RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-02-08 23:57:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow user and role changes on dynamic transitions with the same constraints as regular transitions.

Browse Source
This commit is contained in:
Chris PeBenito 2011-09-02 09:59:26 -04:00
parent 74aaedde68
commit 8ee51235f6
2 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Changelog
View File

@ -1,3 +1,5 @@
- Allow user and role changes on dynamic transitions with the same
constraints as regular transitions.
- New git service features from Dominick Grift. - New git service features from Dominick Grift.
- Corenetwork policy size optimization from Dan Walsh. - Corenetwork policy size optimization from Dan Walsh.
- Silence spurious udp_socket listen denials. - Silence spurious udp_socket listen denials.

9
policy/constraints
View File

@ -87,7 +87,7 @@ ifdef(`enable_ubac',`
); );
') ')
constrain process { transition noatsecure siginh rlimitinh } constrain process { transition dyntransition noatsecure siginh rlimitinh }
( (
u1 == u2 u1 == u2
or ( t1 == can_change_process_identity and t2 == process_user_target ) or ( t1 == can_change_process_identity and t2 == process_user_target )
@ -96,7 +96,7 @@ constrain process { transition noatsecure siginh rlimitinh }
or ( t1 == process_uncond_exempt ) or ( t1 == process_uncond_exempt )
); );
constrain process { transition noatsecure siginh rlimitinh } constrain process { transition dyntransition noatsecure siginh rlimitinh }
( (
r1 == r2 r1 == r2
or ( t1 == can_change_process_role and t2 == process_user_target ) or ( t1 == can_change_process_role and t2 == process_user_target )
@ -105,11 +105,6 @@ constrain process { transition noatsecure siginh rlimitinh }
or ( t1 == process_uncond_exempt ) or ( t1 == process_uncond_exempt )
); );
constrain process dyntransition
(
u1 == u2 and r1 == r2
);
# These permissions do not have ubac constraints: # These permissions do not have ubac constraints:
# fork # fork
# setexec # setexec