RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

screen, roles: use user exec domain attribute 

Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2021-06-24 15:01:30 -04:00
parent 76a6ee4fb9
commit 150353158a
6 changed files with 39 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
policy/modules/apps/screen.if
View File

@ -10,16 +10,21 @@
## is the prefix for user_r).
## </summary>
## </param>
## <param name="user_role">
## <summary>
## The role associated with the user domain.
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## The type of the user domain.
## </summary>
## </param>
## <param name="user_exec_domain">
## <summary>
## User exec domain for execute and transition access.
## </summary>
## </param>
## <param name="user_role">
## <summary>
## The role associated with the user domain.
## </summary>
## </param>
#
template(`screen_role_template',`
gen_require(`
@ -39,7 +44,7 @@ template(`screen_role_template',`
domain_interactive_fd($1_screen_t)
role screen_roles types $1_screen_t;
roleattribute $2 screen_roles;
roleattribute $4 screen_roles;
########################################
#
@ -56,38 +61,42 @@ template(`screen_role_template',`
dontaudit $3 $1_screen_t:unix_stream_socket { read write };
allow $1_screen_t $3:process signal;
allow $3 screen_tmp_t:dir { manage_dir_perms relabel_dir_perms };
allow $3 screen_tmp_t:file { manage_file_perms relabel_file_perms };
allow $3 screen_tmp_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
allow $2 screen_tmp_t:dir { manage_dir_perms relabel_dir_perms };
allow $2 screen_tmp_t:file { manage_file_perms relabel_file_perms };
allow $2 screen_tmp_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
allow $3 screen_home_t:dir { manage_dir_perms relabel_dir_perms };
allow $3 screen_home_t:file { manage_file_perms relabel_file_perms };
allow $3 screen_home_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
allow $3 screen_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
allow $2 screen_home_t:dir { manage_dir_perms relabel_dir_perms };
allow $2 screen_home_t:file { manage_file_perms relabel_file_perms };
allow $2 screen_home_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
allow $2 screen_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
userdom_user_home_dir_filetrans($3, screen_home_t, dir, ".screen")
userdom_user_home_dir_filetrans($3, screen_home_t, file, ".screenrc")
userdom_user_home_dir_filetrans($3, screen_home_t, file, ".tmux.conf")
userdom_user_home_dir_filetrans($2, screen_home_t, dir, ".screen")
userdom_user_home_dir_filetrans($2, screen_home_t, file, ".screenrc")
userdom_user_home_dir_filetrans($2, screen_home_t, file, ".tmux.conf")
manage_dirs_pattern($3, screen_runtime_t, screen_runtime_t)
manage_files_pattern($3, screen_runtime_t, screen_runtime_t)
manage_lnk_files_pattern($3, screen_runtime_t, screen_runtime_t)
manage_fifo_files_pattern($3, screen_runtime_t, screen_runtime_t)
manage_dirs_pattern($2, screen_runtime_t, screen_runtime_t)
manage_files_pattern($2, screen_runtime_t, screen_runtime_t)
manage_lnk_files_pattern($2, screen_runtime_t, screen_runtime_t)
manage_fifo_files_pattern($2, screen_runtime_t, screen_runtime_t)
corecmd_bin_domtrans($1_screen_t, $3)
corecmd_shell_domtrans($1_screen_t, $3)
corecmd_bin_domtrans($1_screen_t, $2)
corecmd_shell_domtrans($1_screen_t, $2)
auth_domtrans_chk_passwd($1_screen_t)
auth_use_nsswitch($1_screen_t)
userdom_user_home_domtrans($1_screen_t, $3)
userdom_user_home_domtrans($1_screen_t, $2)
tunable_policy(`use_samba_home_dirs',`
fs_cifs_domtrans($1_screen_t, $3)
fs_cifs_domtrans($1_screen_t, $2)
')
tunable_policy(`use_nfs_home_dirs',`
fs_nfs_domtrans($1_screen_t, $3)
fs_nfs_domtrans($1_screen_t, $2)
')
optional_policy(`
systemd_user_app_status($1, $1_screen_t)
')
')

2
policy/modules/roles/auditadm.te
View File

@ -40,7 +40,7 @@ optional_policy(`
')
optional_policy(`
screen_role_template(auditadm, auditadm_r, auditadm_t)
screen_role_template(auditadm, auditadm_t, auditadm_application_exec_domain, auditadm_r)
')
optional_policy(`

2
policy/modules/roles/secadm.te
View File

@ -57,7 +57,7 @@ optional_policy(`
')
optional_policy(`
screen_role_template(secadm, secadm_r, secadm_t)
screen_role_template(secadm, secadm_t, secadm_application_exec_domain, secadm_r)
')
optional_policy(`

2
policy/modules/roles/staff.te
View File

@ -167,7 +167,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
screen_role_template(staff, staff_r, staff_t)
screen_role_template(staff, staff_t, staff_application_exec_domain, staff_r)
')
optional_policy(`

2
policy/modules/roles/sysadm.te
View File

@ -926,7 +926,7 @@ optional_policy(`
')
optional_policy(`
screen_role_template(sysadm, sysadm_r, sysadm_t)
screen_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
')
optional_policy(`

2
policy/modules/roles/unprivuser.te
View File

@ -26,7 +26,7 @@ optional_policy(`
')
optional_policy(`
screen_role_template(user, user_r, user_t)
screen_role_template(user, user_t, user_application_exec_domain, user_r)
')
optional_policy(`