selinux-refpolicy/targeted/macros/program/slocate_macros.te

65 lines
1.6 KiB
Plaintext

#
# Macros for locate domains.
#
#
# Author: Russell Coker <russell@coker.com.au>
#
#
# locate_domain(domain_prefix)
#
# Define a derived domain for the locate program when executed
# by a user domain.
#
# The type declaration for the executable type for this program is
# provided separately in domains/program/locate.te.
#
undefine(`locate_domain')
ifdef(`slocate.te', `
define(`locate_domain',`
# Derived domain based on the calling user domain and the program.
type $1_locate_t, domain;
allow $1_locate_t self:process signal;
allow $1_locate_t etc_t:file { getattr read };
allow $1_locate_t self:unix_stream_socket create_socket_perms;
r_dir_file($1_locate_t,locate_var_lib_t)
allow $1_locate_t var_lib_t:dir search;
# Transition from the user domain to this domain.
domain_auto_trans($1_t, locate_exec_t, $1_locate_t)
# The user role is authorized for this domain.
role $1_r types $1_locate_t;
# Inherit and use descriptors from gnome-pty-helper.
ifdef(`gnome-pty-helper.te', `
allow $1_locate_t $1_gph_t:fd use;
')
allow $1_locate_t privfd:fd use;
# allow ps to show locate
can_ps($1_t, $1_locate_t)
allow $1_t $1_locate_t:process signal;
uses_shlib($1_locate_t)
access_terminal($1_locate_t, $1)
allow $1_locate_t { home_root_t $1_home_dir_t $1_file_type }:dir { getattr search };
allow $1_locate_t $1_file_type:{ file lnk_file } { getattr read };
base_file_read_access($1_locate_t)
r_dir_file($1_locate_t, { etc_t lib_t var_t })
dontaudit $1_locate_t { fs_type file_type }:dir r_dir_perms;
dontaudit $1_locate_t { fs_type file_type -shadow_t}:file { getattr read };
')
', `
define(`locate_domain',`')
')