kernel, systemd: Move lines.
This commit is contained in:
parent
9cb572bd02
commit
d2a1333fdc
|
@ -39,7 +39,6 @@ role unconfined_r;
|
||||||
ifdef(`enable_mls',`
|
ifdef(`enable_mls',`
|
||||||
role secadm_r;
|
role secadm_r;
|
||||||
role auditadm_r;
|
role auditadm_r;
|
||||||
mls_process_set_level(kernel_t)
|
|
||||||
')
|
')
|
||||||
|
|
||||||
#
|
#
|
||||||
|
@ -48,7 +47,6 @@ ifdef(`enable_mls',`
|
||||||
#
|
#
|
||||||
type kernel_t, can_load_kernmodule;
|
type kernel_t, can_load_kernmodule;
|
||||||
domain_base_type(kernel_t)
|
domain_base_type(kernel_t)
|
||||||
mls_rangetrans_source(kernel_t)
|
|
||||||
role system_r types kernel_t;
|
role system_r types kernel_t;
|
||||||
sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
|
sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
|
||||||
|
|
||||||
|
@ -296,6 +294,9 @@ fs_manage_tmpfs_files(kernel_t)
|
||||||
fs_manage_tmpfs_sockets(kernel_t)
|
fs_manage_tmpfs_sockets(kernel_t)
|
||||||
fs_delete_tmpfs_symlinks(kernel_t)
|
fs_delete_tmpfs_symlinks(kernel_t)
|
||||||
|
|
||||||
|
mls_rangetrans_source(kernel_t)
|
||||||
|
mls_process_set_level(kernel_t)
|
||||||
|
|
||||||
selinux_getattr_fs(kernel_t)
|
selinux_getattr_fs(kernel_t)
|
||||||
selinux_load_policy(kernel_t)
|
selinux_load_policy(kernel_t)
|
||||||
|
|
||||||
|
|
|
@ -251,17 +251,13 @@ systemd_log_parse_environment(systemd_gpt_generator_t)
|
||||||
|
|
||||||
allow systemd_cgroups_t self:capability net_admin;
|
allow systemd_cgroups_t self:capability net_admin;
|
||||||
|
|
||||||
ifdef(`enable_mls',`
|
|
||||||
kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
|
|
||||||
mls_fd_use_all_levels(systemd_cgroups_t)
|
|
||||||
',`
|
|
||||||
kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
|
kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
|
||||||
')
|
|
||||||
|
|
||||||
kernel_dgram_send(systemd_cgroups_t)
|
kernel_dgram_send(systemd_cgroups_t)
|
||||||
# for /proc/cmdline
|
# for /proc/cmdline
|
||||||
kernel_read_system_state(systemd_cgroups_t)
|
kernel_read_system_state(systemd_cgroups_t)
|
||||||
|
|
||||||
|
mls_fd_use_all_levels(systemd_cgroups_t)
|
||||||
|
|
||||||
selinux_getattr_fs(systemd_cgroups_t)
|
selinux_getattr_fs(systemd_cgroups_t)
|
||||||
|
|
||||||
# write to /run/systemd/cgroups-agent
|
# write to /run/systemd/cgroups-agent
|
||||||
|
@ -274,6 +270,10 @@ seutil_libselinux_linked(systemd_cgroups_t)
|
||||||
|
|
||||||
systemd_log_parse_environment(systemd_cgroups_t)
|
systemd_log_parse_environment(systemd_cgroups_t)
|
||||||
|
|
||||||
|
ifdef(`enable_mls',`
|
||||||
|
kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
|
||||||
|
')
|
||||||
|
|
||||||
######################################
|
######################################
|
||||||
#
|
#
|
||||||
# coredump local policy
|
# coredump local policy
|
||||||
|
|
Loading…
Reference in New Issue