selinux-refpolicy/policy/modules/roles/secadm.te

77 lines
1.3 KiB
Plaintext

policy_module(secadm, 2.1.1)
########################################
#
# Declarations
#
role secadm_r;
userdom_unpriv_user_template(secadm)
userdom_security_admin_template(secadm_t, secadm_r)
########################################
#
# Local policy
#
allow secadm_t self:capability { dac_read_search dac_override };
corecmd_exec_shell(secadm_t)
dev_relabel_all_dev_nodes(secadm_t)
domain_obj_id_change_exemption(secadm_t)
mls_process_read_up(secadm_t)
mls_file_read_all_levels(secadm_t)
mls_file_write_all_levels(secadm_t)
mls_file_upgrade(secadm_t)
mls_file_downgrade(secadm_t)
auth_role(secadm_r, secadm_t)
auth_relabel_all_files_except_shadow(secadm_t)
auth_relabel_shadow(secadm_t)
init_exec(secadm_t)
logging_read_audit_log(secadm_t)
logging_read_generic_logs(secadm_t)
logging_read_audit_config(secadm_t)
optional_policy(`
aide_run(secadm_t, secadm_r)
')
optional_policy(`
auditadm_role_change(secadm_r)
')
optional_policy(`
dmesg_exec(secadm_t)
')
optional_policy(`
netlabel_run_mgmt(secadm_t, secadm_r)
')
optional_policy(`
screen_role_template(secadm, secadm_r, secadm_t)
')
optional_policy(`
su_role_template(secadm, secadm_r, secadm_t)
')
optional_policy(`
sudo_role_template(secadm, secadm_r, secadm_t)
')
optional_policy(`
sysadm_role_change(secadm_r)
')
optional_policy(`
vlock_run(secadm_t, secadm_r)
')