RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/kernel/files.fc

274 lines
8.6 KiB
Plaintext
Raw Normal View History

initial commit
2005-05-10 19:51:00 +00:00
#
# /
#
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/.* gen_context(system_u:object_r:default_t,s0)
/ -d gen_context(system_u:object_r:root_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
/\.journal <<none>>
trunk: 6 patches from dan.
2009-06-11 15:00:48 +00:00
/afs -d gen_context(system_u:object_r:mnt_t,s0)
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames.
2006-03-02 23:41:11 +00:00
/initrd\.img.* -l gen_context(system_u:object_r:boot_t,s0)
/vmlinuz.* -l gen_context(system_u:object_r:boot_t,s0)
add stuff from distros.fc
2005-11-03 18:08:36 +00:00
more merging of NSA CVS policy
2005-09-13 13:06:07 +00:00
ifdef(`distro_redhat',`
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/\.autofsck -- gen_context(system_u:object_r:etc_runtime_t,s0)
/\.autorelabel -- gen_context(system_u:object_r:etc_runtime_t,s0)
patch from dan Wed, 26 Jul 2006 14:42:46 -0400
2006-07-28 15:13:58 +00:00
/\.suspended -- gen_context(system_u:object_r:etc_runtime_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/fastboot -- gen_context(system_u:object_r:etc_runtime_t,s0)
/forcefsck -- gen_context(system_u:object_r:etc_runtime_t,s0)
/fsckoptions -- gen_context(system_u:object_r:etc_runtime_t,s0)
/halt -- gen_context(system_u:object_r:etc_runtime_t,s0)
/poweroff -- gen_context(system_u:object_r:etc_runtime_t,s0)
more merging of NSA CVS policy
2005-09-13 13:06:07 +00:00
')
initial commit
2005-05-10 19:51:00 +00:00
add stuff from distros.fc
2005-11-03 18:08:36 +00:00
ifdef(`distro_suse',`
patch from dan Fri, 22 Sep 2006 16:30:34 -0400
2006-09-25 18:53:06 +00:00
/success -- gen_context(system_u:object_r:etc_runtime_t,s0)
add stuff from distros.fc
2005-11-03 18:08:36 +00:00
')
initial commit
2005-05-10 19:51:00 +00:00
#
# /boot
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/boot -d gen_context(system_u:object_r:boot_t,s0)
/boot/.* gen_context(system_u:object_r:boot_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
/boot/\.journal <<none>>
trunk: 2 patches from dan.
2008-12-02 22:40:49 +00:00
/boot/efi(/.*)?/System\.map(-.*)? -- gen_context(system_u:object_r:system_map_t,s0)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/boot/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
more upstream merging
2005-09-16 19:36:10 +00:00
/boot/lost\+found/.* <<none>>
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames.
2006-03-02 23:41:11 +00:00
/boot/System\.map(-.*)? -- gen_context(system_u:object_r:system_map_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
add stuff from distros.fc
2005-11-03 18:08:36 +00:00
#
# /emul
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/emul -d gen_context(system_u:object_r:usr_t,s0)
/emul/.* gen_context(system_u:object_r:usr_t,s0)
add stuff from distros.fc
2005-11-03 18:08:36 +00:00
initial commit
2005-05-10 19:51:00 +00:00
#
# /etc
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/etc -d gen_context(system_u:object_r:etc_t,s0)
/etc/.* gen_context(system_u:object_r:etc_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/\.fstab\.hal\..+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
patch from dan Fri, 17 Mar 2006 15:22:53 -0500
2006-03-23 19:19:38 +00:00
/etc/blkid(/.*)? gen_context(system_u:object_r:etc_runtime_t,s0)
Files patch from Dan Walsh. Redhat does want /usr/local/src labeled src_t or /usr/src for that matter Fix labels on chroot environments
2010-06-09 13:09:34 +00:00
/etc/cmtab -- gen_context(system_u:object_r:etc_runtime_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/fstab\.REVOKE -- gen_context(system_u:object_r:etc_runtime_t,s0)
patch from dan Fri, 22 Sep 2006 16:30:34 -0400
2006-09-25 18:53:06 +00:00
/etc/ioctl\.save -- gen_context(system_u:object_r:etc_runtime_t,s0)
Files patch from Dan Walsh. Redhat does want /usr/local/src labeled src_t or /usr/src for that matter Fix labels on chroot environments
2010-06-09 13:09:34 +00:00
/etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/localtime -l gen_context(system_u:object_r:etc_t,s0)
/etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0)
Allow mount to write to all of its runtime files, from Guido Trentalancia Allow mount to write not only to /etc/mtab but also to the /etc/mtab~[0-9]\{0,20\} lock files (the number corresponds to the PID). Such files are still mistakenly being labelled as etc_t instead of etc_runtime_t (thus preventing the successful completion of the write operation and the accumulation of unremovable stale lock files over several operation attempts as in normal system reboots, for example). Do the same with the standard mount temporary file /etc/mtab.tmp. The above refers to mount from util-linux-2.21.2 from kernel.org. See mount -vvv for the location of such files.
2012-06-26 13:51:57 +00:00
/etc/mtab~[0-9]* -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/mtab\.tmp -- gen_context(system_u:object_r:etc_runtime_t,s0)
trunk: 3 patches from dan
2007-06-20 19:47:10 +00:00
/etc/mtab\.fuselock -- gen_context(system_u:object_r:etc_runtime_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
add cups
2005-10-23 22:10:59 +00:00
/etc/cups/client\.conf -- gen_context(system_u:object_r:etc_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/ipsec\.d/examples(/.*)? gen_context(system_u:object_r:etc_t,s0)
add ipsec
2005-07-14 18:15:47 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/network/ifstate -- gen_context(system_u:object_r:etc_runtime_t,s0)
leftover from netutils
2005-05-10 20:06:04 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/ptal/ptal-printd-like -- gen_context(system_u:object_r:etc_runtime_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/sysconfig/hwconf -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/sysconfig/iptables\.save -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/sysconfig/firstboot -- gen_context(system_u:object_r:etc_runtime_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
files: fcontext for /etc/zfs/zpool.cache
2017-10-31 05:37:07 +00:00
/etc/zfs/zpool.cache -- gen_context(system_u:object_r:etc_runtime_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
ifdef(`distro_gentoo', `
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/profile\.env -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/csh\.env -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/env\.d/.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
')
add stuff from distros.fc
2005-11-03 18:08:36 +00:00
ifdef(`distro_redhat',`
/etc/rhgb(/.*)? -d gen_context(system_u:object_r:mnt_t,s0)
')
ifdef(`distro_suse',`
/etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0)
Use substititions for /usr/local/lib and /etc/init.d Introduce the substitutions for the /usr/local/lib* locations (towards /usr/lib) and /etc/init.d (towards /etc/rc.d/init.d). Update the file contexts of the translated locations. Rebased (collided with Guido's patch for commenting within the file_contexts.subs_dist file) since v3. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-08-15 14:12:39 +00:00
/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
add stuff from distros.fc
2005-11-03 18:08:36 +00:00
')
#
# HOME_ROOT
# expanded by genhomedircon
#
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
HOME_ROOT -d gen_context(system_u:object_r:home_root_t,s0-mls_systemhigh)
Pull in additional kernel layer Fedora policy changes.
2011-04-14 14:05:56 +00:00
HOME_ROOT -l gen_context(system_u:object_r:home_root_t,s0)
genhomedircon entries
2005-06-08 22:32:43 +00:00
HOME_ROOT/\.journal <<none>>
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
HOME_ROOT/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
HOME_ROOT/lost\+found/.* <<none>>
genhomedircon entries
2005-06-08 22:32:43 +00:00
initial commit
2005-05-10 19:51:00 +00:00
#
# /initrd
#
# initrd mount point, only used during boot
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/initrd -d gen_context(system_u:object_r:root_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
#
# /lost+found
#
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
more upstream merging
2005-09-16 19:36:10 +00:00
/lost\+found/.* <<none>>
initial commit
2005-05-10 19:51:00 +00:00
#
# /media
#
# Mount points; do not relabel subdirectories, since
# we don't want to change any removable media by default.
patch from erich Sat, 02 Sep 2006 03:37:44 +0200
2006-09-04 18:22:12 +00:00
/media(/[^/]*) -l gen_context(system_u:object_r:mnt_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/media(/[^/]*)? -d gen_context(system_u:object_r:mnt_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
/media/[^/]*/.* <<none>>
patch from dan Tue, 24 Oct 2006 11:00:28 -0400
2006-10-31 21:01:48 +00:00
/media/\.hal-.* -- gen_context(system_u:object_r:mnt_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
patch from dan
2006-01-25 15:53:35 +00:00
#
# /misc
#
/misc -d gen_context(system_u:object_r:mnt_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
#
# /mnt
#
patch from erich Sat, 02 Sep 2006 03:37:44 +0200
2006-09-04 18:22:12 +00:00
/mnt(/[^/]*) -l gen_context(system_u:object_r:mnt_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/mnt(/[^/]*)? -d gen_context(system_u:object_r:mnt_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
/mnt/[^/]*/.* <<none>>
patch from dan Fri, 27 Jan 2006 01:37:19 -0500
2006-01-27 20:13:08 +00:00
#
# /net
#
/net -d gen_context(system_u:object_r:mnt_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
#
# /opt
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/opt -d gen_context(system_u:object_r:usr_t,s0)
/opt/.* gen_context(system_u:object_r:usr_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/opt/(.*/)?var/lib(64)?(/.*)? gen_context(system_u:object_r:var_lib_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
#
# /proc
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/proc -d <<none>>
/proc/.* <<none>>
initial commit
2005-05-10 19:51:00 +00:00
Pull in additional kernel layer Fedora policy changes.
2011-04-14 14:05:56 +00:00
#
# /run
#
/run -d gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run -l gen_context(system_u:object_r:var_run_t,s0)
/var/run -> /run again Here's the latest version of my patch to remove all /var/run when it's not needed. I have removed the subst thing from the patch, but kept a distro_debian bit that relies on it. So with this patch the policy won't install if you build it with distro_debian unless you have my subst patch. Chris, if your automated tests require that it build and install with distro_debian then skip the patch for sysnetwork.fc. From Russell Coker
2017-03-25 16:56:03 +00:00
/run/shm -l gen_context(system_u:object_r:var_run_t,s0)
files: no default types for /run and /var/lock encourage private types for /run and /var/lock by not providing default contexts anymore
2017-02-16 15:08:47 +00:00
/run/.* <<none>>
Pull in additional kernel layer Fedora policy changes.
2011-04-14 14:05:56 +00:00
initial commit
2005-05-10 19:51:00 +00:00
#
# /selinux
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/selinux -d <<none>>
/selinux/.* <<none>>
initial commit
2005-05-10 19:51:00 +00:00
more upstream merging
2005-09-16 19:36:10 +00:00
#
# /srv
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/srv -d gen_context(system_u:object_r:var_t,s0)
/srv/.* gen_context(system_u:object_r:var_t,s0)
more upstream merging
2005-09-16 19:36:10 +00:00
initial commit
2005-05-10 19:51:00 +00:00
#
# /tmp
#
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
initial commit
2005-05-10 19:51:00 +00:00
/tmp/.* <<none>>
/tmp/\.journal <<none>>
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
more upstream merging
2005-09-16 19:36:10 +00:00
/tmp/lost\+found/.* <<none>>
initial commit
2005-05-10 19:51:00 +00:00
Label (/var)?/tmp/systemd-private-.../tmp like /tmp Such directories are used by systemd as private mountpoints for services.
2014-08-23 11:35:51 +00:00
/tmp/systemd-private-[^/]+ -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
/tmp/systemd-private-[^/]+/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
/tmp/systemd-private-[^/]+/tmp/.* <<none>>
initial commit
2005-05-10 19:51:00 +00:00
#
# /usr
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/usr -d gen_context(system_u:object_r:usr_t,s0)
/usr/.* gen_context(system_u:object_r:usr_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
/usr/\.journal <<none>>
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
patch from dan Thu, 09 Feb 2006 13:39:41 -0500
2006-02-13 22:05:08 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
files: reduce the scope of the pattern matching /usr/include The pattern that matches /usr/include uses a dot, in order probably to avoid calling m4's function include(). This also matches other paths such as /usr/inclu/e. Such a side-effect can be avoided by inserting an empty string which is removed by m4's preprocessing. Mailing-list discussion: https://lore.kernel.org/selinux-refpolicy/CAJfZ7=krh_TaCBQzFxLM394Sc5-82ZO0DdcfvWON-RXu-wqBVw@mail.gmail.com/t/#u Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-08-27 20:39:37 +00:00
# Avoid calling m4's include by using en empty string
/usr/include`'(/.*)? gen_context(system_u:object_r:usr_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
/usr/local/\.journal <<none>>
fix ordering and put in var_lib_t
2005-05-27 20:29:17 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/local/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
fix ordering and put in var_lib_t
2005-05-27 20:29:17 +00:00
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/usr/local/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
more upstream merging
2005-09-16 19:36:10 +00:00
/usr/local/lost\+found/.* <<none>>
initial commit
2005-05-10 19:51:00 +00:00
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
more upstream merging
2005-09-16 19:36:10 +00:00
/usr/lost\+found/.* <<none>>
trunk: 11 patches from dan.
2007-10-29 18:35:32 +00:00
/usr/share/doc(/.*)?/README.* gen_context(system_u:object_r:usr_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/usr/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
initial commit
2005-05-10 19:51:00 +00:00
/usr/tmp/.* <<none>>
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_debian',`
/var/run -> /run again Here's the latest version of my patch to remove all /var/run when it's not needed. I have removed the subst thing from the patch, but kept a distro_debian bit that relies on it. So with this patch the policy won't install if you build it with distro_debian unless you have my subst patch. Chris, if your automated tests require that it build and install with distro_debian then skip the patch for sysnetwork.fc. From Russell Coker
2017-03-25 16:56:03 +00:00
# on Debian /lib/init/rw is a tmpfs used like /run
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
/usr/lib/init/rw(/.*)? gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
Misc fc changes from Russell Coker.
2017-04-06 20:59:47 +00:00
/run/resolvconf(/.*)? -d gen_context(system_u:object_r:etc_t,s0)
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
')
Files patch from Dan Walsh. Redhat does want /usr/local/src labeled src_t or /usr/src for that matter Fix labels on chroot environments
2010-06-09 13:09:34 +00:00
ifndef(`distro_redhat',`
/usr/local/src(/.*)? gen_context(system_u:object_r:src_t,s0)
/usr/src(/.*)? gen_context(system_u:object_r:src_t,s0)
/usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
')
initial commit
2005-05-10 19:51:00 +00:00
#
# /var
#
second part of dans patch Fri, 14 Apr 2006 08:08:43 -0400
2006-04-17 17:54:57 +00:00
/var -d gen_context(system_u:object_r:var_t,s0)
/var/.* gen_context(system_u:object_r:var_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
/var/\.journal <<none>>
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/db/.*\.db -- gen_context(system_u:object_r:etc_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/ftp/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/lib(/.*)? gen_context(system_u:object_r:var_lib_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
fix ordering and put in var_lib_t
2005-05-27 20:29:17 +00:00
/var/lib/nfs/rpc_pipefs(/.*)? <<none>>
initial commit
2005-05-10 19:51:00 +00:00
files: no default types for /run and /var/lock encourage private types for /run and /var/lock by not providing default contexts anymore
2017-02-16 15:08:47 +00:00
/var/lock -d gen_context(system_u:object_r:var_lock_t,s0-mls_systemhigh)
/var/lock -l gen_context(system_u:object_r:var_lock_t,s0)
/var/lock/subsys -d gen_context(system_u:object_r:var_lock_t,s0-mls_systemhigh)
/var/lock/.* <<none>>
initial commit
2005-05-10 19:51:00 +00:00
add lost+found filesystem labels to support NSA security guidelines Add lost+found filesystem label to /var/log and /var/log/audit. Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
2012-08-25 22:38:29 +00:00
/var/log/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
/var/log/lost\+found/.* <<none>>
/var/log/audit/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
/var/log/audit/lost\+found/.* <<none>>
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/var/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
more upstream merging
2005-09-16 19:36:10 +00:00
/var/lost\+found/.* <<none>>
fix ordering and put in var_lib_t
2005-05-27 20:29:17 +00:00
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/var/run -l gen_context(system_u:object_r:var_run_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/var/spool(/.*)? gen_context(system_u:object_r:var_spool_t,s0)
fix optional in fc, move contexts to their proper modules
2006-02-02 20:41:12 +00:00
/var/spool/postfix/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Pull in additional kernel layer Fedora policy changes.
2011-04-14 14:05:56 +00:00
/var/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
/var/tmp -l gen_context(system_u:object_r:tmp_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
/var/tmp/.* <<none>>
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/var/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
more upstream merging
2005-09-16 19:36:10 +00:00
/var/tmp/lost\+found/.* <<none>>
Label (/var)?/tmp/systemd-private-.../tmp like /tmp Such directories are used by systemd as private mountpoints for services.
2014-08-23 11:35:51 +00:00
/var/tmp/systemd-private-[^/]+ -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
/var/tmp/systemd-private-[^/]+/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
/var/tmp/systemd-private-[^/]+/tmp/.* <<none>>
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/tmp/vi\.recover -d gen_context(system_u:object_r:tmp_t,s0)