RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/authlogin.fc

53 lines
2.8 KiB
Plaintext
Raw Normal View History

rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
/etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0)
/etc/gshadow.* -- gen_context(system_u:object_r:shadow_t,s0)
/etc/passwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
/etc/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
/usr/bin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
/usr/bin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/bin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
/usr/bin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/bin/utempter -- gen_context(system_u:object_r:utempter_exec_t,s0)
/usr/bin/validate -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/kerberos/sbin/login\.krb5 -- gen_context(system_u:object_r:login_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Properly label utempter helper on debian
2015-11-26 20:45:34 +00:00
/usr/lib/utempter/utempter -- gen_context(system_u:object_r:utempter_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
/usr/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/sbin/utempter -- gen_context(system_u:object_r:utempter_exec_t,s0)
/usr/sbin/validate -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_suse', `
/usr/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
initial commit
2005-05-10 19:51:00 +00:00
trunk: 1 patch from dan.
2009-06-12 15:30:15 +00:00
/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/db/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
add patch from dan
2005-11-15 16:34:10 +00:00
/var/lib/abl(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
/var/lib/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
add patch from dan
2005-11-15 16:34:10 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/log/btmp.* -- gen_context(system_u:object_r:faillog_t,s0)
/var/log/faillog -- gen_context(system_u:object_r:faillog_t,s0)
/var/log/lastlog -- gen_context(system_u:object_r:lastlog_t,s0)
patch from dan Tue, 24 Oct 2006 11:00:28 -0400
2006-10-31 21:01:48 +00:00
/var/log/tallylog -- gen_context(system_u:object_r:faillog_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/log/wtmp.* -- gen_context(system_u:object_r:wtmp_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0)
/run/faillock(/.*)? gen_context(system_u:object_r:faillog_t,s0)
/run/pam_mount(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
/run/sepermit(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
sudo: add fcontext for /run/sudo/ts/USERNAME This lets restorecon -F set the context properly
2017-09-15 17:16:14 +00:00
/run/sudo/ts/%{USERNAME} gen_context(system_u:object_r:pam_var_run_t,s0)
authlogin: Sudo file context specification did not catch paths (squash me) Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-24 13:40:05 +00:00
/var/(db|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/var/lib/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)