selinux-policy/targeted/domains/program/load_policy.te
2005-11-07 20:09:28 +00:00

66 lines
1.8 KiB
Plaintext

#DESC LoadPolicy - SELinux policy loading utilities
#
# Authors: Frank Mayer, mayerf@tresys.com
# X-Debian-Packages: policycoreutils
#
###########################
# load_policy_t is the domain type for load_policy
# load_policy_exec_t is the file type for the executable
# boolean to determine whether the system permits loading policy, setting
# enforcing mode, and changing boolean values. Set this to true and you
# have to reboot to set it back
bool secure_mode_policyload false;
type load_policy_t, domain;
role sysadm_r types load_policy_t;
role secadm_r types load_policy_t;
role system_r types load_policy_t;
type load_policy_exec_t, file_type, exec_type, sysadmfile;
##########################
#
# Rules
domain_auto_trans(secadmin, load_policy_exec_t, load_policy_t)
allow load_policy_t console_device_t:chr_file { read write };
# Reload the policy configuration (sysadm_t no longer has this ability)
can_loadpol(load_policy_t)
# Reset policy boolean values.
can_setbool(load_policy_t)
###########################
# constrain from where load_policy can load a policy, specifically
# policy_config_t files
#
# only allow read of policy config files
allow load_policy_t policy_src_t:dir search;
r_dir_file(load_policy_t, policy_config_t)
r_dir_file(load_policy_t, selinux_config_t)
# directory search permissions for path to binary policy files
allow load_policy_t root_t:dir search;
allow load_policy_t etc_t:dir search;
# for mcs.conf
allow load_policy_t etc_t:file { getattr read };
# Other access
can_access_pty(load_policy_t, initrc)
allow load_policy_t { admin_tty_type devtty_t }:chr_file { read write ioctl getattr };
uses_shlib(load_policy_t)
allow load_policy_t self:capability dac_override;
allow load_policy_t { userdomain privfd initrc_t }:fd use;
allow load_policy_t fs_t:filesystem getattr;
read_locale(load_policy_t)