container, miscfiles: transition to s0 for public content created by containers
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
parent
d4c5bd96c8
commit
d9314aeb24
@ -315,6 +315,10 @@ tunable_policy(`container_manage_public_content',`
|
||||
miscfiles_manage_public_files(container_domain)
|
||||
miscfiles_watch_public_dirs(container_domain)
|
||||
')
|
||||
optional_policy(`
|
||||
# range_transition is not valid in a tunable
|
||||
miscfiles_rangetrans_all_public_content(container_domain, s0)
|
||||
')
|
||||
|
||||
tunable_policy(`container_read_public_content',`
|
||||
miscfiles_read_public_files(container_domain)
|
||||
|
@ -961,6 +961,33 @@ interface(`miscfiles_mounton_all_public_files',`
|
||||
allow $1 public_content_rw_t:file mounton;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Transition to the specified sensitivity
|
||||
## when creating all public content objects.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`miscfiles_rangetrans_all_public_content',`
|
||||
gen_require(`
|
||||
type public_content_t;
|
||||
type public_content_rw_t;
|
||||
')
|
||||
|
||||
ifdef(`enable_mcs',`
|
||||
range_transition $1 public_content_t:dir_file_class_set $2;
|
||||
range_transition $1 public_content_rw_t:dir_file_class_set $2;
|
||||
')
|
||||
ifdef(`enable_mls',`
|
||||
range_transition $1 public_content_t:dir_file_class_set $2;
|
||||
range_transition $1 public_content_rw_t:dir_file_class_set $2;
|
||||
')
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read TeX data
|
||||
|
Loading…
Reference in New Issue
Block a user