RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/selinuxutil.fc

60 lines
3.1 KiB
Plaintext
Raw Normal View History

move selinux to selinuxutil
2005-06-14 20:12:46 +00:00
# SELinux userland utilities
initial commit
2005-05-10 19:51:00 +00:00
#
# /etc
#
selinuxutil: adjustments * no negative permission matching for newrole_t:process * do not label /usr/lib/selinux as policy_src_t, otherwise semodule can not run /usr/lib/selinux/hll/pp * reorder label for /run/restorecond.pid * fix systemd related denials
2017-01-06 14:10:04 +00:00
/etc/selinux(/.*)? gen_context(system_u:object_r:selinux_config_t,s0)
/etc/selinux/([^/]*/)?contexts(/.*)? gen_context(system_u:object_r:default_context_t,s0)
/etc/selinux/([^/]*/)?contexts/files(/.*)? gen_context(system_u:object_r:file_context_t,s0)
/etc/selinux/([^/]*/)?policy(/.*)? gen_context(system_u:object_r:policy_config_t,mls_systemhigh)
/etc/selinux/([^/]*/)?setrans\.conf -- gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
/etc/selinux/([^/]*/)?seusers -- gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
/etc/selinux/([^/]*/)?modules(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
/etc/selinux/([^/]*/)?modules/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0)
/etc/selinux/([^/]*/)?modules/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0)
/etc/selinux/([^/]*/)?users(/.*)? -- gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
initial commit
2005-05-10 19:51:00 +00:00
#
# /root
#
selinuxutil: adjustments * no negative permission matching for newrole_t:process * do not label /usr/lib/selinux as policy_src_t, otherwise semodule can not run /usr/lib/selinux/hll/pp * reorder label for /run/restorecond.pid * fix systemd related denials
2017-01-06 14:10:04 +00:00
/root/\.default_contexts -- gen_context(system_u:object_r:default_context_t,s0)
#
# /run
#
/run/restorecond\.pid -- gen_context(system_u:object_r:restorecond_run_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
#
# /usr
#
selinuxutil: adjustments * no negative permission matching for newrole_t:process * do not label /usr/lib/selinux as policy_src_t, otherwise semodule can not run /usr/lib/selinux/hll/pp * reorder label for /run/restorecond.pid * fix systemd related denials
2017-01-06 14:10:04 +00:00
/usr/bin/checkpolicy -- gen_context(system_u:object_r:checkpolicy_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/load_policy -- gen_context(system_u:object_r:load_policy_exec_t,s0)
selinuxutil: adjustments * no negative permission matching for newrole_t:process * do not label /usr/lib/selinux as policy_src_t, otherwise semodule can not run /usr/lib/selinux/hll/pp * reorder label for /run/restorecond.pid * fix systemd related denials
2017-01-06 14:10:04 +00:00
/usr/bin/newrole -- gen_context(system_u:object_r:newrole_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/restorecon -- gen_context(system_u:object_r:setfiles_exec_t,s0)
/usr/bin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0)
/usr/bin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0)
/usr/bin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0)
/usr/bin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/bin/semanage -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/bin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
selinuxutil: adjustments * no negative permission matching for newrole_t:process * do not label /usr/lib/selinux as policy_src_t, otherwise semodule can not run /usr/lib/selinux/hll/pp * reorder label for /run/restorecond.pid * fix systemd related denials
2017-01-06 14:10:04 +00:00
/usr/lib/systemd/system/restorecond.*\.service -- gen_context(system_u:object_r:restorecond_unit_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
selinuxutil: adjustments * no negative permission matching for newrole_t:process * do not label /usr/lib/selinux as policy_src_t, otherwise semodule can not run /usr/lib/selinux/hll/pp * reorder label for /run/restorecond.pid * fix systemd related denials
2017-01-06 14:10:04 +00:00
/usr/sbin/load_policy -- gen_context(system_u:object_r:load_policy_exec_t,s0)
/usr/sbin/restorecon -- gen_context(system_u:object_r:setfiles_exec_t,s0)
/usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0)
/usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0)
/usr/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0)
/usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/sbin/semanage -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/libexec/selinux/semanage_migrate_store -- gen_context(system_u:object_r:semanage_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Support semanage permissive mode The semanage application supports a "semanage permissive" feature, allowing certain domains to be marked for running permissive (rather than the entire system). To support this feature, we introduce a semanage_var_lib_t type for the location where semanage will keep its permissive_<domain>.* files, and allow semanage_t to work with fifo_files (needed for the command to work). Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-09-09 19:36:59 +00:00
#
# /var/lib
#
selinuxutil: adjustments * no negative permission matching for newrole_t:process * do not label /usr/lib/selinux as policy_src_t, otherwise semodule can not run /usr/lib/selinux/hll/pp * reorder label for /run/restorecond.pid * fix systemd related denials
2017-01-06 14:10:04 +00:00
/var/lib/selinux(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
/var/lib/selinux/[^/]+/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0)
/var/lib/selinux/[^/]+/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0)
/usr/lib/selinux/semanage_migrate_store -- gen_context(system_u:object_r:semanage_exec_t,s0)