RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make role attributes able to type their "own" types. 

By default, any role attribute should be able to type their "own" types
that share the same prefix and used in the run interface. For example,

role newrole_roles types newrole_t;

so that the calling domain of the seutil_run_newrole() interface could
properly tansition into newrole_t. Without above role rule, the caller's
role won't be associated with newrole_t.

Other role attributes such as useradd_roles, groupadd_roles, chfn_roles
and run_init_roles should be fixed in the same way.
This commit is contained in:
Harry Ciao 2011-12-15 15:17:17 +08:00 committed by Chris PeBenito
parent f3262926ae
commit 93c3ee8b7f
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/admin/usermanage.te
View File

@ -6,9 +6,11 @@ policy_module(usermanage, 1.17.0)
#
attribute_role chfn_roles;
role chfn_roles types chfn_t;
role system_r types chfn_t;
attribute_role groupadd_roles;
role groupadd_roles types groupadd_t;
attribute_role passwd_roles;
roleattribute system_r passwd_roles;
@ -17,6 +19,7 @@ attribute_role sysadm_passwd_roles;
roleattribute system_r sysadm_passwd_roles;
attribute_role useradd_roles;
role useradd_roles types useradd_t;
type admin_passwd_exec_t;
files_type(admin_passwd_exec_t)

2
policy/modules/system/selinuxutil.te
View File

@ -13,8 +13,10 @@ attribute can_write_binary_policy;
attribute can_relabelto_binary_policy;
attribute_role newrole_roles;
role newrole_roles types newrole_t;
attribute_role run_init_roles;
role run_init_roles types run_init_t;
role system_r types run_init_t;
attribute_role semanage_roles;