RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/roles/staff.te

220 lines
3.2 KiB
Plaintext
Raw Normal View History

Bump module versions for release.
2019-02-01 20:03:42 +00:00
policy_module(staff, 2.10.0)
trunk: Move user roles into individual modules.
2008-04-29 13:58:34 +00:00
########################################
#
# Declarations
#
Remove duplicate role declarations -This patch is needed since CIL does not allow duplicate role declarations. The roles for system_r, staff_r, sysadm_r, and user_r were already declared in kernel.te. Since the roles are pulled in from require statements in the appropriate interfaces, the duplicate role declarations could be deleted in modules for auditadm, staff, sysadm, and userdomain. -Move a role declaration that used an argument passed into the userdom_base_user_template into a gen_require statement.
2014-09-15 17:22:27 +00:00
#role staff_r;
trunk: Move user roles into individual modules.
2008-04-29 13:58:34 +00:00
userdom_unpriv_user_template(staff)
########################################
#
# Local policy
#
refpolicy: Infiniband pkeys and endports Every Infiniband network will have a default pkey, so that is labeled. The rest of the pkey configuration is network specific. The policy allows access to the default and unlabeled pkeys for sysadm and staff users. kernel_t is allowed access to all pkeys, which it needs to process and route management datagrams. Endports are all unlabeled by default, sysadm users are allowed to manage the subnet on unlabeled endports. kernel_t is allowed to manage the subnet on all ibendports, which is required for configuring the HCA. This patch requires selinux series: "SELinux user space support for Infiniband RDMA", due to the new ipkeycon labeling mechanism. Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
2017-05-24 14:14:59 +00:00
corenet_ib_access_unlabeled_pkeys(staff_t)
trunk: Move user roles into individual modules.
2008-04-29 13:58:34 +00:00
optional_policy(`
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
apache_role(staff_r, staff_t)
trunk: Move user roles into individual modules.
2008-04-29 13:58:34 +00:00
')
optional_policy(`
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
auditadm_role_change(staff_r)
trunk: Move user roles into individual modules.
2008-04-29 13:58:34 +00:00
')
Dbadm updates from KaiGai Kohei.
2010-08-19 12:41:39 +00:00
optional_policy(`
dbadm_role_change(staff_r)
')
New git service features from Dominick Grift. * git user sessions * repositories on CIFS/NFS * inetd service
2011-09-02 13:20:23 +00:00
optional_policy(`
git_role(staff_r, staff_t)
')
more misc stuff Here's the latest stuff, most of which is to make staff_t usable as a login domain. Please merge whatever you think is good and skip the rest.
2019-01-31 02:58:52 +00:00
optional_policy(`
modemmanager_dbus_chat(staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
postgresql_role(staff_r, staff_t)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
')
optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
secadm_role_change(staff_r)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
')
optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
ssh_role_template(staff, staff_r, staff_t)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
')
optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
sudo_role_template(staff, staff_r, staff_t)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
')
optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
sysadm_role_change(staff_r)
userdom_dontaudit_use_user_terminals(staff_t)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
')
Add Syncthing Support to Policy For now, optionally add the Syncthing role to user_r, staff_r, and unconfined_r, and define the Syncthing ports in core network.
2016-08-21 07:06:32 +00:00
optional_policy(`
syncthing_role(staff_r, staff_t)
')
Adding support for the vlock program. Both the system administrator and the unprivileged user could use vlock to lock the current console when logging in either from the serial console or by ssh. Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
2010-10-26 06:34:11 +00:00
optional_policy(`
Rename vlock interfaces.
2010-11-01 15:22:07 +00:00
vlock_run(staff_t, staff_r)
Adding support for the vlock program. Both the system administrator and the unprivileged user could use vlock to lock the current console when logging in either from the serial console or by ssh. Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
2010-10-26 06:34:11 +00:00
')
base: enable the xscreensaver role This patch enables the xscreensaver role so that the xscreensaver module is used on those systems where the corresponding application is installed. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
2016-12-19 23:48:46 +00:00
optional_policy(`
xscreensaver_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
xserver_role(staff_r, staff_t)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
')
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
ifndef(`distro_redhat',`
optional_policy(`
auth_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
bluetooth_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
cdrecord_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
optional_policy(`
chromium_role(staff_r, staff_t)
')
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
cron_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
dbus_role_template(staff, staff_r, staff_t)
Changes to the user domain policy module gnome_role is deprecated, use gnome_role_template instead depends on dbus because of gkeyringd Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2012-10-22 12:48:22 +00:00
optional_policy(`
gnome_role_template(staff, staff_r, staff_t)
')
users: calls pulseaudio_role() for restricted xwindows users and staff_t/user_t Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-11-09 09:45:16 +00:00
optional_policy(`
wm: update the window manager (wm) module and enable its role template (v7) Enable the window manager role (wm contrib module) and update the module to work with gnome-shell. This patch requires the following recently posted patch for the games module: [PATCH v3 1/2] games: general update and improved pulseaudio integration http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html This patch has received some testing with the following two configurations: - gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg); - gnome-shell executing in gdm mode (with the Gnome Display Manager). Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm. Since the window managers are not limited by gnome-shell, this latter version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates. The new wm_application_domain() interface introduced in the sixth version of this patch is an idea of Jason Zaman. This patch also fixes a minor bug in the way the pulseaudio_role() interface is optionally included by the role templates (pulseaudio does not depend on dbus). This seventh version splits the 1/5 patch in two separate patches: one for the base policy and one for the contrib policy. THIS IS THE BASE POLICY PART. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
2016-12-16 15:59:31 +00:00
telepathy_role_template(staff, staff_r, staff_t)
users: calls pulseaudio_role() for restricted xwindows users and staff_t/user_t Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-11-09 09:45:16 +00:00
')
Add telepathy role for user_r and staff_r
2014-04-05 18:01:21 +00:00
optional_policy(`
wm: update the window manager (wm) module and enable its role template (v7) Enable the window manager role (wm contrib module) and update the module to work with gnome-shell. This patch requires the following recently posted patch for the games module: [PATCH v3 1/2] games: general update and improved pulseaudio integration http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html This patch has received some testing with the following two configurations: - gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg); - gnome-shell executing in gdm mode (with the Gnome Display Manager). Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm. Since the window managers are not limited by gnome-shell, this latter version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates. The new wm_application_domain() interface introduced in the sixth version of this patch is an idea of Jason Zaman. This patch also fixes a minor bug in the way the pulseaudio_role() interface is optionally included by the role templates (pulseaudio does not depend on dbus). This seventh version splits the 1/5 patch in two separate patches: one for the base policy and one for the contrib policy. THIS IS THE BASE POLICY PART. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
2016-12-16 15:59:31 +00:00
wm_role_template(staff, staff_r, staff_t)
Add telepathy role for user_r and staff_r
2014-04-05 18:01:21 +00:00
')
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
dirmngr: add to roles
2017-05-26 15:59:31 +00:00
optional_policy(`
dirmngr_role(staff_r, staff_t)
')
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
evolution_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
games_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
gift_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
gpg_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
irc_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
java_role(staff_r, staff_t)
')
Add dbadm, from KaiGai Kohei.
2010-02-08 15:34:08 +00:00
base: role changes for the new libmtp module This is the base part of the policy needed to support libmtp (an Initiator implementation of the Media Transfer Protocol). Signed-off-by: Guido Trentalancia <guido at trentalancia.net>
2017-05-13 21:15:27 +00:00
optional_policy(`
libmtp_role(staff_r, staff_t)
')
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
lockdev_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
lpd_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
mozilla_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
mplayer_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
mta_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
Apache OpenOffice module (base policy part) This is a patch that I have created and tested to support Apache OpenOffice with its own module (base policy part, 1/2). The file contexts (and initial tests) are based on the default installation path for version 4 of the office suite. Since the second version it includes revisions from Dominick Grift. Since the third version it should correctly manage files in home directories and allow some other major functionality. The fourth version of the patch introduces a boolean to enable or disable software updates from the network (application and/or extensions). The fifth version of the patch adds the ability to connect to the X display manager (XDM) using Unix domain sockets (interface xserver_stream_connect_xdm()). Also the fifth version splits the whole patch into separate base policy / contrib policy patches as required. The sixth version of this patch removes obsolete executable permission from the unconfined module. The seventh, eighth and nineth versions brings no changes in the base part of the patch. All released versions are safe to apply, each new version just brings improved application functionality and better integration with other desktop applications. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
2016-12-06 20:41:39 +00:00
optional_policy(`
ooffice_role(staff_r, staff_t)
')
wm: update the window manager (wm) module and enable its role template (v7) Enable the window manager role (wm contrib module) and update the module to work with gnome-shell. This patch requires the following recently posted patch for the games module: [PATCH v3 1/2] games: general update and improved pulseaudio integration http://oss.tresys.com/pipermail/refpolicy/2016-December/008679.html This patch has received some testing with the following two configurations: - gnome-shell executing in normal mode (with display managers other than gdm, such as xdm from XOrg); - gnome-shell executing in gdm mode (with the Gnome Display Manager). Patches 3/5, 4/5 and 5/5 are needed when gnome-shell is used in conjunction with gdm. Since the window managers are not limited by gnome-shell, this latter version of the patch (along with part 2/5) uses separate optional conditionals for the gnome and wm role templates. The new wm_application_domain() interface introduced in the sixth version of this patch is an idea of Jason Zaman. This patch also fixes a minor bug in the way the pulseaudio_role() interface is optionally included by the role templates (pulseaudio does not depend on dbus). This seventh version splits the 1/5 patch in two separate patches: one for the base policy and one for the contrib policy. THIS IS THE BASE POLICY PART. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
2016-12-16 15:59:31 +00:00
optional_policy(`
pulseaudio_role(staff_r, staff_t)
')
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
pyzor_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
razor_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
rssh_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
screen_role_template(staff, staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
spamassassin_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
su_role_template(staff, staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef
2010-07-21 14:39:57 +00:00
optional_policy(`
thunderbird_role(staff_r, staff_t)
')
optional_policy(`
tvtime_role(staff_r, staff_t)
')
optional_policy(`
uml_role(staff_r, staff_t)
')
optional_policy(`
userhelper_role_template(staff, staff_r, staff_t)
')
optional_policy(`
vmware_role(staff_r, staff_t)
')
optional_policy(`
wireshark_role(staff_r, staff_t)
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
')