1031ee6f6a
My previous version had a minor bug in admin_role where it was using cobblerd_var_log_t, and cobblerd_var_lib_t instead of cobbler_var_log_t, and cobbler_var_lib_t. Whilst i was at it, i decided the implement a cobbler_etc_t for cobbler content in /etc. This because you cannot admin a cobbler environment witouth having access to cobbler config files and i dont want to give cobbler_admin access to manage etc_t. As a consequence if this i also removed the files_read_etc_files(cobblerd_t), as i think that cobbler only needed it to read its own files in /etc. However this is not confirmed, and it may need read access to etc_t afteral. Also i would like to underscore my reason for using public_content_rw_t. One of the reasons is that i do not want to give cobbler access to manage httpd_sys_content_rw_t. In general i do not want to depend on apache module at all. Signed-off-by: Dominick Grift <domg472@gmail.com> Signed-off-by: Chris PeBenito <pebenito@gentoo.org>
91 lines
2.9 KiB
Plaintext
91 lines
2.9 KiB
Plaintext
#
|
|
# /emul
|
|
#
|
|
ifdef(`distro_gentoo',`
|
|
/emul/linux/x86/usr/(X11R6/)?lib/X11/locale(/.*)? gen_context(system_u:object_r:locale_t,s0)
|
|
')
|
|
|
|
#
|
|
# /etc
|
|
#
|
|
/etc/avahi/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
|
/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
|
/etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)
|
|
|
|
ifdef(`distro_redhat',`
|
|
/etc/sysconfig/clock -- gen_context(system_u:object_r:locale_t,s0)
|
|
')
|
|
|
|
#
|
|
# /opt
|
|
#
|
|
/opt/(.*/)?man(/.*)? gen_context(system_u:object_r:man_t,s0)
|
|
|
|
#
|
|
# /srv
|
|
#
|
|
/srv/([^/]*/)?ftp(/.*)? gen_context(system_u:object_r:public_content_t,s0)
|
|
/srv/([^/]*/)?rsync(/.*)? gen_context(system_u:object_r:public_content_t,s0)
|
|
|
|
#
|
|
# /usr
|
|
#
|
|
/usr/lib/locale(/.*)? gen_context(system_u:object_r:locale_t,s0)
|
|
|
|
/usr/lib(64)?/perl5/man(/.*)? gen_context(system_u:object_r:man_t,s0)
|
|
|
|
/usr/local/man(/.*)? gen_context(system_u:object_r:man_t,s0)
|
|
/usr/local/share/man(/.*)? gen_context(system_u:object_r:man_t,s0)
|
|
|
|
/usr/local/share/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
|
|
|
|
/usr/man(/.*)? gen_context(system_u:object_r:man_t,s0)
|
|
|
|
/usr/share/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
|
|
/usr/share/ghostscript/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
|
|
/usr/share/locale(/.*)? gen_context(system_u:object_r:locale_t,s0)
|
|
/usr/share/man(/.*)? gen_context(system_u:object_r:man_t,s0)
|
|
/usr/share/X11/locale(/.*)? gen_context(system_u:object_r:locale_t,s0)
|
|
/usr/share/zoneinfo(/.*)? gen_context(system_u:object_r:locale_t,s0)
|
|
|
|
/usr/share/ssl/certs(/.*)? gen_context(system_u:object_r:cert_t,s0)
|
|
/usr/share/ssl/private(/.*)? gen_context(system_u:object_r:cert_t,s0)
|
|
|
|
/usr/X11R6/lib/X11/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
|
|
|
|
/usr/X11R6/man(/.*)? gen_context(system_u:object_r:man_t,s0)
|
|
|
|
ifdef(`distro_gentoo',`
|
|
/usr/share/misc/(pci|usb)\.ids -- gen_context(system_u:object_r:hwdata_t,s0)
|
|
')
|
|
|
|
ifdef(`distro_redhat',`
|
|
/usr/share/hwdata(/.*)? gen_context(system_u:object_r:hwdata_t,s0)
|
|
')
|
|
|
|
#
|
|
# /var
|
|
#
|
|
/var/ftp(/.*)? gen_context(system_u:object_r:public_content_t,s0)
|
|
|
|
/var/lib/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
|
|
|
|
/var/cache/fontconfig(/.*)? gen_context(system_u:object_r:fonts_t,s0)
|
|
/var/cache/fonts(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
|
|
/var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0)
|
|
|
|
/var/www/cobbler/images(/.*)? gen_context(system_u:object_r:public_content_rw_t, s0)
|
|
/var/lib/cobbler/webui_sessions(/.*)? gen_context(system_u:object_r:public_content_rw_t, s0)
|
|
|
|
/var/spool/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0)
|
|
|
|
ifdef(`distro_debian',`
|
|
/var/lib/msttcorefonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
|
|
/var/lib/usbutils(/.*)? gen_context(system_u:object_r:hwdata_t,s0)
|
|
')
|
|
|
|
ifdef(`distro_redhat',`
|
|
/var/empty/sshd/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
|
/var/spool/postfix/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
|
')
|