RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/mount.fc

13 lines
712 B
Plaintext
Raw Normal View History

patch from dan Tue, 24 Oct 2006 11:00:28 -0400
2006-10-31 21:01:48 +00:00
/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount... mount.fc defines file contexts for /usr/bin/mount.*, /usr/bin/umount.* and /usr/sbin/mount\.zfs. These patterns are not consistent for two reasons: - some distributions use /sbin/mount... for other file systems that zfs. For example Debian uses /sbin/mount.ntfs-3g (https://packages.debian.org/jessie/amd64/ntfs-3g/filelist) - mount_exec_t type should only be applied to mount, umount, mount.$FS and umount.udisks2, not mountpoint. Replace the file patterns with ones that do not match mountpoint and match every mount and umount programs in /usr/bin and /usr/sbin.
2017-04-15 18:23:34 +00:00
/usr/bin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/bin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/zfs -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/bin/zpool -- gen_context(system_u:object_r:mount_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount... mount.fc defines file contexts for /usr/bin/mount.*, /usr/bin/umount.* and /usr/sbin/mount\.zfs. These patterns are not consistent for two reasons: - some distributions use /sbin/mount... for other file systems that zfs. For example Debian uses /sbin/mount.ntfs-3g (https://packages.debian.org/jessie/amd64/ntfs-3g/filelist) - mount_exec_t type should only be applied to mount, umount, mount.$FS and umount.udisks2, not mountpoint. Replace the file patterns with ones that do not match mountpoint and match every mount and umount programs in /usr/bin and /usr/sbin.
2017-04-15 18:23:34 +00:00
/usr/sbin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/sbin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/zfs -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/sbin/zpool -- gen_context(system_u:object_r:mount_exec_t,s0)
Add mount_var_run_t type and allow mount_t domain to manage the files and directories In Debian, mount store some information (a utab file) under /var/run/mount directory. This is inspired by the fedora policy.
2013-01-12 21:32:26 +00:00
update mount module * rename mount_var_run_t to mount_runtime_t * delete kernel_read_unlabeled_files(mount_t) * add selinux_getattr_fs(mount_t)
2017-01-06 14:05:00 +00:00
/run/mount(/.*)? gen_context(system_u:object_r:mount_runtime_t,s0)