selinux-refpolicy/policy/modules/roles/staff.te

policy_module(staff, 2.5.2)

########################################
#
# Declarations
#

#role staff_r;

userdom_unpriv_user_template(staff)

########################################
#
# Local policy
#

optional_policy(`
	apache_role(staff_r, staff_t)
')

optional_policy(`
	auditadm_role_change(staff_r)
')

optional_policy(`
	dbadm_role_change(staff_r)
')

optional_policy(`
	git_role(staff_r, staff_t)
')

optional_policy(`
	postgresql_role(staff_r, staff_t)
')

optional_policy(`
	secadm_role_change(staff_r)
')

optional_policy(`
	ssh_role_template(staff, staff_r, staff_t)
')

optional_policy(`
	sudo_role_template(staff, staff_r, staff_t)
')

optional_policy(`
	sysadm_role_change(staff_r)
	userdom_dontaudit_use_user_terminals(staff_t)
')

optional_policy(`
	vlock_run(staff_t, staff_r)
')

optional_policy(`
	xserver_role(staff_r, staff_t)
')

ifndef(`distro_redhat',`
	optional_policy(`
		auth_role(staff_r, staff_t)
	')

	optional_policy(`
		bluetooth_role(staff_r, staff_t)
	')

	optional_policy(`
		cdrecord_role(staff_r, staff_t)
	')

	optional_policy(`
		cron_role(staff_r, staff_t)
	')

	optional_policy(`
		dbus_role_template(staff, staff_r, staff_t)

		optional_policy(`
			gnome_role_template(staff, staff_r, staff_t)
		')

		optional_policy(`
			pulseaudio_role(staff_r, staff_t)
		')

		optional_policy(`
			telepathy_role_template(staff, staff_r, staff_t)
		')
	')

	optional_policy(`
		evolution_role(staff_r, staff_t)
	')

	optional_policy(`
		games_role(staff_r, staff_t)
	')

	optional_policy(`
		gift_role(staff_r, staff_t)
	')

	optional_policy(`
		gpg_role(staff_r, staff_t)
	')

	optional_policy(`
		irc_role(staff_r, staff_t)
	')

	optional_policy(`
		java_role(staff_r, staff_t)
	')

	optional_policy(`
		lockdev_role(staff_r, staff_t)
	')

	optional_policy(`
		lpd_role(staff_r, staff_t)
	')

	optional_policy(`
		mozilla_role(staff_r, staff_t)
	')

	optional_policy(`
		mplayer_role(staff_r, staff_t)
	')

	optional_policy(`
		mta_role(staff_r, staff_t)
	')

	optional_policy(`
		pyzor_role(staff_r, staff_t)
	')

	optional_policy(`
		razor_role(staff_r, staff_t)
	')

	optional_policy(`
		rssh_role(staff_r, staff_t)
	')

	optional_policy(`
		screen_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		spamassassin_role(staff_r, staff_t)
	')

	optional_policy(`
		su_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		thunderbird_role(staff_r, staff_t)
	')

	optional_policy(`
		tvtime_role(staff_r, staff_t)
	')

	optional_policy(`
		uml_role(staff_r, staff_t)
	')

	optional_policy(`
		userhelper_role_template(staff, staff_r, staff_t)
	')

	optional_policy(`
		vmware_role(staff_r, staff_t)
	')

	optional_policy(`
		wireshark_role(staff_r, staff_t)
	')
')
Module version bump for CIL fixes from Yuli Khodorkovskiy. 2014-09-17 18:00:08 +00:00			`policy_module(staff, 2.5.2)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

Remove duplicate role declarations -This patch is needed since CIL does not allow duplicate role declarations. The roles for system_r, staff_r, sysadm_r, and user_r were already declared in kernel.te. Since the roles are pulled in from require statements in the appropriate interfaces, the duplicate role declarations could be deleted in modules for auditadm, staff, sysadm, and userdomain. -Move a role declaration that used an argument passed into the userdom_base_user_template into a gen_require statement. 2014-09-15 17:22:27 +00:00			`#role staff_r;`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00
			`userdom_unpriv_user_template(staff)`

			`########################################`
			`#`
			`# Local policy`
			`#`

			optional_policy(`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`apache_role(staff_r, staff_t)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00			`')`

			optional_policy(`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`auditadm_role_change(staff_r)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00			`')`

Dbadm updates from KaiGai Kohei. 2010-08-19 12:41:39 +00:00			optional_policy(`
			`dbadm_role_change(staff_r)`
			`')`

New git service features from Dominick Grift. * git user sessions * repositories on CIFS/NFS * inetd service 2011-09-02 13:20:23 +00:00			optional_policy(`
			`git_role(staff_r, staff_t)`
			`')`

trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`postgresql_role(staff_r, staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`secadm_role_change(staff_r)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`ssh_role_template(staff, staff_r, staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`sudo_role_template(staff, staff_r, staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`sysadm_role_change(staff_r)`
			`userdom_dontaudit_use_user_terminals(staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

Adding support for the vlock program. Both the system administrator and the unprivileged user could use vlock to lock the current console when logging in either from the serial console or by ssh. Signed-off-by: Harry Ciao <qingtao.cao@windriver.com> 2010-10-26 06:34:11 +00:00			optional_policy(`
Rename vlock interfaces. 2010-11-01 15:22:07 +00:00			`vlock_run(staff_t, staff_r)`
Adding support for the vlock program. Both the system administrator and the unprivileged user could use vlock to lock the current console when logging in either from the serial console or by ssh. Signed-off-by: Harry Ciao <qingtao.cao@windriver.com> 2010-10-26 06:34:11 +00:00			`')`

trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			optional_policy(`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`xserver_role(staff_r, staff_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`

roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			ifndef(`distro_redhat',`
			optional_policy(`
			`auth_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`bluetooth_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`cdrecord_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`cron_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`dbus_role_template(staff, staff_r, staff_t)`
Changes to the user domain policy module gnome_role is deprecated, use gnome_role_template instead depends on dbus because of gkeyringd Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2012-10-22 12:48:22 +00:00
			optional_policy(`
			`gnome_role_template(staff, staff_r, staff_t)`
			`')`
users: calls pulseaudio_role() for restricted xwindows users and staff_t/user_t Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2013-11-09 09:45:16 +00:00
			optional_policy(`
			`pulseaudio_role(staff_r, staff_t)`
			`')`
Add telepathy role for user_r and staff_r 2014-04-05 18:01:21 +00:00
			optional_policy(`
			`telepathy_role_template(staff, staff_r, staff_t)`
			`')`
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`evolution_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`games_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`gift_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`gpg_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`irc_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`java_role(staff_r, staff_t)`
			`')`
Add dbadm, from KaiGai Kohei. 2010-02-08 15:34:08 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`lockdev_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`lpd_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`mozilla_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`mplayer_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`mta_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`pyzor_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`razor_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`rssh_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`screen_role_template(staff, staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`spamassassin_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`su_role_template(staff, staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-07-21 14:39:57 +00:00			optional_policy(`
			`thunderbird_role(staff_r, staff_t)`
			`')`

			optional_policy(`
			`tvtime_role(staff_r, staff_t)`
			`')`

			optional_policy(`
			`uml_role(staff_r, staff_t)`
			`')`

			optional_policy(`
			`userhelper_role_template(staff, staff_r, staff_t)`
			`')`

			optional_policy(`
			`vmware_role(staff_r, staff_t)`
			`')`

			optional_policy(`
			`wireshark_role(staff_r, staff_t)`
			`')`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`')`