nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Allow unconfined users to call portage features

Browse Source 
The unconfined user is currently not allowed to call portage-related
functions. However, in a targeted system (with unconfined domains
enabled), users (including administrators) should be allowed to
transition to the portage domain.

We position the portage-related calls outside the "ifdef(distro_gentoo)"
as other distributions support Portage as well.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
This commit is contained in:
Sven Vermeulen 2011-09-13 20:22:44 +02:00 committed by Chris PeBenito
parent c94b5e3d18
commit 017b505110
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
policy/modules/system/unconfined.te
View File

@ -149,6 +149,12 @@ optional_policy(`
oddjob_domtrans_mkhomedir(unconfined_t)
')
optional_policy(`
portage_run(unconfined_t, unconfined_r)
portage_run_fetch(unconfined_t, unconfined_r)
portage_run_gcc_config(unconfined_t, unconfined_r)A
')
optional_policy(`
prelink_run(unconfined_t, unconfined_r)
')