RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/init.fc

98 lines
4.3 KiB
Plaintext
Raw Normal View History

initial commit
2005-05-10 19:51:00 +00:00
#
# /etc
#
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/rc\.d/rc -- gen_context(system_u:object_r:initrc_exec_t,s0)
Init patch from Dan Walsh.
2010-03-18 14:19:49 +00:00
/etc/rc\.d/rc\.[^/]+ -- gen_context(system_u:object_r:initrc_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/rc\.d/init\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
Init patch from Dan Walsh.
2010-03-18 14:19:49 +00:00
/etc/sysconfig/network-scripts/ifup-ipsec -- gen_context(system_u:object_r:initrc_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
trunk: merge strict and targeted policies. merge shlib_t into lib_t.
2007-10-02 16:04:50 +00:00
/etc/X11/prefdm -- gen_context(system_u:object_r:initrc_exec_t,s0)
more strict testing fixes
2006-08-23 19:36:04 +00:00
ifdef(`distro_gentoo',`
/etc/vmware/init\.d/vmware -- gen_context(system_u:object_r:initrc_exec_t,s0)
trunk: Patch to clean up unescaped periods in several file context entries from Jan-Frode Myklebust.
2007-10-05 18:00:55 +00:00
/etc/x11/startDM\.sh -- gen_context(system_u:object_r:initrc_exec_t,s0)
more strict testing fixes
2006-08-23 19:36:04 +00:00
')
initial commit
2005-05-10 19:51:00 +00:00
#
# /dev
#
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/dev/initctl -p gen_context(system_u:object_r:initctl_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
#
# /usr
#
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
/usr/bin/open_init_pty -- gen_context(system_u:object_r:initrc_exec_t,s0)
trunk: add sepostgresql policy from kaigai kohei.
2008-06-10 15:33:18 +00:00
/usr/bin/sepg_ctl -- gen_context(system_u:object_r:initrc_exec_t,s0)
Little misc patches from Russell Coker.
2017-02-18 14:39:01 +00:00
/usr/bin/systemd -- gen_context(system_u:object_r:init_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
trunk: add sepostgresql policy from kaigai kohei.
2008-06-10 15:33:18 +00:00
Label systemd files in init module
2014-09-07 21:28:10 +00:00
/usr/lib/systemd/systemd -- gen_context(system_u:object_r:init_exec_t,s0)
label systemd-shutdown so shutdown works I am seeing (on RHEL 7.4 w/systemd) that halting the system doesn't work. It took me a long time (and a lot of help from Steve L.) to figure out what was going on. It turns out in refpolicy the default label for /usr/lib/systemd/systemd-shutdown is bin_t. But when systemd tried to execve systemd-shutdown it fails because init_t isn't allowed file entrypoint for bin_t. When I labeled systemd-shutdown as init_exec_t shutting down the system works. I was seeing the following log (from systemd) when I enabled systemd debug logging (which was very useful). [ 59.745037] systemd[1]: Starting Final Step. [ 59.746112] systemd[1]: Starting Power-Off... [ 59.776320] systemd[1]: Shutting down. [ 59.783559] systemd[1]: Failed to execute shutdown binary, freezing: Operation not permitted At this point everything locks up instead of actually halting the system. This is a patch to change the label for systemd-shutdown which solves the problem. I'm happy to go through and make a distinct type of systemd-shutdown if someone doesn't think it is a good idea to share the type with systemd. But based on what is going on, this might be reasonable. Signed-off-by: Dave Sugar <dsugar@tresys.com>
2017-12-08 22:30:58 +00:00
/usr/lib/systemd/systemd-shutdown -- gen_context(system_u:object_r:init_exec_t,s0)
Implement core systemd policy. Significant contributions from the Tresys CLIP team. Other changes from Laurent Bigonville.
2015-10-23 14:16:59 +00:00
/usr/lib/systemd/system-preset(/.*)? gen_context(system_u:object_r:systemd_unit_t,s0)
/usr/lib/systemd/user-preset(/.*)? gen_context(system_u:object_r:systemd_unit_t,s0)
/usr/lib/systemd/ntp-units\.d -d gen_context(system_u:object_r:systemd_unit_t,s0)
/usr/lib/systemd/system(/.*)? gen_context(system_u:object_r:systemd_unit_t,s0)
Move use of systemd_unit_t from systemd.fc to init.fc The type systemd_unit_t is actually declared in init.te. Moved the file contexts to label transient systemd files with the systemd_unit_t type from systemd.fc to init.fc. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2018-04-11 18:55:22 +00:00
/run/systemd/transient(/.*)? gen_context(system_u:object_r:systemd_unit_t,s0)
Label systemd files in init module
2014-09-07 21:28:10 +00:00
add dcc, bug 1522
2006-05-04 17:44:26 +00:00
/usr/libexec/dcc/start-.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
/usr/libexec/dcc/stop-.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/sbin/open_init_pty -- gen_context(system_u:object_r:initrc_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_gentoo', `
init: upstream fcontexts from gentoo policy Signed-off-by: Jason Zaman <jason@perfinion.com>
2020-11-17 03:46:27 +00:00
/usr/lib/rc/cache(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
/usr/lib/rc/console(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
init: Move fc lines.
2017-09-08 23:30:34 +00:00
/usr/lib/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
init: upstream fcontexts from gentoo policy Signed-off-by: Jason Zaman <jason@perfinion.com>
2020-11-17 03:46:27 +00:00
/usr/sbin/rc -- gen_context(system_u:object_r:rc_exec_t,s0)
/usr/sbin/openrc -- gen_context(system_u:object_r:rc_exec_t,s0)
init: Added fcontext for openrc-init. Signed-off-by: Jonathan Davies <jpds@protonmail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org> Signed-off-by: Jason Zaman <jason@perfinion.com>
2020-11-17 03:46:24 +00:00
/usr/sbin/openrc-init -- gen_context(system_u:object_r:init_exec_t,s0)
init: Added fcontext for openrc-shutdown. Signed-off-by: Jonathan Davies <jpds@protonmail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org> Signed-off-by: Jason Zaman <jason@perfinion.com>
2020-11-17 03:46:25 +00:00
/usr/sbin/openrc-shutdown -- gen_context(system_u:object_r:init_exec_t,s0)
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
')
init: Move fc lines.
2017-09-08 23:30:34 +00:00
ifdef(`distro_redhat',`
/usr/lib/systemd/rhel[^/]* -- gen_context(system_u:object_r:initrc_exec_t,s0)
')
initial commit
2005-05-10 19:51:00 +00:00
#
# /var
#
Label systemd files in init module
2014-09-07 21:28:10 +00:00
/var/lib/systemd(/.*)? gen_context(system_u:object_r:init_var_lib_t,s0)
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/initctl -p gen_context(system_u:object_r:initctl_t,s0)
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/kerneloops\.pid -- gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/utmp -- gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/runlevel\.dir gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/random-seed -- gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/setmixer_flag -- gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/systemd(/.*)? gen_context(system_u:object_r:init_runtime_t,s0)
/run/wd_keepalive\.pid -- gen_context(system_u:object_r:initrc_runtime_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
ifdef(`distro_debian',`
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/hotkey-setup -- gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/kdm/.* -- gen_context(system_u:object_r:initrc_runtime_t,s0)
Misc fc changes from Russell Coker.
2017-04-06 20:59:47 +00:00
/etc/network/if-pre-up\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
/etc/network/if-up\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
/etc/network/if-down\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
/etc/network/if-post-down\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
')
Rearrange distro blocks in init.fc
2010-12-15 19:48:43 +00:00
ifdef(`distro_gentoo', `
/var/lib/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
init: upstream fcontexts from gentoo policy Signed-off-by: Jason Zaman <jason@perfinion.com>
2020-11-17 03:46:27 +00:00
/var/lib/ip6?tables(/.*)? gen_context(system_u:object_r:initrc_tmp_t,s0)
/run/openrc(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/svscan\.pid -- gen_context(system_u:object_r:initrc_runtime_t,s0)
Rearrange distro blocks in init.fc
2010-12-15 19:48:43 +00:00
')
initial commit
2005-05-10 19:51:00 +00:00
ifdef(`distro_suse', `
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/bootsplashctl -p gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/keymap -- gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/numlock-on -- gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/setleds-on -- gen_context(system_u:object_r:initrc_runtime_t,s0)
/run/sysconfig(/.*)? gen_context(system_u:object_r:initrc_runtime_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
')