selinux-refpolicy/policy/modules/kernel/selinux.te

49 lines
1.4 KiB
Plaintext
Raw Normal View History

2005-06-14 20:40:09 +00:00
policy_module(selinux,1.1.2)
2005-06-14 20:40:09 +00:00
########################################
#
# Declarations
#
2005-07-05 20:59:51 +00:00
attribute can_load_policy;
attribute can_setenforce;
attribute can_setsecparam;
attribute selinux_unconfined_type;
2005-07-05 20:59:51 +00:00
2005-06-14 20:40:09 +00:00
#
# security_t is the target type when checking
# the permissions in the security class. It is also
# applied to selinuxfs inodes.
#
2005-09-26 20:26:32 +00:00
type security_t;
fs_type(security_t)
2005-09-26 20:26:32 +00:00
mls_trusted_object(security_t)
2006-01-06 22:51:40 +00:00
sid security gen_context(system_u:object_r:security_t,s15:c0.c255)
genfscon selinuxfs / gen_context(system_u:object_r:security_t,s0)
2005-07-05 20:59:51 +00:00
neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
########################################
#
# Unconfined access to this module
#
# use SELinuxfs
allow selinux_unconfined_type security_t:dir { getattr search read };
allow selinux_unconfined_type security_t:file { getattr read write };
# Access the security API.
allow selinux_unconfined_type security_t:security ~{ load_policy setenforce setbool };
if(!secure_mode_policyload) {
allow selinux_unconfined_type security_t:security { load_policy setenforce setbool };
ifdef(`distro_rhel4',`
# needed for systems without audit support
auditallow selinux_unconfined_type security_t:security { load_policy setenforce setbool };
')
}