RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux/dbus/org.selinux.policy

83 lines
3.2 KiB
Plaintext
Raw Normal View History

These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>
<vendor>Red Hat Inc.</vendor>
<vendor_url>http://www.redhat.com</vendor_url>
<action id="org.selinux.restorecon">
<description>SELinux write access</description>
<message>System policy prevents restorecon access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 15:38:08 +00:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.selinux.setenforce">
<description>SELinux write access</description>
<message>System policy prevents setenforce access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 15:38:08 +00:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.selinux.semanage">
<description>SELinux write access</description>
<message>System policy prevents semanage access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 15:38:08 +00:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.selinux.customized">
<description>SELinux Read access</description>
<message>System policy prevents read access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 15:38:08 +00:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
org.selinux.policy: Require auth_admin_keep for all actions. Fedora permits obtaining local policy customizations and the list of policy modules without admin authentication, but we would prefer more conservative defaults upstream. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-27 20:13:34 +00:00
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
</defaults>
</action>
<action id="org.selinux.semodule_list">
<description>SELinux list modules access</description>
<message>System policy prevents read access to SELinux modules</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 15:38:08 +00:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
org.selinux.policy: Require auth_admin_keep for all actions. Fedora permits obtaining local policy customizations and the list of policy modules without admin authentication, but we would prefer more conservative defaults upstream. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-27 20:13:34 +00:00
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
</defaults>
</action>
<action id="org.selinux.relabel_on_boot">
<description>SELinux write access</description>
<message>System policy prevents relabel_on_boot access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 15:38:08 +00:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
</defaults>
</action>
<action id="org.selinux.change_default_policy">
<description>SELinux write access</description>
<message>System policy prevents change_default_policy access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 15:38:08 +00:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
</defaults>
</action>
<action id="org.selinux.change_policy_type">
<description>SELinux write access</description>
<message>System policy prevents change_policy_type access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 15:38:08 +00:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 14:16:57 +00:00
</defaults>
</action>
</policyconfig>