selinux-refpolicy/policy/modules/system/unconfined.te


policy_module(unconfined,1.6.1)

########################################
#
# Declarations
#

type unconfined_t;
type unconfined_exec_t;
init_system_domain(unconfined_t,unconfined_exec_t)

ifdef(`targeted_policy',`
	type unconfined_execmem_t;
	type unconfined_execmem_exec_t;
	init_system_domain(unconfined_execmem_t,unconfined_execmem_exec_t)
')

########################################
#
# Local policy
#

unconfined_domain(unconfined_t)

logging_send_syslog_msg(unconfined_t)

ifdef(`targeted_policy',`
	allow unconfined_t self:system syslog_read;
	dontaudit unconfined_t self:capability sys_module;

	domain_auto_trans(unconfined_t,unconfined_execmem_exec_t,unconfined_execmem_t)

	files_create_boot_flag(unconfined_t)

	mcs_killall(unconfined_t)
	mcs_ptrace_all(unconfined_t)

	init_domtrans_script(unconfined_t)

	libs_domtrans_ldconfig(unconfined_t)

	logging_domtrans_auditctl(unconfined_t)

	mount_domtrans_unconfined(unconfined_t)

	seutil_domtrans_setfiles(unconfined_t)
	seutil_domtrans_semanage(unconfined_t)

	userdom_unconfined(unconfined_t)
	userdom_priveleged_home_dir_manager(unconfined_t)

	optional_policy(`
		ada_domtrans(unconfined_t)
	')

	optional_policy(`
		apache_domtrans_helper(unconfined_t)
	')

	optional_policy(`
		bind_domtrans_ndc(unconfined_t)
	')

	optional_policy(`
		bootloader_domtrans(unconfined_t)
	')

	optional_policy(`
		init_dbus_chat_script(unconfined_t)

		dbus_stub(unconfined_t)

		optional_policy(`
			avahi_dbus_chat(unconfined_t)
		')

		optional_policy(`
			bluetooth_dbus_chat(unconfined_t)
		')

		optional_policy(`
			consolekit_dbus_chat(unconfined_t)
		')

		optional_policy(`
			cups_dbus_chat_config(unconfined_t)
		')

		optional_policy(`
			hal_dbus_chat(unconfined_t)
		')

		optional_policy(`
			networkmanager_dbus_chat(unconfined_t)
		')

		optional_policy(`
			oddjob_dbus_chat(unconfined_t)
		')
	')

	optional_policy(`
		firstboot_domtrans(unconfined_t)
	')

	optional_policy(`
		ftp_domtrans_ftpdctl(unconfined_t)
	')

	optional_policy(`
		inn_domtrans(unconfined_t)
	')

	optional_policy(`
		java_domtrans(unconfined_t)
	')

	optional_policy(`
		lpd_domtrans_checkpc(unconfined_t)
	')

	optional_policy(`
		modutils_domtrans_update_mods(unconfined_t)
	')

	optional_policy(`
		mono_domtrans(unconfined_t)
	')

	optional_policy(`
		oddjob_domtrans_mkhomedir(unconfined_t)
	')

	optional_policy(`
		prelink_domtrans(unconfined_t)
	')

	optional_policy(`
		portmap_domtrans_helper(unconfined_t)
	')

	optional_policy(`
		postfix_domtrans_map(unconfined_t)
		# cjp: this should probably be removed:
		postfix_domtrans_master(unconfined_t)
	')

	optional_policy(`
		# cjp: this should probably be removed:
		rpc_domtrans_nfsd(unconfined_t)
	')

	optional_policy(`
		rpm_domtrans(unconfined_t)
	')

	optional_policy(`
		samba_domtrans_net(unconfined_t)
		samba_domtrans_winbind_helper(unconfined_t)
	')

	optional_policy(`
		sendmail_domtrans(unconfined_t)
	')

	optional_policy(`
		sysnet_domtrans_dhcpc(unconfined_t)
		sysnet_dbus_chat_dhcpc(unconfined_t)
	')

	optional_policy(`
		tzdata_domtrans(unconfined_t)
	')

	optional_policy(`
		usermanage_domtrans_admin_passwd(unconfined_t)
	')

	optional_policy(`
		vpn_domtrans(unconfined_t)
	')

	optional_policy(`
		webalizer_domtrans(unconfined_t)
	')

	optional_policy(`
		wine_domtrans(unconfined_t)
	')

	optional_policy(`
		xserver_domtrans_xdm_xserver(unconfined_t)
	')
')

########################################
#
# Unconfined Execmem Local policy
#

ifdef(`targeted_policy',`
	allow unconfined_execmem_t self:process { execstack execmem };
	unconfined_domain_noaudit(unconfined_execmem_t)

	optional_policy(`
		dbus_stub(unconfined_execmem_t)

		init_dbus_chat_script(unconfined_execmem_t)
		unconfined_dbus_chat(unconfined_execmem_t)

		optional_policy(`
			hal_dbus_chat(unconfined_execmem_t)
		')
	')
')
add unconfined 2005-07-05 20:59:51 +00:00
merge restorecon into setfiles 2007-05-11 17:10:43 +00:00			`policy_module(unconfined,1.6.1)`
add unconfined 2005-07-05 20:59:51 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options. 2006-10-04 17:25:34 +00:00			`type unconfined_t;`
add unconfined 2005-07-05 20:59:51 +00:00			`type unconfined_exec_t;`
			`init_system_domain(unconfined_t,unconfined_exec_t)`
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00
			ifdef(`targeted_policy',`
			`type unconfined_execmem_t;`
			`type unconfined_execmem_exec_t;`
			`init_system_domain(unconfined_execmem_t,unconfined_execmem_exec_t)`
			`')`
add unconfined 2005-07-05 20:59:51 +00:00
			`########################################`
			`#`
			`# Local policy`
			`#`

patch from dan Wed, 01 Feb 2006 08:33:30 -0500 2006-02-06 22:47:46 +00:00			`unconfined_domain(unconfined_t)`
another round of TODO cleanup 2005-07-08 20:44:57 +00:00
add unconfined 2005-07-05 20:59:51 +00:00			`logging_send_syslog_msg(unconfined_t)`

support for targeted policy 2005-07-06 20:28:29 +00:00			ifdef(`targeted_policy',`
			`allow unconfined_t self:system syslog_read;`
tty and caps fixes 2005-11-01 15:34:00 +00:00			`dontaudit unconfined_t self:capability sys_module;`
support for targeted policy 2005-07-06 20:28:29 +00:00
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00			`domain_auto_trans(unconfined_t,unconfined_execmem_exec_t,unconfined_execmem_t)`

more fix 2005-11-09 15:51:22 +00:00			`files_create_boot_flag(unconfined_t)`

patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`mcs_killall(unconfined_t)`
			`mcs_ptrace_all(unconfined_t)`

another round of TODO cleanup 2005-07-08 20:44:57 +00:00			`init_domtrans_script(unconfined_t)`

add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`libs_domtrans_ldconfig(unconfined_t)`

			`logging_domtrans_auditctl(unconfined_t)`

patch from dan Tue, 18 Apr 2006 23:16:15 -0400 2006-04-19 15:25:22 +00:00			`mount_domtrans_unconfined(unconfined_t)`

merge restorecon into setfiles 2007-05-11 17:10:43 +00:00			`seutil_domtrans_setfiles(unconfined_t)`
patch from dan Tue, 18 Apr 2006 23:16:15 -0400 2006-04-19 15:25:22 +00:00			`seutil_domtrans_semanage(unconfined_t)`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00
support for targeted policy 2005-07-06 20:28:29 +00:00			`userdom_unconfined(unconfined_t)`
easy fixes 2005-10-25 19:03:15 +00:00			`userdom_priveleged_home_dir_manager(unconfined_t)`

second part of dans patch Tue, 11 Apr 2006 09:25:24 -0400 2006-04-12 16:58:23 +00:00			optional_policy(`
			`ada_domtrans(unconfined_t)`
			`')`
first part of dans patch Tue, 11 Apr 2006 09:25:24 -0400 2006-04-12 15:04:28 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
more fixes 2005-10-31 22:19:16 +00:00			`apache_domtrans_helper(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
more transition work 2005-10-27 15:16:42 +00:00			`bind_domtrans_ndc(unconfined_t)`
			`')`

patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			optional_policy(`
			`bootloader_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
first part of dans patch Fri, 14 Apr 2006 08:08:43 -0400 2006-04-17 17:32:54 +00:00			`init_dbus_chat_script(unconfined_t)`

clean up networkmanager hacks 2005-11-25 16:43:03 +00:00			`dbus_stub(unconfined_t)`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
fix several modular build problems 2005-11-29 21:27:15 +00:00			`avahi_dbus_chat(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`bluetooth_dbus_chat(unconfined_t)`
			`')`

from Dan: This is a new policy for the User Switching capability coming in gnome. consolekit is a daemon that communicates with xdm_t and hal through dbus to change the ownership/access on certain devices when the login session changes from one user to another 2007-03-19 18:01:15 +00:00			optional_policy(`
			`consolekit_dbus_chat(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`cups_dbus_chat_config(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
fix several modular build problems 2005-11-29 21:27:15 +00:00			`hal_dbus_chat(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
clean up networkmanager hacks 2005-11-25 16:43:03 +00:00			`networkmanager_dbus_chat(unconfined_t)`
			`')`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00
			optional_policy(`
			`oddjob_dbus_chat(unconfined_t)`
			`')`
clean up networkmanager hacks 2005-11-25 16:43:03 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`firstboot_domtrans(unconfined_t)`
pile o fixes 2005-10-26 16:00:13 +00:00			`')`

add ftpdctl from paul howarth 2006-06-13 18:17:34 +00:00			optional_policy(`
			`ftp_domtrans_ftpdctl(unconfined_t)`
			`')`

most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			optional_policy(`
			`inn_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
patch from dan Sun, 19 Feb 2006 08:16:18 -0500 2006-02-20 16:31:54 +00:00			`java_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
pile o fixes 2005-10-26 16:00:13 +00:00			`lpd_domtrans_checkpc(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
easy fixes 2005-10-25 19:03:15 +00:00			`modutils_domtrans_update_mods(unconfined_t)`
			`')`
support for targeted policy 2005-07-06 20:28:29 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
patch from Dan, sent Thu, 19 Jan 2006 14:16:26 -0500 2006-01-19 23:00:23 +00:00			`mono_domtrans(unconfined_t)`
			`')`
patch from dan Thu, 09 Feb 2006 13:39:41 -0500 2006-02-13 22:05:08 +00:00
patch from dan Mon, 25 Sep 2006 15:46:40 -0400 2006-09-28 14:37:29 +00:00			optional_policy(`
			`oddjob_domtrans_mkhomedir(unconfined_t)`
			`')`

most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			optional_policy(`
			`prelink_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`portmap_domtrans_helper(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
more postfix work 2005-10-25 00:00:50 +00:00			`postfix_domtrans_map(unconfined_t)`
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`# cjp: this should probably be removed:`
			`postfix_domtrans_master(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`# cjp: this should probably be removed:`
			`rpc_domtrans_nfsd(unconfined_t)`
more postfix work 2005-10-25 00:00:50 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
fix rpm transition 2005-10-26 13:51:33 +00:00			`rpm_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
fix most of samba 2005-10-24 21:33:46 +00:00			`samba_domtrans_net(unconfined_t)`
add some missing transitions from unconfined 2005-10-27 15:06:15 +00:00			`samba_domtrans_winbind_helper(unconfined_t)`
fix most of samba 2005-10-24 21:33:46 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
patch from dan. 2006-01-11 15:28:14 +00:00			`sendmail_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`sysnet_domtrans_dhcpc(unconfined_t)`
fix up bad ifdefs and remove foo.te definition for modules. 2006-06-12 14:17:40 +00:00			`sysnet_dbus_chat_dhcpc(unconfined_t)`
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`')`

patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			optional_policy(`
			`tzdata_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
more fix 2005-11-09 15:51:22 +00:00			`usermanage_domtrans_admin_passwd(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
patch from dan Sun, 19 Feb 2006 08:16:18 -0500 2006-02-20 16:31:54 +00:00			`vpn_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
sediff fixes 2005-10-27 14:52:37 +00:00			`webalizer_domtrans(unconfined_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
patch from Dan, sent Thu, 19 Jan 2006 14:16:26 -0500 2006-01-19 23:00:23 +00:00			`wine_domtrans(unconfined_t)`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`')`
patch from dan Wed, 01 Feb 2006 08:33:30 -0500 2006-02-06 22:47:46 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
patch from dan Wed, 01 Feb 2006 08:33:30 -0500 2006-02-06 22:47:46 +00:00			`xserver_domtrans_xdm_xserver(unconfined_t)`
			`')`
support for targeted policy 2005-07-06 20:28:29 +00:00			`')`
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00
			`########################################`
			`#`
			`# Unconfined Execmem Local policy`
			`#`

			ifdef(`targeted_policy',`
			`allow unconfined_execmem_t self:process { execstack execmem };`
			`unconfined_domain_noaudit(unconfined_execmem_t)`
patch from dan Wed, 23 Aug 2006 14:03:49 -0400 2006-08-29 02:41:00 +00:00
			optional_policy(`
			`dbus_stub(unconfined_execmem_t)`

			`init_dbus_chat_script(unconfined_execmem_t)`
			`unconfined_dbus_chat(unconfined_execmem_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00
			optional_policy(`
			`hal_dbus_chat(unconfined_execmem_t)`
			`')`
patch from dan Wed, 23 Aug 2006 14:03:49 -0400 2006-08-29 02:41:00 +00:00			`')`
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00			`')`