RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-30 18:12:10 +00:00
Code Issues Packages Projects Releases Wiki Activity
2efa068575
selinux/libselinux/src/file_path_suffixes.h

34 lines
1.6 KiB
C
Raw Normal View History

initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
/* File name suffixes. */
S_(BINPOLICY, "/policy/policy")
S_(CONTEXTS_DIR, "/contexts")
S_(FILE_CONTEXTS, "/contexts/files/file_contexts")
S_(HOMEDIR_CONTEXTS, "/contexts/files/homedir_template")
S_(DEFAULT_CONTEXTS, "/contexts/default_contexts")
S_(USER_CONTEXTS, "/contexts/users/")
S_(FAILSAFE_CONTEXT, "/contexts/failsafe_context")
S_(DEFAULT_TYPE, "/contexts/default_type")
S_(SECURETTY_TYPES, "/contexts/securetty_types")
S_(BOOLEANS, "/booleans")
S_(MEDIA_CONTEXTS, "/contexts/files/media")
S_(REMOVABLE_CONTEXT, "/contexts/removable_context")
S_(CUSTOMIZABLE_TYPES, "/contexts/customizable_types")
S_(USERS_DIR, "/users/")
S_(SEUSERS, "/seusers")
S_(TRANSLATIONS, "/setrans.conf")
S_(NETFILTER_CONTEXTS, "/contexts/netfilter_contexts")
S_(FILE_CONTEXTS_HOMEDIR, "/contexts/files/file_contexts.homedirs")
S_(FILE_CONTEXTS_LOCAL, "/contexts/files/file_contexts.local")
S_(X_CONTEXTS, "/contexts/x_contexts")
Add config path function for secolor.conf file. Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
2008-12-31 23:55:20 +00:00
S_(COLORS, "/secolor.conf")
Author: Daniel J Walsh Email: dwalsh@redhat.com Subject: SELinux context patch Date: Mon, 18 May 2009 14:16:12 -0400 This patch adds context files for virtual_domain and virtual_image, these are both being used to locat the default context to be executed by svirt. I also included the subs patch which I submitted before. This patch allows us to substitute prefixes to matchpathcon. So we can say /export/home == /home and /web == /var/www Author: Chad Sellers Email: csellers@tresys.com Flipped free()'s in original patch when strdup'd fail to proper order. Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-06-04 21:15:31 +00:00
S_(VIRTUAL_DOMAIN, "/contexts/virtual_domain_context")
S_(VIRTUAL_IMAGE, "/contexts/virtual_image_context")
libselinux: Add support for lxc_contexts_path In order for lxc to look up its process and file labels we add new libselinux support. This is what we do for everything else, like libvirt, seposgresql, etc. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-04-18 18:46:12 +00:00
S_(LXC_CONTEXTS, "/contexts/lxc_contexts")
libselinux: Add openrc_contexts functions The file will initially contain: run_init=run_init_t There can not be any spaces around the = since OpenRC's existing config files and the methods it uses require it. Signed-off-by: Jason Zaman <jason@perfinion.com>
2016-09-22 14:43:57 +00:00
S_(OPENRC_CONTEXTS, "/contexts/openrc_contexts")
libselinux: add selinux_openssh_contexts_path() openssh in Fedora uses "sshd_net_t" type for privilege separated processes in the preauthentication phase. Similarly, openssh portable uses "sftp_t" for internal-sftp processes. Both type are hardcoded what is not ideal. Therefore selinux_openssh_contexts_path() was created to get a path where sshd can get a correct types prepared by a distribution or an administrator. Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2015-05-21 16:14:22 +00:00
S_(OPENSSH_CONTEXTS, "/contexts/openssh_contexts")
libselinux: add selinux_snapperd_contexts_path() Snapper needs a way how to set a proper selinux context on btrfs subvolumes originating in snapshot create command. Fs can't handle it on its own so snapper will enforce .snapshots subvolume relabeling according to a file returned by selinux_snapperd_contexts_path(). The format of the file will be similar to other contexts file: snapperd_data = system_u:object_r:snapperd_data_t:s0 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1247530 https://bugzilla.redhat.com/show_bug.cgi?id=1247532 Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2016-06-20 11:09:51 +00:00
S_(SNAPPERD_CONTEXTS, "/contexts/snapperd_contexts")
Add selinux_systemd_contexts_path systemd has some internal contexts like generated systemd unit files that we want to allow it to check against processes trying to manage them.
2013-10-09 18:52:49 +00:00
S_(SYSTEMD_CONTEXTS, "/contexts/systemd_contexts")
Author: Daniel J Walsh Email: dwalsh@redhat.com Subject: SELinux context patch Date: Mon, 18 May 2009 14:16:12 -0400 This patch adds context files for virtual_domain and virtual_image, these are both being used to locat the default context to be executed by svirt. I also included the subs patch which I submitted before. This patch allows us to substitute prefixes to matchpathcon. So we can say /export/home == /home and /web == /var/www Author: Chad Sellers Email: csellers@tresys.com Flipped free()'s in original patch when strdup'd fail to proper order. Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-06-04 21:15:31 +00:00
S_(FILE_CONTEXT_SUBS, "/contexts/files/file_contexts.subs")
This patch adds a new subs_dist file. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The idea is to allow distributions to ship a subs file as well as let the user modify subs. In F16 we are looking at shipping a file_contexts.subs_dist file like this cat file_contexts.subs_dist /run /var/run /run/lock /var/lock /var/run/lock /var/lock /lib64 /lib /usr/lib64 /usr/lib The we will remove all (64)? from policy. This will allow us to make sure all /usr/lib/libBLAH is labeled the same as /usr/lib64/libBLAH -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk2c1ksACgkQrlYvE4MpobNXcQCgqgAiQJxmwa1+NdIq8E3tQRp6 QT0An0ihA60di9CRsEqEdVbSaHOwtte5 =LXgd -----END PGP SIGNATURE----- Signed-off-by: Steve Lawrence <slawrence@tresys.com>
2011-04-06 21:08:27 +00:00
S_(FILE_CONTEXT_SUBS_DIST, "/contexts/files/file_contexts.subs_dist")
This patch allows selabel_*() interfaces to provide an expected security context for the given database object identified by its name and object class. It is necessary to implement a feature something like the restorecon on databases. The specfile shall be described as follows: ------------------------ # # The specfile for database objects # (for SE-PostgreSQL) # # <object class> <object name> <security context> # db_database * system_u:object_r:sepgsql_db_t:s0 db_schema *.pg_catalog system_u:obejct_r:sepgsql_sys_schema_t:s0 db_schema *.* system_u:object_r:sepgsql_schema_t:s0 db_table *.pg_catalog.* system_u:object_r:sepgsql_sysobj_t:s0 db_table *.*.* system_u:object_r:sepgsql_table_t:s0 ------------------------ - All the characters after the '#' are ignored. - Wildcards ('*' and '?') are available. - It returns the first match security context. Note that hierarchy of the namespace of database objects depends on RDBMS. So, author of the specfile needs to write correct patterns which are suitable for the target RDBMS. The patched selabel_*() interfaces don't have any heuristics for the namespace hierarchy to be suitable for widespread RDBMSs. In the case of SE-PgSQL, when we lookup an expected security context for the 'my_table' table in the 'public' schema and 'postgres' database, the caller shall provide 'postgres.public.my_table' as a key. In the default, it tries to read a specfile which maps database objects and security context from the /etc/selinux/$POLICYTYPE/contexts/sepgsql_contexts. Note that when another RDBMS uses this interface, it needs to give an explicit SELABEL_OPT_PATH option on the selabel_open(). Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com> Acked-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
2010-03-15 22:38:35 +00:00
S_(SEPGSQL_CONTEXTS, "/contexts/sepgsql_contexts")
libselinux: Change boooleans.subs to booleans.subs_dist. Currently we ship other subs files with the _dist to indicate they come with the distribution as opposed to being modified by the user. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-06-08 13:18:04 +00:00
S_(BOOLEAN_SUBS, "/booleans.subs_dist")
Reference in New Issue Copy Permalink