RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/userdomain.fc

13 lines
596 B
Plaintext
Raw Normal View History

trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
userdomain: introduce the user certificate file context (was miscfiles: introduce the user certificate file context) Introduce a new file context for user certificates (user_cert_t) located in home directories. Introduce new auxiliary interfaces to read and manage such files files and directories. Thanks to Christopher PeBenito for the useful suggestions that led to this improved version of the patch. Compared to the previous version, this patch adds the ability to search the user home directories in the new interfaces. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
2016-09-08 16:38:37 +00:00
HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:user_cert_t,s0)
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
base: use new genhomedircon template for username Use the new genhomedircon templates for username-dependant file contexts (requires libsemanage >= 2.6). This is the base policy part (1/2).
2016-12-27 15:33:57 +00:00
/tmp/gconfd-%{USERNAME} -d gen_context(system_u:object_r:user_tmp_t,s0)
userdomain: Introduce types for /run/user These are the types for /run/user, analogous to /home's home_root_t and home_dir_t.
2016-06-01 16:08:54 +00:00
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/user -d gen_context(system_u:object_r:user_runtime_root_t,s0)
/run/user/[^/]+ -d gen_context(system_u:object_r:user_runtime_t,s0)
/run/user/[^/]+/.+ -d <<none>>
userdomain: Introduce types for /run/user These are the types for /run/user, analogous to /home's home_root_t and home_dir_t.
2016-06-01 16:08:54 +00:00
# new genhomedircon required for these patterns
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/user/%{USERID} -d gen_context(system_u:object_r:user_runtime_t,s0)
/run/user/%{USERID}/.+ <<none>>