76 lines
1.6 KiB
Plaintext
76 lines
1.6 KiB
Plaintext
## <summary>The unconfined domain.</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## A template to make the specified domain unconfined.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## Domain to make unconfined.
|
|
## </param>
|
|
#
|
|
template(`unconfined_access_template',`
|
|
|
|
# Use any Linux capability.
|
|
allow $1 self:capability *;
|
|
|
|
# Transition to myself, to make get_ordered_context_list happy.
|
|
allow $1 self:process transition;
|
|
|
|
# Write access is for setting attributes under /proc/self/attr.
|
|
allow $1 self:file rw_file_perms;
|
|
|
|
# Userland object managers
|
|
allow $1 self:nscd *;
|
|
allow $1 self:dbus *;
|
|
allow $1 self:passwd *;
|
|
|
|
kernel_unconfined($1)
|
|
dev_unconfined($1)
|
|
fs_unconfined($1)
|
|
selinux_unconfined($1)
|
|
|
|
domain_unconfined($1)
|
|
files_unconfined($1)
|
|
|
|
tunable_policy(`allow_execmem',`
|
|
# Allow loading DSOs that require executable stack.
|
|
allow $1 self:process execmem;
|
|
')
|
|
|
|
# to satisfy assertions:
|
|
optional_policy(`authlogin.te',`
|
|
auth_manage_shadow($1)
|
|
auth_relabelto_shadow($1)
|
|
')
|
|
|
|
optional_policy(`bootloader.te',`
|
|
bootloader_manage_kernel_modules($1)
|
|
')
|
|
|
|
optional_policy(`selinuxutil.te',`
|
|
seutil_create_binary_pol($1)
|
|
seutil_relabelto_binary_pol($1)
|
|
')
|
|
|
|
optional_policy(`storage.te',`
|
|
storage_unconfined($1)
|
|
')
|
|
|
|
ifdef(`TODO',`
|
|
if (allow_execmod) {
|
|
# Allow text relocations on system shared libraries, e.g. libGL.
|
|
allow $1 texrel_shlib_t:file execmod;
|
|
}
|
|
|
|
ifdef(`dbusd.te', `
|
|
# Communicate via dbusd.
|
|
allow $1 system_dbusd_t:dbus *;
|
|
')
|
|
|
|
ifdef(`nscd.te', `
|
|
# Get info via nscd.
|
|
allow $1 nscd_t:nscd *;
|
|
')
|
|
') dnl end TODO
|
|
')
|