selinux-refpolicy/policy/modules/admin/bootloader.te

policy_module(bootloader, 1.13.2)

########################################
#
# Declarations
#

attribute_role bootloader_roles;
roleattribute system_r bootloader_roles;

#
# boot_runtime_t is the type for /boot/kernel.h,
# which is automatically generated at boot time.
# only for Red Hat
#
type boot_runtime_t;
files_type(boot_runtime_t)

type bootloader_t;
type bootloader_exec_t;
application_domain(bootloader_t, bootloader_exec_t)
role bootloader_roles types bootloader_t;

#
# bootloader_etc_t is the configuration file,
# grub.conf, lilo.conf, etc.
#
type bootloader_etc_t alias etc_bootloader_t;
files_type(bootloader_etc_t)

#
# The temp file is used for initrd creation;
# it consists of files and device nodes
#
type bootloader_tmp_t;
files_tmp_file(bootloader_tmp_t)
dev_node(bootloader_tmp_t)

########################################
#
# bootloader local policy
#

allow bootloader_t self:capability { dac_override dac_read_search fsetid sys_rawio sys_admin mknod chown };
allow bootloader_t self:process { signal_perms execmem };
allow bootloader_t self:fifo_file rw_fifo_file_perms;

allow bootloader_t bootloader_etc_t:file read_file_perms;
# uncomment the following lines if you use "lilo -p"
#allow bootloader_t bootloader_etc_t:file manage_file_perms;
#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)

manage_dirs_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
manage_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
manage_lnk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
manage_blk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
manage_chr_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
files_tmp_filetrans(bootloader_t, bootloader_tmp_t, { dir file lnk_file chr_file blk_file })
# for tune2fs (cjp: ?)
files_root_filetrans(bootloader_t, bootloader_tmp_t, file)

kernel_getattr_core_if(bootloader_t)
kernel_read_network_state(bootloader_t)
kernel_read_system_state(bootloader_t)
kernel_read_software_raid_state(bootloader_t)
kernel_read_kernel_sysctls(bootloader_t)

storage_raw_read_fixed_disk(bootloader_t)
storage_raw_write_fixed_disk(bootloader_t)
storage_raw_read_removable_device(bootloader_t)
storage_raw_write_removable_device(bootloader_t)

dev_getattr_all_chr_files(bootloader_t)
dev_getattr_all_blk_files(bootloader_t)
dev_dontaudit_rw_generic_dev_nodes(bootloader_t)
dev_read_rand(bootloader_t)
dev_read_urand(bootloader_t)
dev_read_sysfs(bootloader_t)
# needed on some hardware
dev_rw_nvram(bootloader_t)

fs_getattr_xattr_fs(bootloader_t)
fs_getattr_tmpfs(bootloader_t)
fs_read_tmpfs_symlinks(bootloader_t)
#Needed for ia64
fs_manage_dos_files(bootloader_t)

mls_file_read_all_levels(bootloader_t)
mls_file_write_all_levels(bootloader_t)

term_getattr_all_ttys(bootloader_t)
term_dontaudit_manage_pty_dirs(bootloader_t)

corecmd_exec_all_executables(bootloader_t)

domain_use_interactive_fds(bootloader_t)

files_create_boot_dirs(bootloader_t)
files_manage_boot_files(bootloader_t)
files_manage_boot_symlinks(bootloader_t)
files_read_etc_files(bootloader_t)
files_exec_etc_files(bootloader_t)
files_read_usr_src_files(bootloader_t)
files_read_usr_files(bootloader_t)
files_read_var_files(bootloader_t)
files_read_kernel_modules(bootloader_t)
# for nscd
files_dontaudit_search_pids(bootloader_t)
# for blkid.tab
files_manage_etc_runtime_files(bootloader_t)
files_etc_filetrans_etc_runtime(bootloader_t, file)
files_dontaudit_search_home(bootloader_t)

init_getattr_initctl(bootloader_t)
init_use_script_ptys(bootloader_t)
init_use_script_fds(bootloader_t)
init_rw_script_pipes(bootloader_t)

libs_read_lib_files(bootloader_t)
libs_exec_lib_files(bootloader_t)

logging_send_syslog_msg(bootloader_t)
logging_rw_generic_logs(bootloader_t)

miscfiles_read_localization(bootloader_t)

modutils_domtrans_insmod(bootloader_t)

seutil_read_bin_policy(bootloader_t)
seutil_read_loadpolicy(bootloader_t)
seutil_dontaudit_search_config(bootloader_t)

userdom_use_user_terminals(bootloader_t)
userdom_dontaudit_search_user_home_dirs(bootloader_t)

ifdef(`distro_debian',`
	allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };
	fs_list_tmpfs(bootloader_t)

	files_relabel_kernel_modules(bootloader_t)
	files_relabelfrom_boot_files(bootloader_t)
	files_delete_kernel_modules(bootloader_t)
	files_relabelto_usr_files(bootloader_t)
	files_search_var_lib(bootloader_t)
	# for /usr/share/initrd-tools/scripts
	files_exec_usr_files(bootloader_t)

	fstools_manage_entry_files(bootloader_t)
	fstools_relabelto_entry_files(bootloader_t)

	libs_relabelto_lib_files(bootloader_t)
')

ifdef(`distro_redhat',`
	# for memlock
	allow bootloader_t self:capability ipc_lock;

	# new file system defaults to file_t, granting file_t access is still bad.
	allow bootloader_t boot_runtime_t:file { read_file_perms delete_file_perms };

	# new file system defaults to file_t, granting file_t access is still bad.
	files_manage_isid_type_dirs(bootloader_t)
	files_manage_isid_type_files(bootloader_t)
	files_manage_isid_type_symlinks(bootloader_t)
	files_manage_isid_type_blk_files(bootloader_t)
	files_manage_isid_type_chr_files(bootloader_t)

	# for mke2fs
	mount_run(bootloader_t, bootloader_roles)

	optional_policy(`
		unconfined_domain(bootloader_t)
	')
')

optional_policy(`
	fstools_exec(bootloader_t)
')

optional_policy(`
	hal_dontaudit_append_lib_files(bootloader_t)
	hal_write_log(bootloader_t)
')

optional_policy(`
	kudzu_domtrans(bootloader_t)
')

optional_policy(`
	dev_rw_lvm_control(bootloader_t)

	lvm_domtrans(bootloader_t)
	lvm_read_config(bootloader_t)
')

optional_policy(`
	modutils_exec_insmod(bootloader_t)
	modutils_read_module_deps(bootloader_t)
	modutils_read_module_config(bootloader_t)
	modutils_exec_insmod(bootloader_t)
	modutils_exec_depmod(bootloader_t)
	modutils_exec_update_mods(bootloader_t)
')

optional_policy(`
	nscd_use(bootloader_t)
')

optional_policy(`
	rpm_rw_pipes(bootloader_t)
')
Module version bump for fixes from Dominick Grift. 2013-01-03 15:53:34 +00:00			`policy_module(bootloader, 1.13.2)`
add module statement macro and entrypoint executable attribute to replicate can_exec($1,exec_type) 2005-04-26 17:00:25 +00:00
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00			`########################################`
			`#`
			`# Declarations`
			`#`

Add role attributes to bootloader. 2011-08-12 14:37:56 +00:00			`attribute_role bootloader_roles;`
			`roleattribute system_r bootloader_roles;`

move modules_object_t back to bootloader 2005-04-25 21:32:09 +00:00			`#`
			`# boot_runtime_t is the type for /boot/kernel.h,`
			`# which is automatically generated at boot time.`
			`# only for Red Hat`
			`#`
add boot_runtime_t 2005-04-16 17:18:34 +00:00			`type boot_runtime_t;`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_type(boot_runtime_t)`
add boot_runtime_t 2005-04-16 17:18:34 +00:00
move modules_object_t back to bootloader 2005-04-25 21:32:09 +00:00			`type bootloader_t;`
			`type bootloader_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`application_domain(bootloader_t, bootloader_exec_t)`
Add role attributes to bootloader. 2011-08-12 14:37:56 +00:00			`role bootloader_roles types bootloader_t;`
move modules_object_t back to bootloader 2005-04-25 21:32:09 +00:00
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# bootloader_etc_t is the configuration file,`
			`# grub.conf, lilo.conf, etc.`
			`#`
			`type bootloader_etc_t alias etc_bootloader_t;`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_type(bootloader_etc_t)`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
			`# The temp file is used for initrd creation;`
			`# it consists of files and device nodes`
			`#`
			`type bootloader_tmp_t;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_tmp_file(bootloader_tmp_t)`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_node(bootloader_tmp_t)`
initial commit 2005-04-14 20:18:17 +00:00
make getattr and setattr interfaces and make naming consistent 2005-04-22 19:31:32 +00:00			`########################################`
			`#`
			`# bootloader local policy`
			`#`

patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`allow bootloader_t self:capability { dac_override dac_read_search fsetid sys_rawio sys_admin mknod chown };`
bootloader: permission set. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-10-04 18:23:17 +00:00			`allow bootloader_t self:process { signal_perms execmem };`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow bootloader_t self:fifo_file rw_fifo_file_perms;`
initial commit 2005-04-14 20:18:17 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow bootloader_t bootloader_etc_t:file read_file_perms;`
pile of updates 2005-05-13 14:37:13 +00:00			`# uncomment the following lines if you use "lilo -p"`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`#allow bootloader_t bootloader_etc_t:file manage_file_perms;`
			`#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)`
pile of updates 2005-05-13 14:37:13 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)`
			`manage_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)`
			`manage_lnk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)`
			`manage_blk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)`
			`manage_chr_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)`
			`files_tmp_filetrans(bootloader_t, bootloader_tmp_t, { dir file lnk_file chr_file blk_file })`
pile of updates 2005-05-13 14:37:13 +00:00			`# for tune2fs (cjp: ?)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`files_root_filetrans(bootloader_t, bootloader_tmp_t, file)`
pile of updates 2005-05-13 14:37:13 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_getattr_core_if(bootloader_t)`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`kernel_read_network_state(bootloader_t)`
initial commit 2005-04-14 20:18:17 +00:00			`kernel_read_system_state(bootloader_t)`
			`kernel_read_software_raid_state(bootloader_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(bootloader_t)`
initial commit 2005-04-14 20:18:17 +00:00
			`storage_raw_read_fixed_disk(bootloader_t)`
			`storage_raw_write_fixed_disk(bootloader_t)`
			`storage_raw_read_removable_device(bootloader_t)`
			`storage_raw_write_removable_device(bootloader_t)`

Devices rename. 2005-06-13 16:22:32 +00:00			`dev_getattr_all_chr_files(bootloader_t)`
fix bugs uncovered from sediff 2005-09-01 20:13:42 +00:00			`dev_getattr_all_blk_files(bootloader_t)`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_dontaudit_rw_generic_dev_nodes(bootloader_t)`
			`dev_read_rand(bootloader_t)`
			`dev_read_urand(bootloader_t)`
patch from dan Thu, 09 Feb 2006 13:39:41 -0500 2006-02-13 22:05:08 +00:00			`dev_read_sysfs(bootloader_t)`
patch from dan Wed, 23 Aug 2006 14:03:49 -0400 2006-08-29 02:41:00 +00:00			`# needed on some hardware`
			`dev_rw_nvram(bootloader_t)`
initial commit 2005-04-14 20:18:17 +00:00
renaming insanity 2005-06-10 01:01:13 +00:00			`fs_getattr_xattr_fs(bootloader_t)`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`fs_getattr_tmpfs(bootloader_t)`
patch from dan 2006-01-25 15:53:35 +00:00			`fs_read_tmpfs_symlinks(bootloader_t)`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`#Needed for ia64`
			`fs_manage_dos_files(bootloader_t)`
pile of updates 2005-05-13 14:37:13 +00:00
trunk: Deprecate mls_file_write_down() and mls_file_read_up(), replaced with mls_write_all_levels() and mls_read_all_levels(), for consistency. 2007-08-20 18:26:08 +00:00			`mls_file_read_all_levels(bootloader_t)`
			`mls_file_write_all_levels(bootloader_t)`
patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00
Remove concept of user from terminal module interfaces dealing with ptynode and ttynode since these attributes are not specific to users. 2010-02-11 19:20:10 +00:00			`term_getattr_all_ttys(bootloader_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`term_dontaudit_manage_pty_dirs(bootloader_t)`
pile of updates 2005-05-13 14:37:13 +00:00
add concept of executables, and update policies which really want this intead of entrypoints 2006-04-19 21:43:02 +00:00			`corecmd_exec_all_executables(bootloader_t)`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(bootloader_t)`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_create_boot_dirs(bootloader_t)`
			`files_manage_boot_files(bootloader_t)`
			`files_manage_boot_symlinks(bootloader_t)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_etc_files(bootloader_t)`
fixes from sediff 2005-09-22 21:59:50 +00:00			`files_exec_etc_files(bootloader_t)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_usr_src_files(bootloader_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_read_usr_files(bootloader_t)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_var_files(bootloader_t)`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_read_kernel_modules(bootloader_t)`
pile of updates 2005-05-13 14:37:13 +00:00			`# for nscd`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_dontaudit_search_pids(bootloader_t)`
patch from dan Fri, 17 Mar 2006 15:22:53 -0500 2006-03-23 19:19:38 +00:00			`# for blkid.tab`
			`files_manage_etc_runtime_files(bootloader_t)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`files_etc_filetrans_etc_runtime(bootloader_t, file)`
patch from Dan Tue, 20 Jun 2006 16:19:13 -0400 2006-06-21 18:25:06 +00:00			`files_dontaudit_search_home(bootloader_t)`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
missing rules uncovered by sediff 2005-07-07 15:20:24 +00:00			`init_getattr_initctl(bootloader_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(bootloader_t)`
another round of renaming 2006-02-20 21:33:25 +00:00			`init_use_script_fds(bootloader_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_rw_script_pipes(bootloader_t)`
missing rules uncovered by sediff 2005-07-07 15:20:24 +00:00
another slew of renaming 2006-02-02 21:08:12 +00:00			`libs_read_lib_files(bootloader_t)`
fixes from sediff 2005-09-22 21:59:50 +00:00			`libs_exec_lib_files(bootloader_t)`
initial commit 2005-04-14 20:18:17 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`logging_send_syslog_msg(bootloader_t)`
			`logging_rw_generic_logs(bootloader_t)`
initial commit 2005-04-14 20:18:17 +00:00
pile of updates 2005-05-13 14:37:13 +00:00			`miscfiles_read_localization(bootloader_t)`
initial commit 2005-04-14 20:18:17 +00:00
Change secure_mode_insmod to control sys_module capability rather than controlling domain transitions to insmod. Based on a patch from Dan Walsh. 2011-09-13 18:45:14 +00:00			`modutils_domtrans_insmod(bootloader_t)`
patch from Dan Tue, 20 Jun 2006 16:19:13 -0400 2006-06-21 18:25:06 +00:00
another slew of renaming 2006-02-02 21:08:12 +00:00			`seutil_read_bin_policy(bootloader_t)`
			`seutil_read_loadpolicy(bootloader_t)`
more cleanup in system 2005-07-18 18:31:49 +00:00			`seutil_dontaudit_search_config(bootloader_t)`
make getattr and setattr interfaces and make naming consistent 2005-04-22 19:31:32 +00:00
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_use_user_terminals(bootloader_t)`
			`userdom_dontaudit_search_user_home_dirs(bootloader_t)`

add fstools, and more cleanup 2005-06-27 20:59:28 +00:00			ifdef(`distro_debian',`
			`allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };`
try to knock out more of the distro_debian bootloader stuff 2005-08-15 19:31:37 +00:00			`fs_list_tmpfs(bootloader_t)`

make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_relabel_kernel_modules(bootloader_t)`
			`files_relabelfrom_boot_files(bootloader_t)`
			`files_delete_kernel_modules(bootloader_t)`
try to knock out more of the distro_debian bootloader stuff 2005-08-15 19:31:37 +00:00			`files_relabelto_usr_files(bootloader_t)`
			`files_search_var_lib(bootloader_t)`
add fstools, and more cleanup 2005-06-27 20:59:28 +00:00			`# for /usr/share/initrd-tools/scripts`
			`files_exec_usr_files(bootloader_t)`
try to knock out more of the distro_debian bootloader stuff 2005-08-15 19:31:37 +00:00
			`fstools_manage_entry_files(bootloader_t)`
			`fstools_relabelto_entry_files(bootloader_t)`

			`libs_relabelto_lib_files(bootloader_t)`
pile of updates 2005-05-13 14:37:13 +00:00			`')`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
add fstools, and more cleanup 2005-06-27 20:59:28 +00:00			ifdef(`distro_redhat',`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`# for memlock`
			`allow bootloader_t self:capability ipc_lock;`

			`# new file system defaults to file_t, granting file_t access is still bad.`
bootloader: permission set. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-10-04 18:23:17 +00:00			`allow bootloader_t boot_runtime_t:file { read_file_perms delete_file_perms };`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00
add fstools, and more cleanup 2005-06-27 20:59:28 +00:00			`# new file system defaults to file_t, granting file_t access is still bad.`
renaming from 20060131 interface review, round 3 2006-01-31 19:21:01 +00:00			`files_manage_isid_type_dirs(bootloader_t)`
			`files_manage_isid_type_files(bootloader_t)`
			`files_manage_isid_type_symlinks(bootloader_t)`
			`files_manage_isid_type_blk_files(bootloader_t)`
			`files_manage_isid_type_chr_files(bootloader_t)`
add fstools, and more cleanup 2005-06-27 20:59:28 +00:00
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`# for mke2fs`
Add role attributes to bootloader. 2011-08-12 14:37:56 +00:00			`mount_run(bootloader_t, bootloader_roles)`
trunk: 6 patches from the fedora policy, cherry picked by david hardeman. 2008-08-14 14:19:50 +00:00
			optional_policy(`
			`unconfined_domain(bootloader_t)`
			`')`
pile of updates 2005-05-13 14:37:13 +00:00			`')`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
fixes for module compiling 2005-09-14 00:30:10 +00:00			`fstools_exec(bootloader_t)`
pile of updates 2005-05-13 14:37:13 +00:00			`')`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			optional_policy(`
			`hal_dontaudit_append_lib_files(bootloader_t)`
trunk: 4 patches from dan. 2007-09-05 14:48:21 +00:00			`hal_write_log(bootloader_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`')`

patch from Dan Tue, 20 Jun 2006 16:19:13 -0400 2006-06-21 18:25:06 +00:00			optional_policy(`
			`kudzu_domtrans(bootloader_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_rw_lvm_control(bootloader_t)`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`lvm_domtrans(bootloader_t)`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`lvm_read_config(bootloader_t)`
pile of updates 2005-05-13 14:37:13 +00:00			`')`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
piles of fixes for loadable modules 2005-10-18 18:25:33 +00:00			`modutils_exec_insmod(bootloader_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`modutils_read_module_deps(bootloader_t)`
			`modutils_read_module_config(bootloader_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`modutils_exec_insmod(bootloader_t)`
			`modutils_exec_depmod(bootloader_t)`
			`modutils_exec_update_mods(bootloader_t)`
pile of updates 2005-05-13 14:37:13 +00:00			`')`
initial commit 2005-04-14 20:18:17 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
NSCD related changes in various policy modules Use nscd_use instead of nscd_socket_use. This conditionally allows nscd_shm_use Remove the nscd_socket_use from ssh_keygen since it was redundant already allowed by auth_use_nsswitch Had to make some ssh_keysign_t rules unconditional else nscd_use(ssh_keysign_t) would not build (nested booleans) but that does not matter, the only actual domain transition to ssh_keysign_t is conditional so the other unconditional ssh_keygen_t rules are conditional in practice Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2012-12-17 20:06:29 +00:00			`nscd_use(bootloader_t)`
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another slew of renaming 2006-02-02 21:08:12 +00:00			`rpm_rw_pipes(bootloader_t)`
more cleanup of current TODOs 2005-07-12 20:34:24 +00:00			`')`