nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

container, miscfiles: transition to s0 for public content created by containers

Browse Source 
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2022-10-25 17:20:14 -04:00
parent d4c5bd96c8
commit d9314aeb24
2 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/services/container.te
View File

@ -315,6 +315,10 @@ tunable_policy(`container_manage_public_content',`
miscfiles_manage_public_files(container_domain)
miscfiles_watch_public_dirs(container_domain)
')
optional_policy(`
# range_transition is not valid in a tunable
miscfiles_rangetrans_all_public_content(container_domain, s0)
')
tunable_policy(`container_read_public_content',`
miscfiles_read_public_files(container_domain)

27
policy/modules/system/miscfiles.if
View File

@ -961,6 +961,33 @@ interface(`miscfiles_mounton_all_public_files',`
allow $1 public_content_rw_t:file mounton;
')
########################################
## <summary>
## Transition to the specified sensitivity
## when creating all public content objects.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`miscfiles_rangetrans_all_public_content',`
gen_require(`
type public_content_t;
type public_content_rw_t;
')
ifdef(`enable_mcs',`
range_transition $1 public_content_t:dir_file_class_set $2;
range_transition $1 public_content_rw_t:dir_file_class_set $2;
')
ifdef(`enable_mls',`
range_transition $1 public_content_t:dir_file_class_set $2;
range_transition $1 public_content_rw_t:dir_file_class_set $2;
')
')
########################################
## <summary>
## Read TeX data