mirror of
https://github.com/SELinuxProject/refpolicy
synced 2025-03-25 04:26:37 +00:00
9127219358
There is more than 5000 parameter documentations. Only about 300 are
differently done. Change them to be consistently indented.
param with one space
and content inside with one tab
This was done with:
sed -ri '
/^##[[:space:]]*<param/,/^##[[:space:]]*<[/]param>/{
s/^##[[:space:]]*/##\t/;
s/^##[[:space:]]*(<[/]?summary)/##\t\1/;
s/^##[[:space:]]*(<[/]?param)/## \1/;
}' policy/modules/*/*.if
Signed-off-by: Markus Linnala <Markus.Linnala@cybercom.com>
112 lines
3.0 KiB
Plaintext
112 lines
3.0 KiB
Plaintext
## <summary>GNU terminal multiplexer.</summary>
|
|
|
|
#######################################
|
|
## <summary>
|
|
## The role template for the screen module.
|
|
## </summary>
|
|
## <param name="role_prefix">
|
|
## <summary>
|
|
## The prefix of the user role (e.g., user
|
|
## is the prefix for user_r).
|
|
## </summary>
|
|
## </param>
|
|
## <param name="user_role">
|
|
## <summary>
|
|
## The role associated with the user domain.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="user_domain">
|
|
## <summary>
|
|
## The type of the user domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
template(`screen_role_template',`
|
|
gen_require(`
|
|
attribute screen_domain;
|
|
attribute_role screen_roles;
|
|
type screen_exec_t, screen_tmp_t;
|
|
type screen_home_t, screen_runtime_t;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type $1_screen_t, screen_domain;
|
|
userdom_user_application_domain($1_screen_t, screen_exec_t)
|
|
domain_interactive_fd($1_screen_t)
|
|
role screen_roles types $1_screen_t;
|
|
|
|
roleattribute $2 screen_roles;
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
dontaudit $1_screen_t self:capability sys_tty_config;
|
|
|
|
domtrans_pattern($3, screen_exec_t, $1_screen_t)
|
|
|
|
ps_process_pattern($3, $1_screen_t)
|
|
allow $3 $1_screen_t:process { ptrace signal_perms };
|
|
|
|
dontaudit $3 $1_screen_t:unix_stream_socket { read write };
|
|
allow $1_screen_t $3:process signal;
|
|
|
|
allow $3 screen_tmp_t:dir { manage_dir_perms relabel_dir_perms };
|
|
allow $3 screen_tmp_t:file { manage_file_perms relabel_file_perms };
|
|
allow $3 screen_tmp_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
|
|
|
|
allow $3 screen_home_t:dir { manage_dir_perms relabel_dir_perms };
|
|
allow $3 screen_home_t:file { manage_file_perms relabel_file_perms };
|
|
allow $3 screen_home_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
|
|
allow $3 screen_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
|
|
|
|
userdom_user_home_dir_filetrans($3, screen_home_t, dir, ".screen")
|
|
userdom_user_home_dir_filetrans($3, screen_home_t, file, ".screenrc")
|
|
userdom_user_home_dir_filetrans($3, screen_home_t, file, ".tmux.conf")
|
|
|
|
manage_dirs_pattern($3, screen_runtime_t, screen_runtime_t)
|
|
manage_files_pattern($3, screen_runtime_t, screen_runtime_t)
|
|
manage_lnk_files_pattern($3, screen_runtime_t, screen_runtime_t)
|
|
manage_fifo_files_pattern($3, screen_runtime_t, screen_runtime_t)
|
|
|
|
corecmd_bin_domtrans($1_screen_t, $3)
|
|
corecmd_shell_domtrans($1_screen_t, $3)
|
|
|
|
auth_domtrans_chk_passwd($1_screen_t)
|
|
auth_use_nsswitch($1_screen_t)
|
|
|
|
userdom_user_home_domtrans($1_screen_t, $3)
|
|
|
|
tunable_policy(`use_samba_home_dirs',`
|
|
fs_cifs_domtrans($1_screen_t, $3)
|
|
')
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
fs_nfs_domtrans($1_screen_t, $3)
|
|
')
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute the screen runtime sock file.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
interface(`screen_execute_sock_file',`
|
|
gen_require(`
|
|
type screen_tmp_t;
|
|
type screen_runtime_t;
|
|
')
|
|
|
|
allow $1 screen_runtime_t:sock_file execute;
|
|
allow $1 screen_tmp_t:dir search;
|
|
')
|