52 lines
1.6 KiB
Plaintext
52 lines
1.6 KiB
Plaintext
policy_module(selinux, 1.8.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
attribute boolean_type;
|
|
attribute can_load_policy;
|
|
attribute can_setenforce;
|
|
attribute can_setsecparam;
|
|
attribute selinux_unconfined_type;
|
|
|
|
#
|
|
# security_t is the target type when checking
|
|
# the permissions in the security class. It is also
|
|
# applied to selinuxfs inodes.
|
|
#
|
|
type security_t, boolean_type;
|
|
fs_type(security_t)
|
|
mls_trusted_object(security_t)
|
|
sid security gen_context(system_u:object_r:security_t,mls_systemhigh)
|
|
genfscon selinuxfs / gen_context(system_u:object_r:security_t,s0)
|
|
genfscon securityfs / gen_context(system_u:object_r:security_t,s0)
|
|
|
|
neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
|
|
neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
|
|
neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
|
|
|
|
########################################
|
|
#
|
|
# Unconfined access to this module
|
|
#
|
|
|
|
# use SELinuxfs
|
|
allow selinux_unconfined_type security_t:dir list_dir_perms;
|
|
allow selinux_unconfined_type security_t:file rw_file_perms;
|
|
allow selinux_unconfined_type boolean_type:file read_file_perms;
|
|
|
|
# Access the security API.
|
|
allow selinux_unconfined_type security_t:security ~{ load_policy setenforce setbool };
|
|
|
|
if(!secure_mode_policyload) {
|
|
allow selinux_unconfined_type boolean_type:file rw_file_perms;
|
|
allow selinux_unconfined_type security_t:security { load_policy setenforce setbool };
|
|
|
|
ifdef(`distro_rhel4',`
|
|
# needed for systems without audit support
|
|
auditallow selinux_unconfined_type security_t:security { load_policy setenforce setbool };
|
|
')
|
|
}
|