nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6,227 Commits 1 Branch 0 Tags 16 MiB
7d53784332
Commit Graph

4233 Commits

Author SHA1 Message Date
Kenton Groombridge
10bfc890d2 mcs: combine single-level object creation constraints 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:55:18 -05:00
Kenton Groombridge
d355d046d2 mcs: constrain misc IPC objects 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:55:12 -05:00
Kenton Groombridge
814d4d3f38 mcs: add additional constraints to databases 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:55:09 -05:00
Chris PeBenito
2d371fcee2 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-11-09 11:13:37 -05:00
Chris PeBenito
9369323629 Merge pull request #429 from 0xC0ncord/various-20211106 2021-11-09 11:13:21 -05:00
Kenton Groombridge
b24d350780 spamassassin: fix file contexts for rspamd symlinks 
rspamd installs symlinks to /usr/bin that point to the real rspam*
binaries. Make these files bin_t so that other programs can read them
without any additional access needed.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
282c291cb2 policykit, systemd: allow policykit to watch systemd logins and sessions 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
2e6cc2d281 netutils: fix ping 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
ae0a8b7fba bind: fixes for unbound 
Unbound maintains a copy of the root key in /etc/unbound/cache and needs
to be able to manage it.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
60d3cf03ed asterisk: allow reading generic certs 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
82767eaade sysadm, systemd: fixes for systemd-networkd 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
397d4a379f ssh: fix for polyinstantiation 
If using polyinstantiation, sshd needs to be able to create a new tmp
directory for remote users.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
19d787597f usbguard, sysadm: misc fixes 
Fixes for usbguard and allow sysadm to connect to usbguard to manage
devices at runtime.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
2d33258db7 certbot, various: allow various services to read certbot certs 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:44 -05:00
Chris PeBenito
85a3e84a92 Merge pull request #431 from 0xC0ncord/git-type 2021-11-09 11:01:59 -05:00
Chris PeBenito
8500c2da93 Merge pull request #430 from jpds/virt-common-fix 2021-11-09 11:01:42 -05:00
Chris PeBenito
5c942164e4 Merge pull request #426 from yizhao1/passwd 2021-11-09 11:01:20 -05:00
Chris PeBenito
8269a22128 Merge pull request #425 from yizhao1/bind 2021-11-09 11:01:04 -05:00
Chris PeBenito
17b8159a95 Merge pull request #424 from yizhao1/rngd 2021-11-09 11:00:55 -05:00
Chris PeBenito
494e35fcc3 Merge pull request #423 from cgzones/ramfs 2021-11-09 11:00:49 -05:00
Chris PeBenito
1570c0a58d Merge pull request #419 from 0xC0ncord/noxattrfs-split 2021-11-09 11:00:37 -05:00
Kenton Groombridge
fbadd1ae4f mta, spamassassin: fixes for rspamd 
rspamc needs to be able to read the mail spool when learning spam and
ham.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 10:59:41 -05:00
Kenton Groombridge
a531f60b2a dovecot, spamassassin: allow dovecot to execute spamc 
Allow dovecot to execute spamc in order to learn spam and ham when a
user manipulates spam mails in their mailbox.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 10:59:37 -05:00
Kenton Groombridge
bfc4fb4955 git: fix typo in git hook exec access 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-08 11:59:03 -05:00
Jonathan Davies
d4080ab8bd virt.te: Fixed typo in virtlogd_t virt_common_runtime_t 
manage_files_pattern.

Signed-off-by: Jonathan Davies <jpds@protonmail.com>
 2021-11-08 15:59:36 +00:00
Kenton Groombridge
46346a1e5d devices: make usbfs pseudofs instead of noxattrfs 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-02 23:11:08 -04:00
Kenton Groombridge
fe122d7ff8 fs: add pseudofs attribute and interfaces 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-02 23:11:05 -04:00
Yi Zhao
d173de67de passwd: allow passwd to map SELinux status page 
We encountered a passwd runtime error with selinux 3.3:
$ passwd user1
passwd: avc.c:73: avc_context_to_sid_raw: Assertion `avc_running'
failed.
Aborted

Fixes:
avc: denied { map } for pid=325 comm="passwd"
path="/sys/fs/selinux/status" dev="selinuxfs" ino=19 scontext=root:
sysadm_r:passwd_t tcontext=system_u:object_r:security_t tclass=file
permissive=1

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-31 23:44:56 +08:00
Yi Zhao
31c276c7b4 bind: fixes for bind 
* add fcontext for /etc/rc.d/init.d/bind and /etc/bind/rndc.conf
* add getsched for named process

Fixes:
avc: denied { getsched } for pid=418 comm="named"
scontext=system_u:system_r:named_t tcontext=system_u:system_r:named_t
tclass=process permissive=0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-31 00:17:55 +08:00
Yi Zhao
5a24f59407 dbus: allow dbus-daemon to map SELinux status page 
Fixes:
avc: denied { map } for pid=328 comm="dbus-daemon"
path="/sys/fs/selinux/status" dev="selinuxfs" ino=19
scontext=system_u:system_r:system_dbusd_t
tcontext=system_u:object_r:security_t tclass=file permissive=0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-30 16:28:40 +08:00
Yi Zhao
39858a7528 rngd: fixes for rngd 
* allow rngd_t to read certificates
* allow rngd_t to getsched/setsched

Fixes:
avc: denied { search } for pid=332 comm="rngd" name="ssl" dev="vda"
ino=588 scontext=system_u:system_r:rngd_t
tcontext=system_u:object_r:cert_t tclass=dir permissive=1

avc: denied { read } for pid=332 comm="rngd" name="openssl.cnf"
dev="vda" ino=849 scontext=system_u:system_r:rngd_t
tcontext=system_u:object_r:cert_t tclass=file permissive=1

avc: denied { open } for pid=332 comm="rngd" path="/etc/ssl/openssl.cnf"
dev="vda" ino=849 scontext=system_u:system_r:rngd_t
tcontext=system_u:object_r:cert_t tclass=file permissive=1

avc: denied { getattr } for  pid=332 comm="rngd"
path="/etc/ssl/openssl.cnf" dev="vda" ino=849
scontext=system_u:system_r:rngd_t tcontext=system_u:object_r:cert_t
tclass=file permissive=1

avc: denied { getsched } for pid=370 comm="rngd"
scontext=system_u:system_r:rngd_t tcontext=system_u:system_r:rngd_t
tclass=process permissive=1

avc: denied { setsched } for pid=370 comm="rngd"
scontext=system_u:system_r:rngd_t tcontext=system_u:system_r:rngd_t
tclass=process permissive=1

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-30 14:19:58 +08:00
Kenton Groombridge
39a19daa3c mcs: restrict create, relabelto on mcs files 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-29 16:53:26 -04:00
Kenton Groombridge
8d83b25353 mcs: deprecate mcs overrides 
Deprecate mcs overrides in favor of using mcs_constrained_type.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-29 16:53:25 -04:00
Christian Göttsche
1e480c3cd6 filesystem: add fs_use_trans for ramfs 
Enable extended attributes for inodes on ramfs filesystems, similar to
tmpfs filesystems.

For example systemd uses ramfs for service credentials[1], and xattr
support is needed for per service based labeling[2].

[1]: https://www.freedesktop.org/software/systemd/man/systemd-creds.html
[2]: https://github.com/systemd/systemd/pull/21158

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2021-10-29 17:44:30 +02:00
Chris PeBenito
7be64d4bfa rpcbind: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-10-29 00:46:05 -04:00
Chris PeBenito
e906ec137f Merge pull request #413 from yizhao1/fix 2021-10-29 00:45:09 -04:00
Chris PeBenito
1e1deaebf2 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-10-27 09:15:09 -04:00
Chris PeBenito
8374a05cb5 Merge pull request #416 from yizhao1/fixes 2021-10-27 09:14:45 -04:00
Yi Zhao
1afa56d20b selinuxutil: allow setfiles_t to read kernel sysctl 
Fixes:
avc: denied { read } for pid=171 comm="restorecon" name="cap_last_cap"
dev="proc" ino=1241
scontext=system_u:system_r:setfiles_t:s0-s15:c0.c1023
tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=0

avc: denied { open } for pid=171 comm="restorecon"
path="/proc/sys/kernel/cap_last_cap" dev="proc" ino=1241
scontext=system_u:system_r:setfiles_t:s0-s15:c0.c1023
tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=0

avc: denied { getattr } for pid=171 comm="restorecon" name="/"
dev="proc" ino=1 scontext=system_u:system_r:setfiles_t:s0-s15:c0.c1023
tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-27 11:20:11 +08:00
Yi Zhao
7a509f0dbf usermanage: do not audit attempts to getattr of proc for passwd_t and useradd_t 
Fixes:
avc: denied { getattr } for pid=325 comm="passwd" name="/" dev="proc"
ino=1 scontext=root:sysadm_r:passwd_t tcontext=system_u:object_r:proc_t
tclass=filesystem permissive=0

avc: denied { getattr } for pid=491 comm="useradd" name="/" dev="proc"
ino=1 scontext=root:sysadm_r:useradd_t tcontext=system_u:object_r:proc_t
tclass=filesystem permissive=0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-27 11:20:11 +08:00
Yi Zhao
db42fb615e rpc: allow rpc.mountd to list/watch NFS server directory 
Fixes:
avc: denied { read } for pid=484 comm="rpc.mountd" name="clients"
dev="nfsd" ino=22 scontext=system_u:system_r:nfsd_t
tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=0

avc: denied { watch } for pid=487 comm="rpc.mountd"
path="/proc/fs/nfsd/clients" dev="nfsd" ino=22
scontext=system_u:system_r:nfsd_t tcontext=system_u:object_r:nfsd_fs_t
tclass=dir permissive=0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-27 11:20:11 +08:00
Yi Zhao
7ae40510fd udev: allow udev_t to watch udev_rules_t dir 
Fixes:
avc: denied { watch } for pid=187 comm="udevd" path="/lib/udev/rules.d"
dev="vda" ino=1060 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:lib_t tclass=dir permissive=0

avc: denied { watch } for pid=187 comm="udevd" path="/etc/udev/rules.d"
dev="vda" ino=886 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:udev_rules_t tclass=dir permissive=0

avc: denied { watch } for pid=187 comm="udevd" path="/run/udev/rules.d"
dev="tmpfs" ino=4 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:udev_runtime_t tclass=dir permissive=0

avc: denied { watch } for pid=196 comm="udevadm" path="/run/udev"
dev="tmpfs" ino=2 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:udev_runtime_t tclass=dir permissive=0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-27 11:20:11 +08:00
Yi Zhao
44cd27ad32 avahi: allow avahi_t to watch /etc/avahi directory 
Fixes:
avc: denied { watch } for pid=420 comm="avahi-daemon" path="/services"
dev="vda" ino=173 scontext=system_u:system_r:avahi_t
tcontext=system_u:object_r:etc_t tclass=dir permissive=1

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-27 11:20:11 +08:00
Yi Zhao
017a321811 bluetooth: fixes for bluetoothd 
* Allow bluetooth_t to create and use bluetooth_socket.
* Allow bluetooth_t to send messages to init scripts over dbus.
* Allow bluetooth_t to send messages from systemd hostnamed over dbus.

Fixes:
avc: denied { create } for pid=377 comm="bluetoothd"
scontext=system_u:system_r:bluetooth_t
tcontext=system_u:system_r:bluetooth_t tclass=bluetooth_socket
permissive=1

avc: denied { bind } for pid=377 comm="bluetoothd"
scontext=system_u:system_r:bluetooth_t
tcontext=system_u:system_r:bluetooth_t tclass=bluetooth_socket
permissive=1

avc: denied { write } for pid=377 comm="bluetoothd"
scontext=system_u:system_r:bluetooth_t
tcontext=system_u:system_r:bluetooth_t tclass=bluetooth_socket
permissive=1

avc: denied { getattr } for pid=377 comm="bluetoothd"
path="socket:[12424]" dev="sockfs" ino=12424
scontext=system_u:system_r:bluetooth_t
tcontext=system_u:system_r:bluetooth_t tclass=bluetooth_socket
permissive=1

avc: denied { listen } for pid=377 comm="bluetoothd"
scontext=system_u:system_r:bluetooth_t
tcontext=system_u:system_r:bluetooth_t tclass=bluetooth_socket
permissive=1

avc: denied { read } for pid=377 comm="bluetoothd" path="socket:[12424]"
dev="sockfs" ino=12424 scontext=system_u:system_r:bluetooth_t
tcontext=system_u:system_r:bluetooth_t tclass=bluetooth_socket
permissive=1

avc: denied { send_msg } for msgtype=method_return dest=:1.2 spid=377
tpid=431 scontext=system_u:system_r:bluetooth_t
tcontext=system_u:system_r:initrc_t tclass=dbus permissive=1

avc: denied { send_msg } for msgtype=signal
interface=org.freedesktop.DBus.ObjectManager member=InterfacesAdded
dest=org.freedesktop.DBus spid=319 tpid=241
scontext=system_u:system_r:bluetooth_t
tcontext=system_u:system_r:initrc_t tclass=dbus permissive=1

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-27 11:20:11 +08:00
Chris PeBenito
86812d22b3 Merge pull request #422 from dsugar100/sshd_fips_check 2021-10-26 15:44:09 -04:00
Chris PeBenito
81738db161 Merge pull request #420 from yizhao1/samba-fixes 2021-10-26 15:44:00 -04:00
Dave Sugar
ecc0cff7c0 sshd: allow to run /usr/bin/fipscheck (to check fips state) 
type=AVC msg=audit(1634644085.903:245): avc:  denied  { search } for pid=1825 comm="sshd" name="crypto" dev="proc" ino=1386 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1634644085.903:245): avc:  denied  { read } for pid=1825 comm="sshd" name="fips_enabled" dev="proc" ino=1387 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1
type=AVC msg=audit(1634644085.903:245): avc:  denied  { open } for pid=1825 comm="sshd" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=1387 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1
type=SYSCALL msg=audit(1634644085.903:245): arch=c000003e syscall=2 success=yes exit=3 a0=7f905129f682 a1=0 a2=1 a3=7ffdda768660 items=0 ppid=1 pid=1825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1634644085.905:247): avc:  denied  { getattr } for pid=1825 comm="sshd" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=1387 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1
type=SYSCALL msg=audit(1634644085.905:247): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffdda768fc0 a2=7ffdda768fc0 a3=0 items=0 ppid=1 pid=1825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1634644085.944:258): avc:  denied  { execute } for pid=1913 comm="sshd" name="fipscheck" dev="dm-2" ino=283611 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1
type=AVC msg=audit(1634644085.944:258): avc:  denied  { read open } for pid=1913 comm="sshd" path="/usr/bin/fipscheck" dev="dm-2" ino=283611 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1
type=AVC msg=audit(1634644085.944:258): avc:  denied  { execute_no_trans } for  pid=1913 comm="sshd" path="/usr/bin/fipscheck" dev="dm-2" ino=283611 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1
type=AVC msg=audit(1634644085.944:258): avc:  denied  { map } for pid=1913 comm="fipscheck" path="/usr/bin/fipscheck" dev="dm-2" ino=283611 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1
type=SYSCALL msg=audit(1634644085.944:258): arch=c000003e syscall=59 success=yes exit=0 a0=7f9051ff76ba a1=55ce27ee83c0 a2=7f90521f8118 a3=7ffdda766ca0 items=0 ppid=1825 pid=1913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fipscheck" exe="/usr/bin/fipscheck" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)

Signed-off-by: Dave Sugar <dsugar100@gmail.com>
 2021-10-19 17:06:48 -04:00
Yi Zhao
a7700d9bb7 rpc: add dac_read_search capability for rpcd_t 
Fixes:
avc: denied { dac_read_search } for pid=473 comm="sm-notify"
capability=2  scontext=system_u:system_r:rpcd_t
tcontext=system_u:system_r:rpcd_t tclass=capability permissive=1

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-19 11:04:45 +08:00
Yi Zhao
6a3bba766f samba: allow smbd_t to send and receive messages from avahi over dbus 
Fixes:
avc: denied { send_msg } for msgtype=method_call
interface=org.freedesktop.Avahi.Server member=GetAPIVersion
dest=org.freedesktop.Avahi spid=481 tpid=508
scontext=system_u:system_r:smbd_t tcontext=system_u:system_r:avahi_t
tclass=dbus permissive=1

avc: denied { send_msg } for msgtype=signal
interface=org.freedesktop.Avahi.Server member=StateChanged
dest=org.freedesktop.DBus spid=508 tpid=481
scontext=system_u:system_r:avahi_t tcontext=system_u:system_r:smbd_t
tclass=dbus permissive=1

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-10-19 11:04:38 +08:00
Dave Sugar
b9231040bb Allow iscsid to check fips_enabled 
type=AVC msg=audit(1634568931.358:227): avc:  denied  { search } for pid=1832 comm="iscsid" name="crypto" dev="proc" ino=9307 scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1634568931.358:227): avc:  denied  { read } for pid=1832 comm="iscsid" name="fips_enabled" dev="proc" ino=9308 scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1
type=AVC msg=audit(1634568931.358:227): avc:  denied  { open } for pid=1832 comm="iscsid" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=9308 scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1
type=AVC msg=audit(1634568931.358:228): avc:  denied  { getattr } for pid=1832 comm="iscsid" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=9308 scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1

Signed-off-by: Dave Sugar <dsugar100@gmail.com>
 2021-10-18 15:58:26 -04:00
Dave Sugar
abf8202e47 Allow iscsid to request kernel module load 
type=AVC msg=audit(1634568931.426:263): avc:  denied  { module_request } for  pid=1832 comm="iscsid" kmod="net-pf-16-proto-8" scontext=system_u:system_r:iscsid_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=1

Signed-off-by: Dave Sugar <dsugar100@gmail.com>
 2021-10-18 15:58:18 -04:00
Kenton Groombridge
c7e4c1da8c mpd, pulseaudio: split domtrans and client access 
Split `pulseaudio_domtrans()` into two interfaces: one that grants
transition access and the other the `pulseaudio_client` attribute. This
fixes a build error because calls to `pulseaudio_domtrans()` by the role
would associate the client attribute with the user exec domain
attribute.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:08:42 -04:00
Kenton Groombridge
d260220709 shutdown: add tunable to control user exec domain access 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:08:42 -04:00
Kenton Groombridge
580248ee48 su: add tunable to control user exec domain access 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:08:42 -04:00
Kenton Groombridge
94f6d5d9c5 sudo: add tunable to control user exec domain access 
The tunable 'sudo_allow_user_exec_domains' only allows user domains
themselves to use sudo if disabled (default), otherwise any domain with
the corresponding user exec domain attribute may use sudo.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:08:42 -04:00
Kenton Groombridge
5a7837efd9 mono: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:08:42 -04:00
Kenton Groombridge
d675ea2aa0 wine: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:08:42 -04:00
Kenton Groombridge
b591857dcd cryfs, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
efd8b75386 shutdown, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
22f5be2547 hadoop, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
77ed833ba2 wm, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
7ba794a6a7 wireshark, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
92330a3119 vmware, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
6d9dd8d5dc userhelper, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
32acf9ccac uml, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
787cb62e75 tvtime, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
2efb746c67 thunderbird, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
04725f303b telepathy, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
da2ef960bb su, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
8ef3a91347 spamassassin, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
0ac3f4ea2c rssh, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
34c7853f00 razor, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
1339b7db0c pyzor, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
0a78bb05eb pulseaudio, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
9554af912d openoffice, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
b3b8942040 mta, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
ffdbf9c86e mplayer, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
f5f0af2c24 mozilla, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
34f7b026ea lpd, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
8bdab0397c libmtp, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
0f650e0dc5 java, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
b7980a45fc irc, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
56a50fb56c gpg, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
7cd14e0c49 gnome, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
d5246d98aa games, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
ab30d35882 evolution, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
8875024efc dirmngr, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
95cf374eee cron, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
4d7eb76fb9 chromium, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
99c2c94507 cdrecord, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
afa5769b4c bluetooth, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
386d00de34 authlogin, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
b90d40db67 xserver, roles, various: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:34 -04:00
Kenton Groombridge
dd7abf1f47 xscreensaver, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:33 -04:00
Kenton Groombridge
a3f02b2f6c syncthing, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:24 -04:00
Kenton Groombridge
3d11a43da1 sudo, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:13 -04:00
Kenton Groombridge
562d61bda9 ssh, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:13 -04:00
Kenton Groombridge
86462c81ec postgresql, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:13 -04:00
Kenton Groombridge
48a7d3db51 git, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:13 -04:00
Kenton Groombridge
150353158a screen, roles: use user exec domain attribute 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-10-13 19:07:13 -04:00