selinux-refpolicy/policy/modules/system/miscfiles.te

policy_module(miscfiles, 1.12.4)

########################################
#
# Declarations
#

attribute cert_type;

#
# cert_t is the type of files in the system certs directories.
#
type cert_t;
miscfiles_cert_type(cert_t)

#
# fonts_t is the type of various font
# files in /usr
#
type fonts_t;
files_type(fonts_t)

type fonts_cache_t;
files_type(fonts_cache_t)

#
# type for /usr/share/hwdata
#
type hwdata_t;
files_type(hwdata_t)

#
# locale_t is the type for system localization
#
type locale_t;
files_type(locale_t)

#
# man_t is the type for the man directories.
#
type man_t alias catman_t;
files_type(man_t)

optional_policy(`
	systemd_tmpfilesd_managed(man_t, dir)
')

type man_cache_t;
files_type(man_cache_t)

#
# Types for public content
#
type public_content_t; #, customizable;
files_type(public_content_t)

type public_content_rw_t; #, customizable;
files_type(public_content_rw_t)

#
# Base type for the tests directory.
#
type test_file_t;
files_type(test_file_t)

#
# for /var/{spool,lib}/texmf index files
#
type tetex_data_t;
files_tmp_file(tetex_data_t)
miscfiles: Module version bump for patch from Luis Ressel. 2017-06-07 23:26:06 +00:00			`policy_module(miscfiles, 1.12.4)`
add module statement macro and entrypoint executable attribute to replicate can_exec($1,exec_type) 2005-04-26 17:00:25 +00:00
more work on current modules 2005-06-30 18:54:08 +00:00			`########################################`
			`#`
			`# Declarations`
			`#`

Implement miscfiles_cert_type(). This is based on Fedoras' miscfiles_cert_type implementation. The idea was that openvpn needs to be able read home certificates (home_cert_t) which is not implemented in refpolicy yet, as well as generic cert_t certificates. Note that openvpn is allowed to read all cert_types, as i know that it needs access to both generic cert_t as well as (future) home_cert_t. Dwalsh noted that other domains may need this as well but because i do not know exactly which domains i will not changes any other domains call to generic cert type interfaces. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-09-09 16:14:48 +00:00			`attribute cert_type;`

initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# cert_t is the type of files in the system certs directories.`
			`#`
			`type cert_t;`
Implement miscfiles_cert_type(). This is based on Fedoras' miscfiles_cert_type implementation. The idea was that openvpn needs to be able read home certificates (home_cert_t) which is not implemented in refpolicy yet, as well as generic cert_t certificates. Note that openvpn is allowed to read all cert_types, as i know that it needs access to both generic cert_t as well as (future) home_cert_t. Dwalsh noted that other domains may need this as well but because i do not know exactly which domains i will not changes any other domains call to generic cert type interfaces. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-09-09 16:14:48 +00:00			`miscfiles_cert_type(cert_t)`
system_miscfiles patch from Dan Walsh "move cobbler, Allow policy to define certs." 2010-11-11 20:11:38 +00:00
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# fonts_t is the type of various font`
			`# files in /usr`
			`#`
			`type fonts_t;`
clean up usercanread 2006-06-14 20:52:45 +00:00			`files_type(fonts_t)`
initial commit 2005-04-14 20:18:17 +00:00
Miscfiles patch from Dan Walsh. 2010-03-09 15:44:55 +00:00			`type fonts_cache_t;`
			`files_type(fonts_cache_t)`

more merging of NSA CVS policy 2005-09-13 13:06:07 +00:00			`#`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`# type for /usr/share/hwdata`
more merging of NSA CVS policy 2005-09-13 13:06:07 +00:00			`#`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`type hwdata_t;`
			`files_type(hwdata_t)`
more upstream merging 2005-09-16 19:36:10 +00:00
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# locale_t is the type for system localization`
			`#`
			`type locale_t;`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_type(locale_t)`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
			`# man_t is the type for the man directories.`
			`#`
more merging of NSA CVS policy 2005-09-13 13:06:07 +00:00			`type man_t alias catman_t;`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_type(man_t)`
initial commit 2005-04-14 20:18:17 +00:00
Systemd fixes from Russell Coker. 2017-02-24 01:03:23 +00:00			optional_policy(`
			`systemd_tmpfilesd_managed(man_t, dir)`
			`')`

Label /var/cache/man with a private man cache type for mandb Since /var/cache/man was previously labeled man_t, make sure that the old interfaces with regard to man_t also support man_cache_t Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2012-10-31 18:02:16 +00:00			`type man_cache_t;`
			`files_type(man_cache_t)`

partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`#`
			`# Types for public content`
			`#`
			`type public_content_t; #, customizable;`
			`files_type(public_content_t)`

			`type public_content_rw_t; #, customizable;`
			`files_type(public_content_rw_t)`

initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# Base type for the tests directory.`
			`#`
uncomment test file 2005-04-21 21:34:08 +00:00			`type test_file_t;`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_type(test_file_t)`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
			`# for /var/{spool,lib}/texmf index files`
			`#`
more cleanup in system 2005-07-18 18:31:49 +00:00			`type tetex_data_t;`
			`files_tmp_file(tetex_data_t)`