RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/kernel/filesystem.fc

29 lines
903 B
Plaintext
Raw Normal View History

Rearrange and whitespace fix filesystem.fc.
2011-04-14 14:17:18 +00:00
/cgroup -d gen_context(system_u:object_r:cgroup_t,s0)
/cgroup/.* <<none>>
cgroup in filesystem. Move cgroup_t declarations from kernel.te to filesystem.te Redo cgroup interfaces in filesystem.if Add file context specification for /cgroup mountpoint to filesystem.fc Signed-off-by: Dominick Grift <domg472@gmail.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2010-06-07 18:17:14 +00:00
Rearrange and whitespace fix filesystem.fc.
2011-04-14 14:17:18 +00:00
/dev/hugepages -d gen_context(system_u:object_r:hugetlbfs_t,s0)
/dev/hugepages(/.*)? <<none>>
/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
/dev/shm/.* <<none>>
Libcgroup moved the cgroup directory to /sys/fs/cgroup. Signed-off-by: Dominick Grift <domg472@gmail.com>
2010-09-03 14:25:47 +00:00
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/lib/udev/devices/hugepages -d gen_context(system_u:object_r:hugetlbfs_t,s0)
/usr/lib/udev/devices/hugepages/.* <<none>>
/usr/lib/udev/devices/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
/usr/lib/udev/devices/shm/.* <<none>>
added bpf_t filesystem label
2019-11-24 14:07:58 +00:00
/sys/fs/bpf(/.*)? <<none>>
Initial pstore support Generic interface to platform dependent persistent storage https://www.kernel.org/doc/Documentation/ABI/testing/pstore This basically works pretty much the same as cgroup file systems from a SELinux perspective Make sure that the installed /sys/fs/pstore directory is labeled properly so that the pstore file system can be mounted on that I also removed the files_type() calls as they are duplicate (it is already called in files_mountpoint) Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-11 08:53:08 +00:00
/sys/fs/cgroup -d gen_context(system_u:object_r:cgroup_t,s0)
/sys/fs/cgroup/.* <<none>>
filesystem: label cgroup symlinks /sys/fs/cgroup is a tmpfs which contains cgroup mounts and symlinks such as cpu and cpuacct. Running restorecon makes this warning happen: restorecon: Warning no default label for /sys/fs/cgroup/cpu Declare a file context for every symlink in the cgroup tmpfs montpoint to no longer have such warning.
2014-04-14 21:18:31 +00:00
/sys/fs/cgroup/[^/]+ -l gen_context(system_u:object_r:cgroup_t,s0)
Initial pstore support Generic interface to platform dependent persistent storage https://www.kernel.org/doc/Documentation/ABI/testing/pstore This basically works pretty much the same as cgroup file systems from a SELinux perspective Make sure that the installed /sys/fs/pstore directory is labeled properly so that the pstore file system can be mounted on that I also removed the files_type() calls as they are duplicate (it is already called in files_mountpoint) Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-11 08:53:08 +00:00
/sys/fs/pstore -d gen_context(system_u:object_r:pstore_t,s0)
/sys/fs/pstore/.* <<none>>
Label /var/run/shm as tmpfs_t for Debian In Debian, /dev/shm is a symlink to /var/run/shm. Label that mountpoint the same way.
2013-01-12 21:32:19 +00:00
filesystem: pathcon for matching tracefs mount Prevent restorecon from trying to relabel /sys/fs/tracing . Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-26 16:59:37 +00:00
/sys/kernel/tracing(/.*)? <<none>>
Label /var/run/shm as tmpfs_t for Debian In Debian, /dev/shm is a symlink to /var/run/shm. Label that mountpoint the same way.
2013-01-12 21:32:19 +00:00
ifdef(`distro_debian',`
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
/run/shm/.* <<none>>
Label /var/run/shm as tmpfs_t for Debian In Debian, /dev/shm is a symlink to /var/run/shm. Label that mountpoint the same way.
2013-01-12 21:32:19 +00:00
')