telepathy, roles: use user exec domain attribute
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
parent
da2ef960bb
commit
04725f303b
|
@ -41,18 +41,23 @@ template(`telepathy_domain_template',`
|
||||||
## </desc>
|
## </desc>
|
||||||
## <param name="role_prefix">
|
## <param name="role_prefix">
|
||||||
## <summary>
|
## <summary>
|
||||||
## The prefix of the user domain (e.g., user
|
## The prefix of the user role (e.g., user
|
||||||
## is the prefix for user_t).
|
## is the prefix for user_r).
|
||||||
## </summary>
|
|
||||||
## </param>
|
|
||||||
## <param name="user_role">
|
|
||||||
## <summary>
|
|
||||||
## The role associated with the user domain.
|
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
## <param name="user_domain">
|
## <param name="user_domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
## The type of the user domain.
|
## User domain for the role.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="user_exec_domain">
|
||||||
|
## <summary>
|
||||||
|
## User exec domain for execute and transition access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="role">
|
||||||
|
## <summary>
|
||||||
|
## Role allowed access
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
|
@ -74,7 +79,7 @@ template(`telepathy_role_template',`
|
||||||
type telepathy_mission_control_home_t;
|
type telepathy_mission_control_home_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
role $2 types telepathy_domain;
|
role $4 types telepathy_domain;
|
||||||
|
|
||||||
allow $3 telepathy_domain:process { ptrace signal_perms };
|
allow $3 telepathy_domain:process { ptrace signal_perms };
|
||||||
ps_process_pattern($3, telepathy_domain)
|
ps_process_pattern($3, telepathy_domain)
|
||||||
|
@ -93,34 +98,38 @@ template(`telepathy_role_template',`
|
||||||
dbus_spec_session_domain($1, telepathy_stream_engine_t, telepathy_stream_engine_exec_t)
|
dbus_spec_session_domain($1, telepathy_stream_engine_t, telepathy_stream_engine_exec_t)
|
||||||
dbus_spec_session_domain($1, telepathy_msn_t, telepathy_msn_exec_t)
|
dbus_spec_session_domain($1, telepathy_msn_t, telepathy_msn_exec_t)
|
||||||
|
|
||||||
allow $3 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:dir { manage_dir_perms relabel_dir_perms };
|
allow $2 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:dir { manage_dir_perms relabel_dir_perms };
|
||||||
allow $3 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms };
|
allow $2 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms };
|
||||||
allow $3 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms };
|
allow $2 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms };
|
||||||
|
|
||||||
allow $3 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:file { manage_file_perms relabel_file_perms };
|
allow $2 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:file { manage_file_perms relabel_file_perms };
|
||||||
allow $3 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:file { manage_file_perms relabel_file_perms };
|
allow $2 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:file { manage_file_perms relabel_file_perms };
|
||||||
allow $3 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:file { manage_file_perms relabel_file_perms };
|
allow $2 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:file { manage_file_perms relabel_file_perms };
|
||||||
|
|
||||||
filetrans_pattern($3, telepathy_xdg_cache_t, telepathy_gabble_xdg_cache_t, dir, "gabble")
|
filetrans_pattern($2, telepathy_xdg_cache_t, telepathy_gabble_xdg_cache_t, dir, "gabble")
|
||||||
# gnome_cache_filetrans($3, telepathy_gabble_cache_home_t, dir, "wocky")
|
# gnome_cache_filetrans($2, telepathy_gabble_cache_home_t, dir, "wocky")
|
||||||
|
|
||||||
filetrans_pattern($3, telepathy_xdg_cache_t, telepathy_logger_xdg_cache_t, dir, "logger")
|
filetrans_pattern($2, telepathy_xdg_cache_t, telepathy_logger_xdg_cache_t, dir, "logger")
|
||||||
# gnome_data_filetrans($3, telepathy_logger_data_home_t, dir, "TpLogger")
|
# gnome_data_filetrans($2, telepathy_logger_data_home_t, dir, "TpLogger")
|
||||||
|
|
||||||
userdom_user_home_dir_filetrans($3, telepathy_mission_control_home_t, dir, ".mission-control")
|
userdom_user_home_dir_filetrans($2, telepathy_mission_control_home_t, dir, ".mission-control")
|
||||||
filetrans_pattern($3, telepathy_xdg_data_t, telepathy_mission_control_xdg_data_t, dir, "mission-control")
|
filetrans_pattern($2, telepathy_xdg_data_t, telepathy_mission_control_xdg_data_t, dir, "mission-control")
|
||||||
# gnome_cache_filetrans($3, telepathy_mission_control_cache_home_t, file, ".mc_connections")
|
# gnome_cache_filetrans($2, telepathy_mission_control_cache_home_t, file, ".mc_connections")
|
||||||
|
|
||||||
userdom_user_home_dir_filetrans($3, telepathy_sunshine_home_t, dir, ".telepathy-sunshine")
|
userdom_user_home_dir_filetrans($2, telepathy_sunshine_home_t, dir, ".telepathy-sunshine")
|
||||||
|
|
||||||
# gnome_cache_filetrans($3, telepathy_cache_home_t, dir, "telepathy")
|
# gnome_cache_filetrans($2, telepathy_cache_home_t, dir, "telepathy")
|
||||||
# gnome_data_filetrans($3, telepathy_data_home_t, dir, "telepathy")
|
# gnome_data_filetrans($2, telepathy_data_home_t, dir, "telepathy")
|
||||||
|
|
||||||
allow $3 telepathy_tmp_content:dir { manage_dir_perms relabel_dir_perms };
|
allow $2 telepathy_tmp_content:dir { manage_dir_perms relabel_dir_perms };
|
||||||
allow $3 telepathy_tmp_content:file { manage_file_perms relabel_file_perms };
|
allow $2 telepathy_tmp_content:file { manage_file_perms relabel_file_perms };
|
||||||
allow $3 telepathy_tmp_content:sock_file { manage_sock_file_perms relabel_sock_file_perms };
|
allow $2 telepathy_tmp_content:sock_file { manage_sock_file_perms relabel_sock_file_perms };
|
||||||
|
|
||||||
telepathy_mission_control_dbus_chat($3)
|
telepathy_mission_control_dbus_chat($3)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
systemd_user_app_status($1, telepathy_domain)
|
||||||
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
|
|
@ -179,7 +179,7 @@ ifndef(`distro_redhat',`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
telepathy_role_template(staff, staff_r, staff_t)
|
telepathy_role_template(staff, staff_t, staff_application_exec_domain, staff_r)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
|
|
|
@ -163,7 +163,7 @@ ifndef(`distro_redhat',`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
telepathy_role_template(user, user_r, user_t)
|
telepathy_role_template(user, user_t, user_application_exec_domain, user_r)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
|
|
Loading…
Reference in New Issue