RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

make transition on shell work

This commit is contained in:
Chris PeBenito 2005-05-23 15:48:45 +00:00
parent c4309768f1
commit 3000a31552
1 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
refpolicy/policy/modules/system/corecommands.if
View File

@ -1,4 +1,9 @@
# Copyright (C) 2005 Tresys Technology, LLC
## <module name="corecommands" layer="system">
## <summary>
## Core policy for shells, and generic programs
## in /bin, /sbin, /usr/bin, and /usr/sbin.
## </summary>
#######################################
#
@ -124,14 +129,27 @@ class file { getattr read execute execute_no_trans };
')
########################################
#
# corecommands_shell_transition(domain)
## <interface name="corecommands_shell_transition">
## <description>
## Execute a shell in the target domain.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <parameter name="target_domain">
## The type of the shell process.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
#
define(`corecommands_shell_transition',`
requires_block_template(`$0'_depend)
allow $1 bin_t:dir { getattr search read };
allow $1 bin_t:lnk_file { getattr read };
allow $1 shell_exec_t:file { getattr read execute };
allow $1 $2:process transition;
type_transition $1 shell_exec_t:file $2;
dontaudit $1 $2:process { noatsecure siginh rlimitinh };
')
define(`corecommands_shell_transition_depend',`
@ -157,3 +175,5 @@ type chroot_exec_t;
class file { getattr read execute execute_no_trans };
class capability sys_chroot;
')
## </module>