RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/admin/bootloader.fc

30 lines
1.9 KiB
Plaintext
Raw Normal View History

initial commit
2005-05-10 15:31:48 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/lilo\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0)
/etc/yaboot\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0)
initial commit
2005-05-10 15:31:48 +00:00
bootloader: add rEFInd and systemd-boot Add EFI bootloaders rEFInd and systemd-boot. Boot tools which manage bootloader files in UEFI (DOS) partition need also to manage UEFI boot variables in efivarfs. Bootctl (systemd-boot tool) verifies the type of EFI file system and needs to mmap() the files. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-04-25 09:41:18 +00:00
/usr/bin/bootctl -- gen_context(system_u:object_r:bootloader_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/grub -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/bin/grub2?-bios-setup -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/bin/grub2?-install -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/bin/grub2?-mkconfig -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/bin/grub2?-probe -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/bin/lilo.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)
bootloader: add rEFInd and systemd-boot Add EFI bootloaders rEFInd and systemd-boot. Boot tools which manage bootloader files in UEFI (DOS) partition need also to manage UEFI boot variables in efivarfs. Bootctl (systemd-boot tool) verifies the type of EFI file system and needs to mmap() the files. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-04-25 09:41:18 +00:00
/usr/bin/mkrlconf -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/bin/mvrefind -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/bin/refind-install -- gen_context(system_u:object_r:bootloader_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/ybin.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)
bootloader: add rEFInd and systemd-boot Add EFI bootloaders rEFInd and systemd-boot. Boot tools which manage bootloader files in UEFI (DOS) partition need also to manage UEFI boot variables in efivarfs. Bootctl (systemd-boot tool) verifies the type of EFI file system and needs to mmap() the files. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-04-25 09:41:18 +00:00
/usr/sbin/bootctl -- gen_context(system_u:object_r:bootloader_exec_t,s0)
three debian patches from manoj
2009-07-14 13:05:59 +00:00
/usr/sbin/grub -- gen_context(system_u:object_r:bootloader_exec_t,s0)
Generalize grub2 pattern GRUB2 helper programs can be named either grub2-* or grub-*, depending on distro and configuration.
2014-02-16 13:35:39 +00:00
/usr/sbin/grub2?-bios-setup -- gen_context(system_u:object_r:bootloader_exec_t,s0)
Label grub2-install as bootloader_exec_t
2014-02-16 13:59:43 +00:00
/usr/sbin/grub2?-install -- gen_context(system_u:object_r:bootloader_exec_t,s0)
Run grub(2)-mkconfig in bootloader domain In order to write the grub configuration and perform the preliminary checks, the grub-mkconfig command should run in the bootloader_t domain. As such, update the file context definition to be bootloader_exec_t.
2014-11-22 21:16:34 +00:00
/usr/sbin/grub2?-mkconfig -- gen_context(system_u:object_r:bootloader_exec_t,s0)
Generalize grub2 pattern GRUB2 helper programs can be named either grub2-* or grub-*, depending on distro and configuration.
2014-02-16 13:35:39 +00:00
/usr/sbin/grub2?-probe -- gen_context(system_u:object_r:bootloader_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/lilo.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)
bootloader: add rEFInd and systemd-boot Add EFI bootloaders rEFInd and systemd-boot. Boot tools which manage bootloader files in UEFI (DOS) partition need also to manage UEFI boot variables in efivarfs. Bootctl (systemd-boot tool) verifies the type of EFI file system and needs to mmap() the files. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-04-25 09:41:18 +00:00
/usr/sbin/mkrlconf -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/sbin/mvrefind -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/sbin/refind-install -- gen_context(system_u:object_r:bootloader_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/ybin.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)
another bootloader patch from Russell Coker
2017-04-19 01:30:02 +00:00
/var/lib/os-prober(/.*)? gen_context(system_u:object_r:bootloader_tmp_t,s0)