RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

kernel, systemd: Move lines.

This commit is contained in:
Chris PeBenito 2019-01-09 19:30:15 -05:00
parent 9cb572bd02
commit d2a1333fdc
2 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
policy/modules/kernel/kernel.te
View File

@ -39,7 +39,6 @@ role unconfined_r;
ifdef(`enable_mls',` ifdef(`enable_mls',`
role secadm_r; role secadm_r;
role auditadm_r; role auditadm_r;
mls_process_set_level(kernel_t)
') ')
# #
@ -48,7 +47,6 @@ ifdef(`enable_mls',`
# #
type kernel_t, can_load_kernmodule; type kernel_t, can_load_kernmodule;
domain_base_type(kernel_t) domain_base_type(kernel_t)
mls_rangetrans_source(kernel_t)
role system_r types kernel_t; role system_r types kernel_t;
sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh) sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
@ -296,6 +294,9 @@ fs_manage_tmpfs_files(kernel_t)
fs_manage_tmpfs_sockets(kernel_t) fs_manage_tmpfs_sockets(kernel_t)
fs_delete_tmpfs_symlinks(kernel_t) fs_delete_tmpfs_symlinks(kernel_t)
mls_rangetrans_source(kernel_t)
mls_process_set_level(kernel_t)
selinux_getattr_fs(kernel_t) selinux_getattr_fs(kernel_t)
selinux_load_policy(kernel_t) selinux_load_policy(kernel_t)

14
policy/modules/system/systemd.te
View File

@ -251,17 +251,13 @@ systemd_log_parse_environment(systemd_gpt_generator_t)
allow systemd_cgroups_t self:capability net_admin; allow systemd_cgroups_t self:capability net_admin;
ifdef(`enable_mls',` kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
mls_fd_use_all_levels(systemd_cgroups_t)
',`
kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
')
kernel_dgram_send(systemd_cgroups_t) kernel_dgram_send(systemd_cgroups_t)
# for /proc/cmdline # for /proc/cmdline
kernel_read_system_state(systemd_cgroups_t) kernel_read_system_state(systemd_cgroups_t)
mls_fd_use_all_levels(systemd_cgroups_t)
selinux_getattr_fs(systemd_cgroups_t) selinux_getattr_fs(systemd_cgroups_t)
# write to /run/systemd/cgroups-agent # write to /run/systemd/cgroups-agent
@ -274,6 +270,10 @@ seutil_libselinux_linked(systemd_cgroups_t)
systemd_log_parse_environment(systemd_cgroups_t) systemd_log_parse_environment(systemd_cgroups_t)
ifdef(`enable_mls',`
kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
')
###################################### ######################################
# #
# coredump local policy # coredump local policy