selinux-refpolicy/policy/modules/roles/staff.te

policy_module(staff, 2.5.1)

########################################
#
# Declarations
#

role staff_r;

userdom_unpriv_user_template(staff)

########################################
#
# Local policy
#

optional_policy(`
	apache_role(staff_r, staff_t)
')

optional_policy(`
	auditadm_role_change(staff_r)
')

optional_policy(`
	dbadm_role_change(staff_r)
')

optional_policy(`
	git_role(staff_r, staff_t)
')

optional_policy(`
	postgresql_role(staff_r, staff_t)
')

optional_policy(`
	secadm_role_change(staff_r)
')

optional_policy(`
	ssh_role_template(staff, staff_r, staff_t)
')

optional_policy(`
	sudo_role_template(staff, staff_r, staff_t)
')

optional_policy(`
	sysadm_role_change(staff_r)
	userdom_dontaudit_use_user_terminals(staff_t)
')

optional_policy(`
	vlock_run(staff_t, staff_r)
')

optional_policy(`
	xserver_role(staff_r, staff_t)
')

ifndef(`distro_redhat',`
	optional_policy(`
		auth_role(staff_r, staff_t)
	')

	optional_policy(`
		bluetooth_role(staff_r, staff_t)
	')

	optional_policy(`
		cdrecord_role(staff_r, staff_t)
	')

	optional_policy(`
		cron_role(staff_r, staff_t)
	')

	optional_policy(`
		dbus_role_template(staff, staff_r, staff_t)

		optional_policy(`
			gnome_role_template(staff, staff_r, staff_t)
		')

		optional_policy(`
			pulseaudio_role(staff_r, staff_t)
		')

		optional_policy(`
			telepathy_role_template(staff, staff_r, staff_t)
		')
	')

	optional_policy(`
		evolution_role(staff_r, staff_t)
	')

	optional_policy(`
		games_role(staff_r, staff_t)
	')

	optional_policy(`
		gift_role(staff_r, staff_t)
	')

	optional_policy(`
		gpg_role(staff_r, staff_t)
	')

	optional_policy(`
		irc_role(staff_r, staff_t)
	')

	optional_policy(`
		java_role(staff_r, staff_t)
	')

	optional_policy(`
		lockdev_role(staff_r, staff_t)
	')

	optional_policy(`
		lpd_role(staff_r, staff_t)
	')

	optional_policy(`
		mozilla_role(staff_r, staff_t)
	')

	optional_policy(`
		mplayer_role(staff_r, staff_t)
	')

	optional_policy(`
		mta_role(staff_r, staff_t)
	')

	optional_policy(`
		pyzor_role(staff_r, staff_t)
	')

	optional_policy(`
		razor_role(staff_r, staff_t)
	')

	optional_policy(`
		rssh_role(staff_r, staff_t)
	')

	optional_policy(`
		screen_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		spamassassin_role(staff_r, staff_t)
	')

	optional_policy(`
		su_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		thunderbird_role(staff_r, staff_t)
	')

	optional_policy(`
		tvtime_role(staff_r, staff_t)
	')

	optional_policy(`
		uml_role(staff_r, staff_t)
	')

	optional_policy(`
		userhelper_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		vmware_role(staff_r, staff_t)
	')

	optional_policy(`
		wireshark_role(staff_r, staff_t)
	')
')
Module version bump for 2 patch sets from Laurent Bigonville. * xattrfs attribute * Misc Debian fixes 2014-04-11 15:21:03 +00:00			`policy_module(staff, 2.5.1)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`role staff_r;`

			`userdom_unpriv_user_template(staff)`

			`########################################`
			`#`
			`# Local policy`
			`#`

			optional_policy(`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`apache_role(staff_r, staff_t)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00			`')`

			optional_policy(`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`auditadm_role_change(staff_r)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00			`')`

Dbadm updates from KaiGai Kohei. 2010-08-19 12:41:39 +00:00			optional_policy(`
			`dbadm_role_change(staff_r)`
			`')`

New git service features from Dominick Grift. * git user sessions * repositories on CIFS/NFS * inetd service 2011-09-02 13:20:23 +00:00			optional_policy(`
			`git_role(staff_r, staff_t)`
			`')`

trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`postgresql_role(staff_r, staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`secadm_role_change(staff_r)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`ssh_role_template(staff, staff_r, staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`sudo_role_template(staff, staff_r, staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`sysadm_role_change(staff_r)`
			`userdom_dontaudit_use_user_terminals(staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

Adding support for the vlock program. Both the system administrator and the unprivileged user could use vlock to lock the current console when logging in either from the serial console or by ssh. Signed-off-by: Harry Ciao <qingtao.cao@windriver.com> 2010-10-26 06:34:11 +00:00			optional_policy(`
Rename vlock interfaces. 2010-11-01 15:22:07 +00:00			`vlock_run(staff_t, staff_r)`
Adding support for the vlock program. Both the system administrator and the unprivileged user could use vlock to lock the current console when logging in either from the serial console or by ssh. Signed-off-by: Harry Ciao <qingtao.cao@windriver.com> 2010-10-26 06:34:11 +00:00			`')`

trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`xserver_role(staff_r, staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			ifndef(`distro_redhat',`
			optional_policy(`
			`auth_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`bluetooth_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`cdrecord_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`cron_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`dbus_role_template(staff, staff_r, staff_t)`
Changes to the user domain policy module gnome_role is deprecated, use gnome_role_template instead depends on dbus because of gkeyringd Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2012-10-22 12:48:22 +00:00
			optional_policy(`
			`gnome_role_template(staff, staff_r, staff_t)`
			`')`
users: calls pulseaudio_role() for restricted xwindows users and staff_t/user_t Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2013-11-09 09:45:16 +00:00
			optional_policy(`
			`pulseaudio_role(staff_r, staff_t)`
			`')`
Add telepathy role for user_r and staff_r 2014-04-05 18:01:21 +00:00
			optional_policy(`
			`telepathy_role_template(staff, staff_r, staff_t)`
			`')`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`evolution_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`games_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`gift_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`gpg_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`irc_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`java_role(staff_r, staff_t)`
			`')`
Add dbadm, from KaiGai Kohei. 2010-02-08 15:34:08 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`lockdev_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`lpd_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`mozilla_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`mplayer_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`mta_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`pyzor_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`razor_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`rssh_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`screen_role_template(staff, staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`spamassassin_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`su_role_template(staff, staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`thunderbird_role(staff_r, staff_t)`
			`')`

			optional_policy(`
			`tvtime_role(staff_r, staff_t)`
			`')`

			optional_policy(`
			`uml_role(staff_r, staff_t)`
			`')`

			optional_policy(`
			`userhelper_role_template(staff, staff_r, staff_t)`
			`')`

			optional_policy(`
			`vmware_role(staff_r, staff_t)`
			`')`

			optional_policy(`
			`wireshark_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`