RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/apps/java.fc

34 lines
1.9 KiB
Plaintext
Raw Normal View History

Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
HOME_DIR/\.java(/.*)? gen_context(system_u:object_r:java_home_t,s0)
/opt/(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
/opt/ibm/java.*/(bin|javaws)(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
/opt/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
/opt/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
java: reduce the scope of the pattern in for java entry points The following pattern seems to match much more than intended: /usr/(.*/)?bin/java[^-]* According to the commit which introduced it (https://github.com/TresysTechnology/refpolicy/commit/0190325c18c30d31145950c1eaf80d12fa6c9db3), the aim was to match java1.4, java5, java6, and not java-config nor java-check-environment. The issue is that the pattern also matches sub-directories such as: /usr/share/my-application/bin/java/myfile Prevent this by adding / in the character blacklist of the pattern. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-08-21 19:41:11 +00:00
/usr/(.*/)?bin/java[^/-]* -- gen_context(system_u:object_r:java_exec_t,s0)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
/usr/bin/fastjar -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/frysk -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/gappletviewer -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/gcj-dbtool -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/gij -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/gjarsigner -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/gkeytool -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/grmic -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/grmiregistry -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/jv-convert -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/java/eclipse[^/]*/eclipse -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/bin/java[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/eclipse/eclipse -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/icedtea[0-9]+/bin/.* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/icedtea[0-9]+/jre/bin/.* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/opera(/.*)?/opera -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/opera(/.*)?/works -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)