	XML summary fixes. ... XML summary fixes.	2010-09-22 15:41:46 +02:00
Dominick Grift	3a3e7db078	Use filetrans_pattern.	2010-09-22 15:41:46 +02:00
Dominick Grift	44f8aa190c	Use stream connect pattern.	2010-09-22 15:41:46 +02:00
Dominick Grift	8bde5ef68b	Redundant brace nothing to expand here. ... Redundant brace nothing to expand here. Redundant brace nothing to expand here. Redundant brace nothing to expand here.	2010-09-22 15:41:46 +02:00
Dominick Grift	96d3c0d35c	Make git daemon executable file an application executable file.	2010-09-22 15:41:46 +02:00
Dominick Grift	08c4bb080f	Search parent directory to be able to interact with targets content.	2010-09-22 15:41:45 +02:00
Dominick Grift	38039abcd1	These interface calls are more suitable here. Also should rename boolean to ftpd_network_connect_db and possibly split mysql and postgresql.	2010-09-22 15:41:45 +02:00
Dominick Grift	02687a7034	Move calls to external interfaces below policy that governs internal interaction. ... Move calls to external interfaces below policy that governs internal interaction.	2010-09-22 15:41:45 +02:00
Dominick Grift	d542026b86	The capability IPC goes on top of the local policy. ... The capability IPC goes on top of the local policy. The capability IPC goes on top of the local policy. The capability IPC goes on top of the local policy. The capability IPC goes on top of the local policy.	2010-09-22 15:41:45 +02:00
Dominick Grift	b952f9532a	This is a duplicate declaration. ... This is a duplicate declaration.	2010-09-22 15:41:45 +02:00
Dominick Grift	ef521e9919	Tunable, optional and if(n)def blocks go below. ... Tunable, optional and if(n)def blocks go below. Tunable, optional and if(n)def blocks go below. Tunable, optional and if(n)def blocks go below. Tunable, optional and if(n)def blocks go below.	2010-09-22 15:41:43 +02:00
Dominick Grift	68ac47d8c5	Whitespace, newline and tab fixes. ... Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.	2010-09-22 15:41:42 +02:00
Dominick Grift	0bdd855157	This is not required here.	2010-09-22 15:39:46 +02:00
Dominick Grift	82c971533a	Youre not allowed to directly use external types.	2010-09-22 15:39:46 +02:00
Dominick Grift	59c544a437	Redundant: All deamons are already allowed this access by default.	2010-09-22 15:39:46 +02:00
Dominick Grift	edcc8aa20d	Redundant: Included init_daemon_domain already has this.	2010-09-22 15:39:44 +02:00
Dominick Grift	1dfc76f76b	Use permission sets where possible. ... Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible.	2010-09-22 15:39:43 +02:00
Dominick Grift	9a0f7994cb	Whitespace, newline and tab fixes. ... Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.	2010-09-22 15:35:31 +02:00
Dominick Grift	9c7f2af2ed	Redundant: Is already permitted by included rw_chr_file_perms.	2010-09-22 15:35:29 +02:00
Dominick Grift	72ba80bf88	Use permission sets where possible. ... Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible.	2010-09-22 15:35:28 +02:00
Miroslav Grepl	b0a5fc3c27	Allow boinc projects to execute java	2010-09-21 16:03:36 +02:00
Dominick Grift	fc0d3d55f8	Merge branch 'base'	2010-09-21 13:57:06 +02:00
Dominick Grift	f262674898	Replace type and attributes statements by comma delimiters where possible. ... Replace type and attributes statements by comma delimiters where possible.	2010-09-21 13:50:00 +02:00
Dominick Grift	612346475b	XML summary fixes. ... XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes.	2010-09-21 13:50:00 +02:00
Dominick Grift	0eef2ca0f7	Use brace extension where possible. ... Use brace extension where possible.	2010-09-21 13:50:00 +02:00
Dominick Grift	69d1431276	Use permission sets where possible. ... Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible.	2010-09-21 13:50:00 +02:00
Dominick Grift	5ce19e3980	Type zarafa_server_t is not a file type.	2010-09-21 13:50:00 +02:00
Dominick Grift	e130679fa0	This is a role capability. ... This is a role capability. This is a role capability.	2010-09-21 13:50:00 +02:00
Dominick Grift	7bc4e83ea9	Redundant: Included files_search_var_lib already permits access to list generic var directories.	2010-09-21 13:50:00 +02:00
Dominick Grift	ddbd71a506	Search parent directory to be able to interact with targets content. ... Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content.	2010-09-21 13:49:59 +02:00
Dominick Grift	5a98a53ade	Missing required type.	2010-09-21 13:49:59 +02:00
Dominick Grift	d696185c23	Use stream connect pattern.	2010-09-21 13:49:59 +02:00
Dominick Grift	b85c14f0b0	Allow users to ptrace and send any signal to their pyzor agent. ... Allow users to ptrace and send any signal to their razor agent.	2010-09-21 13:49:59 +02:00
Dominick Grift	2a724571c9	Whitespace, newline and tab fixes. ... Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.	2010-09-21 13:49:58 +02:00
Dominick Grift	3507be9506	Move this to were the other is and where it should be. ... Move this to were the other is and where it should be.	2010-09-21 13:47:31 +02:00
Dominick Grift	2528a2d701	Replace type and attributes statements by comma delimiters where possible. ... Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible.	2010-09-21 13:47:30 +02:00
Dominick Grift	b46b3ad67f	Tunable, optional and if(n)def blocks go below. ... Tunable, optional and if(n)def blocks go below.	2010-09-21 13:16:29 +02:00
Dominick Grift	30bbb6a533	This is not a role capability.	2010-09-21 13:16:29 +02:00
Miroslav Grepl	d15b40a537	Fixed badly chosen type of interface for some interfaces	2010-09-21 09:09:43 +02:00
Dominick Grift	6ec59cc63d	Redundant: This is already allowed by included admin_pattern for mpd_var_lib_t.	2010-09-20 19:34:45 +02:00
Dominick Grift	a053765caf	Redundant: This is already permitted by included manage_dirs_pattern.	2010-09-20 18:18:44 +02:00
Dominick Grift	7a37620aaa	These are duplicates and redundants.	2010-09-20 18:18:44 +02:00
Dominick Grift	8e3f53a057	Whitespace, newline and tab fixes. ... Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.	2010-09-20 18:18:44 +02:00
Dominick Grift	61f4064286	Use list instead of search in admin interfaces. ... Use list instead of search in admin interfaces. Use list instead of search in admin interfaces. Use list instead of search in admin interfaces. Use list instead of search in admin interfaces.	2010-09-20 18:18:44 +02:00
Dominick Grift	55c2e0e0a4	This is a role capability. ... This is a role capability. This is a role capability. This is a role capability. This is a role capability. This is a role capability. This is a role capability. This is a role capability.	2010-09-20 18:18:44 +02:00
Dominick Grift	8ab34f0132	XML summary fixes. ... XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes.	2010-09-20 18:18:44 +02:00
Dominick Grift	624f2f43b1	Whitespace, newline and tab fixes. ... Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.	2010-09-20 18:18:44 +02:00
Dominick Grift	8f0b7460ea	Replace type and attributes statements by comma delimiters where possible. ... Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Syntax error. Squash me with 959aa527a5394d23b994ecf75347d2445106d0c4 Replace type and attributes statements by comma delimiters where possible. Syntax error. Squach me with 779a708452142d6e4ac2ba2a158f724782a03291 Replace type and attributes statements by comma delimiters where possible. Syntax error. Squash me with 89180ea115794aadddaa9b356ab1dfcdc9ff102	2010-09-20 18:18:42 +02:00
Dominick Grift	f6bed42b4a	This is not a role capability. ... This is not a role capability.	2010-09-20 18:15:57 +02:00
Dominick Grift	23952dea2e	Use ps_process_pattern to read state.	2010-09-20 18:15:57 +02:00
Dominick Grift	6c99405474	This permission is included with mmap_file_perms.	2010-09-20 18:15:57 +02:00
Dominick Grift	3cc747a38c	Allow piranha domains to create their pid directory with their pid file type.	2010-09-20 18:15:57 +02:00
Dominick Grift	c4786dd6ff	Implement oident admin.	2010-09-20 18:15:57 +02:00
Dominick Grift	f9c2fa554d	Wrong type required.	2010-09-20 18:15:57 +02:00
Dominick Grift	f66acfd9f2	Use permission sets where possible. ... Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible.	2010-09-20 18:15:57 +02:00
Dominick Grift	db775a32ca	Redundant; unused interface plus ypbind_t is not a pid file type.	2010-09-20 18:15:57 +02:00
Dominick Grift	ce87242fca	Search parent directory to be able to interact with targets content. ... Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Fix typo. Squash me with f7691806b4a54f3debfabaa403e1472acc17427e	2010-09-20 18:15:55 +02:00
Dominick Grift	dc47bf2b65	Onlt distro redhat currently implements admin_home_t.	2010-09-20 18:15:30 +02:00
Dominick Grift	4e8c6986a2	This type is not required here.	2010-09-20 18:15:30 +02:00
Dominick Grift	d017064d51	Missing required type.	2010-09-20 18:15:29 +02:00
Dominick Grift	1976ddda24	Whitespace, newline and tab fixes. ... Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.	2010-09-20 18:15:28 +02:00
Dominick Grift	e8ea772d89	Allow users to ptrace and send any signal to their lpd agent. ... Allow users to ptrace and send any signal to their mock agent.	2010-09-20 18:13:53 +02:00
Dominick Grift	c0ad94be4a	Reduntant: getattr_sock_files_pattern already permit this.	2010-09-20 18:13:53 +02:00
Dominick Grift	1c45e20097	Reduntant: stream_connect_pattern already permits this.	2010-09-20 18:13:53 +02:00
Dominick Grift	74d74b9c2c	Reduntant: unused, use hal_read_state instead if possible.	2010-09-20 18:13:53 +02:00
Dominick Grift	bece7c48bb	Use stream connect pattern. ... Use stream connect pattern.	2010-09-20 18:13:50 +02:00
Dominick Grift	ab33cc0cf1	I made a mistake in 618ce85f86, but as it turns out this interface is not required at all.	2010-09-17 15:05:25 +02:00
Dominick Grift	9fa4defbd4	Use permission sets where possible. ... Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Squash with 84812bc8dd814709734c2b6d1ef2ff2b84adc35d Syntax error.	2010-09-17 14:32:48 +02:00
Dominick Grift	4b1644f447	Whitespace, newline and tab fixes. ... Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.	2010-09-17 14:32:47 +02:00
Dominick Grift	3c484f5bdc	XML summary fixes. ... XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes. XML summary fixes.	2010-09-17 14:32:47 +02:00
Dominick Grift	86f9f96664	The ps_process_pattern includes permission to get attributes of target domain.	2010-09-17 14:32:47 +02:00
Dominick Grift	6bb4d401ee	Replace type and attributes statements by comma delimiters where possible. ... Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible. Replace type and attributes statements by comma delimiters where possible.	2010-09-17 14:32:47 +02:00
Dominick Grift	25e284d727	This is a role capability. ... This is a role capability. This is a role capability. This is a role capability. This is a role capability. This is a role capability. This is a role capability.	2010-09-17 14:32:47 +02:00
Dominick Grift	f6bcb24b48	Tunable and optional policy goes below. ... Tunable and optional policy goes below.	2010-09-17 14:32:47 +02:00
Dominick Grift	b11ba46f38	Use entry_file as entry_point to domain transition. ... Squash with e9f4178aa052c15ac7919a06e0c226b846ef7c7b Duplicate TE rule.	2010-09-17 14:32:47 +02:00
Dominick Grift	28fdb87aed	Move system type alias statements to system declarations. ... Squash me with 81a5e7c5394ee93d99df472199737cd61f3c24eb Without this build fails because at the point httpd_var_run_t is not yet declared.	2010-09-17 14:32:47 +02:00
Dominick Grift	b5d5518bb4	Add file context specification for HOME_DIR/\.gitaliases. May not be required but cannot hurt either.	2010-09-17 14:32:47 +02:00
Dominick Grift	618ce85f86	Use can_exec.	2010-09-17 14:32:47 +02:00
Dominick Grift	1e92803c62	Search parent directory to be able to interact with targets content. ... Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content. Search parent directory to be able to interact with targets content.	2010-09-17 14:32:47 +02:00
Dominick Grift	89bb445d84	This is not a role capability.	2010-09-17 14:32:47 +02:00
Dominick Grift	dd0d453cdf	Allow users to ptrace and send any signal to their bluetooth helper agent. ... Allow users to prtrace and send any signal to their cron job. Allow users to prtrace and send any signal to their cron job. Allow users to prtrace and send any signal to their cron job. Allow users to ps, ptrace and send any signal to their session bus.	2010-09-17 14:32:47 +02:00
Dominick Grift	2d6615cf20	Class is supposed to be fifo_file according to summary.	2010-09-17 14:32:47 +02:00
Dominick Grift	eb0e0bcca5	Use domtrans_pattern.	2010-09-17 14:32:47 +02:00
Dominick Grift	0293695add	Use stream connect pattern.	2010-09-17 14:32:46 +02:00
Dominick Grift	9b26005b06	Clean up (network) connect DB.	2010-09-17 14:32:46 +02:00
Dominick Grift	7fa5a68a82	Boolean declarations go above.	2010-09-17 14:32:46 +02:00
Dominick Grift	c5eae5f83c	Whitespace, newline and tab fixes. ... Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.	2010-09-17 14:32:43 +02:00
Dominick Grift	1b1f7d01a9	This is a leftover from refpolicy implementation of this functionality.	2010-09-17 14:29:50 +02:00
Dominick Grift	bbdbce34c2	No need for httpd_builtin_scripting to be set for httpd_t to be allowed to read files.	2010-09-17 14:29:50 +02:00
Dominick Grift	c53b75bdd2	Change this functionality to our implementation of this functionality.	2010-09-17 14:29:50 +02:00
Dan Walsh	8c47ad04ba	Remove accedentlay added ~ files	2010-09-16 17:48:39 -04:00