Merge pull request #359 from 0xC0ncord/bugfix/various-20210309
This commit is contained in:
Chris PeBenito
commit
747b9eea23
@ -67,6 +67,7 @@ kernel_read_software_raid_state(bootloader_t)
|
||||
kernel_read_kernel_sysctls(bootloader_t)
|
||||
kernel_search_debugfs(bootloader_t)
|
||||
kernel_setsched(bootloader_t)
|
||||
kernel_dontaudit_getattr_proc(bootloader_t)
|
||||
# for grub-probe
|
||||
kernel_request_load_module(bootloader_t)
|
||||
|
||||
@ -82,6 +83,8 @@ dev_dontaudit_rw_generic_dev_nodes(bootloader_t)
|
||||
dev_read_rand(bootloader_t)
|
||||
dev_read_urand(bootloader_t)
|
||||
dev_read_sysfs(bootloader_t)
|
||||
# newer versions of grub use efivarfs to modify EFI variables; dontaudit legacy /sys/fs/efi/vars access
|
||||
dev_dontaudit_write_sysfs_files(bootloader_t)
|
||||
# needed on some hardware
|
||||
dev_rw_nvram(bootloader_t)
|
||||
|
||||
@ -90,6 +93,7 @@ fs_getattr_dos_fs(bootloader_t)
|
||||
fs_getattr_tmpfs(bootloader_t)
|
||||
fs_read_tmpfs_symlinks(bootloader_t)
|
||||
#Needed for EFI
|
||||
fs_getattr_efivarfs(bootloader_t)
|
||||
fs_manage_dos_files(bootloader_t)
|
||||
fs_mmap_read_dos_files(bootloader_t)
|
||||
|
||||
@ -153,6 +157,7 @@ miscfiles_read_localization(bootloader_t)
|
||||
mount_rw_runtime_files(bootloader_t)
|
||||
|
||||
selinux_getattr_fs(bootloader_t)
|
||||
selinux_use_status_page(bootloader_t)
|
||||
seutil_read_bin_policy(bootloader_t)
|
||||
seutil_read_file_contexts(bootloader_t)
|
||||
seutil_read_loadpolicy(bootloader_t)
|
||||
|
||||
@ -66,6 +66,7 @@ template(`sudo_role_template',`
|
||||
allow $1_sudo_t self:unix_dgram_socket sendto;
|
||||
allow $1_sudo_t self:unix_stream_socket connectto;
|
||||
allow $1_sudo_t self:key manage_key_perms;
|
||||
dontaudit $1_sudo_t self:capability { dac_read_search sys_ptrace };
|
||||
|
||||
allow $1_sudo_t $3:key search;
|
||||
|
||||
@ -85,6 +86,7 @@ template(`sudo_role_template',`
|
||||
kernel_read_kernel_sysctls($1_sudo_t)
|
||||
kernel_read_system_state($1_sudo_t)
|
||||
kernel_link_key($1_sudo_t)
|
||||
kernel_dontaudit_getattr_proc($1_sudo_t)
|
||||
|
||||
corecmd_exec_all_executables($1_sudo_t)
|
||||
|
||||
@ -142,6 +144,7 @@ template(`sudo_role_template',`
|
||||
userdom_manage_user_tmp_symlinks($1_sudo_t)
|
||||
userdom_setattr_user_ptys($1_sudo_t)
|
||||
userdom_use_user_terminals($1_sudo_t)
|
||||
userdom_dontaudit_rw_user_tmp_pipes($1_sudo_t)
|
||||
# for some PAM modules and for cwd
|
||||
userdom_dontaudit_search_user_home_content($1_sudo_t)
|
||||
userdom_dontaudit_search_user_home_dirs($1_sudo_t)
|
||||
|
||||
@ -2,6 +2,9 @@
|
||||
/etc/usbguard/rules\.conf gen_context(system_u:object_r:usbguard_rules_t,s0)
|
||||
/etc/usbguard/.+ gen_context(system_u:object_r:usbguard_conf_t,s0)
|
||||
|
||||
/run/usbguard(/.*)? gen_context(system_u:object_r:usbguard_runtime_t,s0)
|
||||
/run/usbguard\.pid gen_context(system_u:object_r:usbguard_runtime_t,s0)
|
||||
|
||||
/usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_daemon_exec_t,s0)
|
||||
|
||||
/var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0)
|
||||
|
||||
@ -27,6 +27,9 @@ logging_log_file(usbguard_log_t)
|
||||
type usbguard_rules_t;
|
||||
files_config_file(usbguard_rules_t)
|
||||
|
||||
type usbguard_runtime_t;
|
||||
files_runtime_file(usbguard_runtime_t)
|
||||
|
||||
# /dev/shm
|
||||
type usbguard_tmpfs_t;
|
||||
files_tmpfs_file(usbguard_tmpfs_t)
|
||||
@ -45,6 +48,10 @@ list_dirs_pattern(usbguard_t, usbguard_conf_t, usbguard_conf_t)
|
||||
read_files_pattern(usbguard_t, usbguard_conf_t, usbguard_conf_t)
|
||||
read_files_pattern(usbguard_t, usbguard_conf_t, usbguard_rules_t)
|
||||
|
||||
manage_dirs_pattern(usbguard_t, usbguard_runtime_t, usbguard_runtime_t)
|
||||
manage_files_pattern(usbguard_t, usbguard_runtime_t, usbguard_runtime_t)
|
||||
files_runtime_filetrans(usbguard_t, usbguard_runtime_t, { dir file })
|
||||
|
||||
manage_dirs_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t)
|
||||
manage_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t)
|
||||
mmap_read_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t)
|
||||
@ -57,6 +64,14 @@ setattr_files_pattern(usbguard_t, usbguard_log_t, usbguard_log_t)
|
||||
|
||||
dev_rw_sysfs(usbguard_t)
|
||||
|
||||
kernel_read_kernel_sysctls(usbguard_t)
|
||||
kernel_dontaudit_getattr_proc(usbguard_t)
|
||||
|
||||
init_search_runtime(usbguard_t)
|
||||
|
||||
logging_send_audit_msgs(usbguard_t)
|
||||
logging_send_syslog_msg(usbguard_t)
|
||||
|
||||
tunable_policy(`usbguard_user_modify_rule_files',`
|
||||
manage_files_pattern(usbguard_t, usbguard_conf_t, usbguard_rules_t)
|
||||
')
|
||||
|
||||
@ -3391,6 +3391,25 @@ interface(`dev_setattr_null_dev',`
|
||||
setattr_chr_files_pattern($1, device_t, null_device_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to set the attributes of
|
||||
## the null device nodes.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`dev_dontaudit_setattr_null_dev',`
|
||||
gen_require(`
|
||||
type null_device_t;
|
||||
')
|
||||
|
||||
dontaudit $1 null_device_t:chr_file setattr;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Delete the null device (/dev/null).
|
||||
@ -4454,6 +4473,24 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
|
||||
dontaudit $1 sysfs_t:dir write;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to write to a sysfs file.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`dev_dontaudit_write_sysfs_files',`
|
||||
gen_require(`
|
||||
type sysfs_t;
|
||||
')
|
||||
|
||||
dontaudit $1 sysfs_t:file write;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete sysfs
|
||||
|
||||
@ -4662,6 +4662,24 @@ interface(`files_manage_generic_tmp_dirs',`
|
||||
manage_dirs_pattern($1, tmp_t, tmp_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Relabel temporary directories in /tmp.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`files_relabel_generic_tmp_dirs',`
|
||||
gen_require(`
|
||||
type tmp_t;
|
||||
')
|
||||
|
||||
relabel_dirs_pattern($1, tmp_t, tmp_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage temporary files and directories in /tmp.
|
||||
|
||||
@ -2155,6 +2155,24 @@ interface(`fs_manage_dos_files',`
|
||||
manage_files_pattern($1, dosfs_t, dosfs_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Get the attributes of efivarfs filesystems.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`fs_getattr_efivarfs',`
|
||||
gen_require(`
|
||||
type efivarfs_t;
|
||||
')
|
||||
|
||||
allow $1 efivarfs_t:filesystem getattr;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## List dirs in efivarfs filesystem.
|
||||
@ -3850,6 +3868,25 @@ interface(`fs_getattr_pstore_dirs',`
|
||||
dev_search_sysfs($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create pstore directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`fs_create_pstore_dirs',`
|
||||
gen_require(`
|
||||
type pstore_t;
|
||||
')
|
||||
|
||||
create_dirs_pattern($1, pstore_t, pstore_t)
|
||||
dev_search_sysfs($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Relabel to/from pstore_t directories.
|
||||
|
||||
@ -81,6 +81,10 @@ ifdef(`init_systemd',`
|
||||
# Allow sysadm to resolve the username of dynamic users by calling
|
||||
# LookupDynamicUserByUID on org.freedesktop.systemd1.
|
||||
init_dbus_chat(sysadm_t)
|
||||
|
||||
# Allow sysadm to get the status of and set properties of other users,
|
||||
# sessions, and seats on the system.
|
||||
systemd_dbus_chat_logind(sysadm_t)
|
||||
')
|
||||
|
||||
tunable_policy(`allow_ptrace',`
|
||||
|
||||
@ -67,7 +67,7 @@ optional_policy(`
|
||||
|
||||
allow devicekit_disk_t self:capability { chown dac_override fowner fsetid net_admin setgid setuid sys_admin sys_nice sys_ptrace sys_rawio };
|
||||
allow devicekit_disk_t self:capability2 wake_alarm;
|
||||
allow devicekit_disk_t self:process { getsched signal_perms };
|
||||
allow devicekit_disk_t self:process { getsched setsched signal_perms };
|
||||
allow devicekit_disk_t self:fifo_file rw_fifo_file_perms;
|
||||
allow devicekit_disk_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
|
||||
|
||||
@ -63,6 +63,7 @@ manage_files_pattern(fail2ban_t, fail2ban_runtime_t, fail2ban_runtime_t)
|
||||
files_runtime_filetrans(fail2ban_t, fail2ban_runtime_t, file)
|
||||
|
||||
kernel_read_system_state(fail2ban_t)
|
||||
kernel_read_vm_overcommit_sysctl(fail2ban_t)
|
||||
kernel_search_fs_sysctls(fail2ban_t)
|
||||
|
||||
corecmd_exec_bin(fail2ban_t)
|
||||
@ -125,6 +126,7 @@ optional_policy(`
|
||||
|
||||
optional_policy(`
|
||||
systemd_read_journal_files(fail2ban_t)
|
||||
systemd_watch_journal_dirs(fail2ban_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
|
||||
@ -50,7 +50,9 @@ manage_dirs_pattern(redis_t, redis_runtime_t, redis_runtime_t)
|
||||
manage_files_pattern(redis_t, redis_runtime_t, redis_runtime_t)
|
||||
manage_lnk_files_pattern(redis_t, redis_runtime_t, redis_runtime_t)
|
||||
|
||||
kernel_read_net_sysctls(redis_t)
|
||||
kernel_read_system_state(redis_t)
|
||||
kernel_read_vm_overcommit_sysctl(redis_t)
|
||||
|
||||
corenet_all_recvfrom_netlabel(redis_t)
|
||||
corenet_tcp_sendrecv_generic_if(redis_t)
|
||||
@ -66,6 +68,7 @@ dev_read_urand(redis_t)
|
||||
|
||||
logging_send_syslog_msg(redis_t)
|
||||
|
||||
miscfiles_read_generic_certs(redis_t)
|
||||
miscfiles_read_localization(redis_t)
|
||||
|
||||
sysnet_dns_name_resolve(redis_t)
|
||||
|
||||
@ -32,6 +32,7 @@ kernel_rw_kernel_sysctl(rngd_t)
|
||||
|
||||
dev_read_rand(rngd_t)
|
||||
dev_read_urand(rngd_t)
|
||||
dev_read_sysfs(rngd_t)
|
||||
dev_rw_tpm(rngd_t)
|
||||
dev_write_rand(rngd_t)
|
||||
|
||||
|
||||
@ -417,6 +417,8 @@ tunable_policy(`rspamd_spamd',`
|
||||
|
||||
corenet_tcp_connect_http_port(spamd_t)
|
||||
corenet_tcp_connect_redis_port(spamd_t)
|
||||
|
||||
kernel_read_network_state(spamd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`use_nfs_home_dirs',`
|
||||
|
||||
@ -334,6 +334,7 @@ allow ssh_keygen_t sshd_key_t:file manage_file_perms;
|
||||
files_etc_filetrans(ssh_keygen_t, sshd_key_t, file)
|
||||
|
||||
kernel_read_kernel_sysctls(ssh_keygen_t)
|
||||
kernel_dontaudit_getattr_proc(ssh_keygen_t)
|
||||
|
||||
fs_search_auto_mountpoints(ssh_keygen_t)
|
||||
|
||||
@ -354,6 +355,8 @@ auth_use_nsswitch(ssh_keygen_t)
|
||||
|
||||
logging_send_syslog_msg(ssh_keygen_t)
|
||||
|
||||
miscfiles_read_localization(ssh_keygen_t)
|
||||
|
||||
userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t)
|
||||
|
||||
optional_policy(`
|
||||
|
||||
@ -61,8 +61,13 @@ corecmd_exec_shell(wireguard_t)
|
||||
|
||||
domain_use_interactive_fds(wireguard_t)
|
||||
|
||||
# wg-quick can be configured to run iptables and other networking
|
||||
# config tools when bringing up/down the wg interfaces
|
||||
iptables_domtrans(wireguard_t)
|
||||
|
||||
# wg-quick tries to read /proc/filesystem when running "stat" and "mv" commands
|
||||
kernel_dontaudit_read_system_state(wireguard_t)
|
||||
kernel_dontaudit_search_kernel_sysctl(wireguard_t)
|
||||
|
||||
miscfiles_read_localization(wireguard_t)
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
/etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
|
||||
/etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0)
|
||||
/etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_lock_t,s0)
|
||||
/etc/group\.lock -- gen_context(system_u:object_r:shadow_lock_t,s0)
|
||||
/etc/passwd\.lock -- gen_context(system_u:object_r:shadow_lock_t,s0)
|
||||
/etc/gshadow.* -- gen_context(system_u:object_r:shadow_t,s0)
|
||||
/etc/passwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
|
||||
/etc/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
|
||||
|
||||
/usr/bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
|
||||
|
||||
@ -679,6 +679,7 @@ interface(`auth_rw_shadow',`
|
||||
')
|
||||
|
||||
files_list_etc($1)
|
||||
auth_rw_shadow_lock($1)
|
||||
allow $1 shadow_t:file rw_file_perms;
|
||||
typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
|
||||
')
|
||||
@ -700,6 +701,7 @@ interface(`auth_manage_shadow',`
|
||||
type shadow_t;
|
||||
')
|
||||
|
||||
auth_rw_shadow_lock($1)
|
||||
allow $1 shadow_t:file manage_file_perms;
|
||||
typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
|
||||
')
|
||||
@ -771,6 +773,24 @@ interface(`auth_relabel_shadow',`
|
||||
typeattribute $1 can_relabelto_shadow_passwords;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read/Write shadow lock files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`auth_rw_shadow_lock',`
|
||||
gen_require(`
|
||||
type shadow_lock_t;
|
||||
')
|
||||
|
||||
rw_files_pattern($1, shadow_lock_t, shadow_lock_t)
|
||||
')
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
## Append to the login failure log.
|
||||
|
||||
@ -65,6 +65,9 @@ neverallow ~can_read_shadow_passwords shadow_t:file read;
|
||||
neverallow ~can_write_shadow_passwords shadow_t:file { create write };
|
||||
neverallow ~can_relabelto_shadow_passwords shadow_t:file relabelto;
|
||||
|
||||
type shadow_lock_t;
|
||||
files_lock_file(shadow_lock_t)
|
||||
|
||||
type updpwd_t;
|
||||
type updpwd_exec_t;
|
||||
domain_type(updpwd_t)
|
||||
|
||||
@ -55,6 +55,7 @@ allow getty_t getty_tmp_t:file manage_file_perms;
|
||||
allow getty_t getty_tmp_t:dir manage_dir_perms;
|
||||
files_tmp_filetrans(getty_t, getty_tmp_t, { file dir })
|
||||
|
||||
kernel_read_kernel_sysctls(getty_t)
|
||||
kernel_read_system_state(getty_t)
|
||||
|
||||
# these two needed for receiving faxes
|
||||
@ -66,6 +67,7 @@ dev_read_sysfs(getty_t)
|
||||
files_read_etc_runtime_files(getty_t)
|
||||
files_read_etc_files(getty_t)
|
||||
files_search_spool(getty_t)
|
||||
files_dontaudit_search_var_lib(getty_t)
|
||||
|
||||
fs_search_auto_mountpoints(getty_t)
|
||||
# for error condition handling
|
||||
@ -84,6 +86,7 @@ term_setattr_unallocated_ttys(getty_t)
|
||||
term_setattr_console(getty_t)
|
||||
|
||||
auth_rw_login_records(getty_t)
|
||||
auth_use_nsswitch(getty_t)
|
||||
|
||||
init_rw_utmp(getty_t)
|
||||
|
||||
|
||||
@ -2544,7 +2544,7 @@ interface(`init_rw_script_pipes',`
|
||||
type initrc_t;
|
||||
')
|
||||
|
||||
allow $1 initrc_t:fifo_file rw_inherited_fifo_file_perms;
|
||||
allow $1 initrc_t:fifo_file rw_fifo_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -3009,6 +3009,24 @@ interface(`init_manage_utmp',`
|
||||
allow $1 initrc_runtime_t:file manage_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Add a watch on utmp.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`init_watch_utmp',`
|
||||
gen_require(`
|
||||
type initrc_runtime_t;
|
||||
')
|
||||
|
||||
allow $1 initrc_runtime_t:file watch;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Relabel utmp.
|
||||
|
||||
@ -251,6 +251,7 @@ ifdef(`init_systemd',`
|
||||
allow init_t self:capability2 audit_read;
|
||||
allow init_t self:key { search setattr write };
|
||||
allow init_t self:bpf { map_create map_read map_write prog_load prog_run };
|
||||
dontaudit init_t self:process { dyntransition setcurrent };
|
||||
|
||||
allow init_t init_mountpoint_type:dir_file_class_set { getattr mounton };
|
||||
|
||||
@ -267,7 +268,7 @@ ifdef(`init_systemd',`
|
||||
|
||||
# setexec and setkeycreate for systemd --user
|
||||
allow init_t self:process { getcap getsched setsched setpgid setfscreate setsockcreate setexec setkeycreate setcap setrlimit };
|
||||
allow init_t self:capability2 { audit_read block_suspend };
|
||||
allow init_t self:capability2 { audit_read block_suspend bpf perfmon };
|
||||
allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
allow init_t self:unix_dgram_socket lock;
|
||||
|
||||
@ -294,6 +295,11 @@ ifdef(`init_systemd',`
|
||||
# /memfd:systemd-state
|
||||
fs_tmpfs_filetrans(init_t, init_runtime_t, file)
|
||||
|
||||
# mounton is required for systemd-timesyncd
|
||||
allow init_t init_var_lib_t:dir { manage_dir_perms mounton };
|
||||
allow init_t init_var_lib_t:file manage_file_perms;
|
||||
allow init_t init_var_lib_t:lnk_file manage_lnk_file_perms;
|
||||
|
||||
manage_files_pattern(init_t, systemd_unit_t, systemdunit)
|
||||
|
||||
manage_dirs_pattern(init_t, systemd_unit_t, systemd_unit_t)
|
||||
@ -307,6 +313,8 @@ ifdef(`init_systemd',`
|
||||
kernel_read_fs_sysctls(init_t)
|
||||
kernel_list_unlabeled(init_t)
|
||||
kernel_load_module(init_t)
|
||||
kernel_request_load_module(init_t)
|
||||
kernel_rw_fs_sysctls(init_t)
|
||||
kernel_rw_kernel_sysctl(init_t)
|
||||
kernel_rw_net_sysctls(init_t)
|
||||
kernel_read_all_sysctls(init_t)
|
||||
@ -390,6 +398,8 @@ ifdef(`init_systemd',`
|
||||
files_list_spool(init_t)
|
||||
files_manage_all_runtime_dirs(init_t)
|
||||
files_manage_generic_tmp_dirs(init_t)
|
||||
files_relabel_generic_tmp_dirs(init_t)
|
||||
files_mounton_tmp(init_t)
|
||||
files_manage_urandom_seed(init_t)
|
||||
files_read_boot_files(initrc_t)
|
||||
files_relabel_all_lock_dirs(init_t)
|
||||
@ -398,6 +408,7 @@ ifdef(`init_systemd',`
|
||||
# If /etc/localtime is missing, a watch on /etc is added.
|
||||
files_watch_etc_dirs(init_t)
|
||||
files_watch_etc_symlinks(init_t)
|
||||
files_dontaudit_write_var_dirs(init_t)
|
||||
|
||||
fs_relabel_cgroup_dirs(init_t)
|
||||
fs_list_auto_mountpoints(init_t)
|
||||
@ -421,6 +432,7 @@ ifdef(`init_systemd',`
|
||||
fs_relabel_tmpfs_blk_files(init_t)
|
||||
fs_relabel_tmpfs_chr_files(init_t)
|
||||
fs_relabel_tmpfs_fifo_files(init_t)
|
||||
fs_read_efivarfs_files(init_t)
|
||||
# for privatetmp functions
|
||||
fs_relabel_tmpfs_dirs(init_t)
|
||||
fs_relabel_tmpfs_files(init_t)
|
||||
@ -429,6 +441,7 @@ ifdef(`init_systemd',`
|
||||
# mount-setup
|
||||
fs_unmount_autofs(init_t)
|
||||
fs_getattr_pstore_dirs(init_t)
|
||||
fs_create_pstore_dirs(init_t)
|
||||
# for network namespaces
|
||||
fs_read_nsfs_files(init_t)
|
||||
|
||||
@ -437,7 +450,11 @@ ifdef(`init_systemd',`
|
||||
|
||||
miscfiles_watch_localization(init_t)
|
||||
|
||||
# systemd watches utab in order to mount the
|
||||
# local filesystem at boot
|
||||
mount_watch_runtime_dirs(init_t)
|
||||
mount_watch_runtime_files(init_t)
|
||||
mount_watch_reads_runtime_files(init_t)
|
||||
|
||||
# systemd_socket_activated policy
|
||||
mls_socket_write_all_levels(init_t)
|
||||
@ -460,6 +477,8 @@ ifdef(`init_systemd',`
|
||||
auth_relabel_login_records(init_t)
|
||||
auth_relabel_pam_console_data_dirs(init_t)
|
||||
auth_domtrans_chk_passwd(init_t)
|
||||
# for systemd dynamic users
|
||||
auth_rw_shadow_lock(init_t)
|
||||
|
||||
logging_manage_runtime_sockets(init_t)
|
||||
logging_relabelto_devlog_sock_files(init_t)
|
||||
@ -495,6 +514,9 @@ ifdef(`init_systemd',`
|
||||
# for systemd to read udev status
|
||||
udev_read_runtime_files(init_t)
|
||||
|
||||
udev_relabel_rules_dirs(init_t)
|
||||
udev_relabel_rules_files(init_t)
|
||||
|
||||
userdom_relabel_user_runtime_root_dirs(init_t)
|
||||
|
||||
tunable_policy(`init_mounton_non_security',`
|
||||
|
||||
@ -86,6 +86,7 @@ auth_use_nsswitch(iptables_t)
|
||||
init_use_fds(iptables_t)
|
||||
init_use_script_ptys(iptables_t)
|
||||
# to allow rules to be saved on reboot:
|
||||
init_rw_script_pipes(iptables_t)
|
||||
init_rw_script_tmp_files(iptables_t)
|
||||
init_rw_script_stream_sockets(iptables_t)
|
||||
|
||||
|
||||
@ -114,6 +114,7 @@ files_getattr_all_dirs(auditctl_t)
|
||||
files_getattr_all_files(auditctl_t)
|
||||
files_read_etc_files(auditctl_t)
|
||||
|
||||
kernel_dontaudit_getattr_proc(auditctl_t)
|
||||
kernel_read_kernel_sysctls(auditctl_t)
|
||||
kernel_read_proc_symlinks(auditctl_t)
|
||||
kernel_setsched(auditctl_t)
|
||||
@ -166,6 +167,10 @@ manage_files_pattern(auditd_t, auditd_runtime_t, auditd_runtime_t)
|
||||
manage_sock_files_pattern(auditd_t, auditd_runtime_t, auditd_runtime_t)
|
||||
files_runtime_filetrans(auditd_t, auditd_runtime_t, { file sock_file })
|
||||
|
||||
# Needs to be able to getattr on the audisp-remote binary to verify
|
||||
# the plugin configuration.
|
||||
allow auditd_t audisp_remote_exec_t:file getattr;
|
||||
|
||||
kernel_read_kernel_sysctls(auditd_t)
|
||||
# Needs to be able to run dispatcher. see /etc/audit/auditd.conf
|
||||
# Probably want a transition, and a new auditd_helper app
|
||||
@ -196,6 +201,8 @@ domain_use_interactive_fds(auditd_t)
|
||||
files_read_etc_files(auditd_t)
|
||||
files_list_usr(auditd_t)
|
||||
|
||||
auth_use_nsswitch(auditd_t)
|
||||
|
||||
init_telinit(auditd_t)
|
||||
|
||||
logging_set_audit_parameters(auditd_t)
|
||||
|
||||
@ -88,6 +88,7 @@ files_read_kernel_symbol_table(kmod_t)
|
||||
files_read_etc_runtime_files(kmod_t)
|
||||
files_read_etc_files(kmod_t)
|
||||
files_read_usr_files(kmod_t)
|
||||
files_read_usr_src_files(kmod_t)
|
||||
files_exec_etc_files(kmod_t)
|
||||
files_search_tmp(kmod_t)
|
||||
# for nscd:
|
||||
|
||||
@ -103,6 +103,7 @@ fs_getattr_tmpfs(mount_t)
|
||||
fs_getattr_rpc_pipefs(mount_t)
|
||||
fs_getattr_cifs(mount_t)
|
||||
fs_getattr_nfs(mount_t)
|
||||
fs_getattr_dos_fs(mount_t)
|
||||
fs_mount_all_fs(mount_t)
|
||||
fs_unmount_all_fs(mount_t)
|
||||
fs_remount_all_fs(mount_t)
|
||||
|
||||
@ -39,6 +39,7 @@
|
||||
/usr/lib/systemd/systemd-resolved -- gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
|
||||
/usr/lib/systemd/systemd-rfkill -- gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
|
||||
/usr/lib/systemd/systemd-socket-proxyd -- gen_context(system_u:object_r:systemd_socket_proxyd_exec_t,s0)
|
||||
/usr/lib/systemd/systemd-sysctl -- gen_context(system_u:object_r:systemd_sysctl_exec_t,s0)
|
||||
/usr/lib/systemd/systemd-update-done -- gen_context(system_u:object_r:systemd_update_done_exec_t,s0)
|
||||
/usr/lib/systemd/systemd-user-runtime-dir -- gen_context(system_u:object_r:systemd_user_runtime_dir_exec_t,s0)
|
||||
/usr/lib/systemd/systemd-user-sessions -- gen_context(system_u:object_r:systemd_sessions_exec_t,s0)
|
||||
|
||||
@ -164,6 +164,8 @@ template(`systemd_role_template',`
|
||||
systemd_status_user_runtime_units($3)
|
||||
systemd_stop_user_runtime_units($3)
|
||||
|
||||
systemd_watch_passwd_runtime_dirs($3)
|
||||
|
||||
optional_policy(`
|
||||
xdg_config_filetrans($1_systemd_t, systemd_conf_home_t, dir, "systemd")
|
||||
xdg_data_filetrans($1_systemd_t, systemd_data_home_t, dir, "systemd")
|
||||
@ -1163,6 +1165,24 @@ interface(`systemd_manage_passwd_runtime_symlinks',`
|
||||
allow $1 systemd_passwd_runtime_t:lnk_file manage_lnk_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow a domain to watch systemd-passwd runtime dirs.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`systemd_watch_passwd_runtime_dirs',`
|
||||
gen_require(`
|
||||
type systemd_passwd_runtime_t;
|
||||
')
|
||||
|
||||
allow $1 systemd_passwd_runtime_t:dir watch;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## manage systemd unit dirs and the files in them (Deprecated)
|
||||
@ -1235,6 +1255,24 @@ interface(`systemd_manage_journal_files',`
|
||||
allow $1 systemd_journal_t:file map;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow domain to add a watch on systemd_journal_t directories
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`systemd_watch_journal_dirs',`
|
||||
gen_require(`
|
||||
type systemd_journal_t;
|
||||
')
|
||||
|
||||
allow $1 systemd_journal_t:dir watch;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Relabel to systemd-journald directory type.
|
||||
|
||||
@ -260,6 +260,10 @@ corenet_port(systemd_socket_proxyd_port_t)
|
||||
type systemd_socket_proxyd_unit_file_t;
|
||||
init_unit_file(systemd_socket_proxyd_unit_file_t)
|
||||
|
||||
type systemd_sysctl_t;
|
||||
type systemd_sysctl_exec_t;
|
||||
init_daemon_domain(systemd_sysctl_t, systemd_sysctl_exec_t)
|
||||
|
||||
type systemd_sysusers_t;
|
||||
type systemd_sysusers_exec_t;
|
||||
init_system_domain(systemd_sysusers_t, systemd_sysusers_exec_t)
|
||||
@ -332,6 +336,8 @@ systemd_log_parse_environment(systemd_backlight_t)
|
||||
# Allow systemd-backlight to write to /sys/class/backlight/*/brightness
|
||||
dev_rw_sysfs(systemd_backlight_t)
|
||||
|
||||
kernel_dontaudit_search_kernel_sysctl(systemd_backlight_t)
|
||||
|
||||
# for udev.conf
|
||||
files_read_etc_files(systemd_backlight_t)
|
||||
|
||||
@ -432,6 +438,7 @@ allow systemd_generator_t self:fifo_file rw_fifo_file_perms;
|
||||
allow systemd_generator_t self:capability dac_override;
|
||||
allow systemd_generator_t self:process setfscreate;
|
||||
|
||||
corecmd_exec_shell(systemd_generator_t)
|
||||
corecmd_getattr_bin_files(systemd_generator_t)
|
||||
|
||||
dev_read_sysfs(systemd_generator_t)
|
||||
@ -446,6 +453,7 @@ files_search_all_mountpoints(systemd_generator_t)
|
||||
files_list_usr(systemd_generator_t)
|
||||
|
||||
fs_list_efivars(systemd_generator_t)
|
||||
fs_getattr_cgroup(systemd_generator_t)
|
||||
fs_getattr_xattr_fs(systemd_generator_t)
|
||||
|
||||
init_create_runtime_files(systemd_generator_t)
|
||||
@ -464,6 +472,7 @@ init_read_script_files(systemd_generator_t)
|
||||
kernel_use_fds(systemd_generator_t)
|
||||
kernel_read_system_state(systemd_generator_t)
|
||||
kernel_read_kernel_sysctls(systemd_generator_t)
|
||||
kernel_dontaudit_getattr_proc(systemd_generator_t)
|
||||
|
||||
storage_raw_read_fixed_disk(systemd_generator_t)
|
||||
|
||||
@ -494,6 +503,7 @@ optional_policy(`
|
||||
allow systemd_hostnamed_t self:capability sys_admin;
|
||||
|
||||
kernel_read_kernel_sysctls(systemd_hostnamed_t)
|
||||
kernel_dontaudit_getattr_proc(systemd_hostnamed_t)
|
||||
|
||||
dev_read_sysfs(systemd_hostnamed_t)
|
||||
|
||||
@ -592,6 +602,7 @@ allow systemd_logind_t self:unix_dgram_socket create_socket_perms;
|
||||
allow systemd_logind_t self:fifo_file rw_fifo_file_perms;
|
||||
|
||||
allow systemd_logind_t systemd_logind_var_lib_t:dir manage_dir_perms;
|
||||
allow systemd_logind_t systemd_logind_var_lib_t:file manage_file_perms;
|
||||
init_var_lib_filetrans(systemd_logind_t, systemd_logind_var_lib_t, dir)
|
||||
|
||||
manage_fifo_files_pattern(systemd_logind_t, systemd_logind_runtime_t, systemd_logind_runtime_t)
|
||||
@ -610,6 +621,7 @@ allow systemd_logind_t systemd_sessions_runtime_t:dir manage_dir_perms;
|
||||
allow systemd_logind_t systemd_sessions_runtime_t:file manage_file_perms;
|
||||
allow systemd_logind_t systemd_sessions_runtime_t:fifo_file manage_fifo_file_perms;
|
||||
|
||||
kernel_dontaudit_getattr_proc(systemd_logind_t)
|
||||
kernel_read_kernel_sysctls(systemd_logind_t)
|
||||
|
||||
dev_getattr_dri_dev(systemd_logind_t)
|
||||
@ -660,6 +672,7 @@ init_dbus_send_script(systemd_logind_t)
|
||||
init_get_all_units_status(systemd_logind_t)
|
||||
init_get_system_status(systemd_logind_t)
|
||||
init_read_utmp(systemd_logind_t)
|
||||
init_watch_utmp(systemd_logind_t)
|
||||
init_service_start(systemd_logind_t)
|
||||
init_service_status(systemd_logind_t)
|
||||
init_start_all_units(systemd_logind_t)
|
||||
@ -713,8 +726,11 @@ ifdef(`distro_redhat',`
|
||||
|
||||
tunable_policy(`systemd_logind_get_bootloader',`
|
||||
fs_getattr_dos_fs(systemd_logind_t)
|
||||
fs_getattr_xattr_fs(systemd_logind_t)
|
||||
fs_list_dos(systemd_logind_t)
|
||||
fs_read_dos_files(systemd_logind_t)
|
||||
|
||||
files_search_boot(systemd_logind_t)
|
||||
')
|
||||
# systemd-logind uses util-linux's blkid in order to find the ESP (EFI System Partition).
|
||||
# This reads the first sectors of fixed disk devices.
|
||||
@ -814,6 +830,7 @@ optional_policy(`
|
||||
kernel_load_module(systemd_modules_load_t)
|
||||
kernel_read_kernel_sysctls(systemd_modules_load_t)
|
||||
kernel_request_load_module(systemd_modules_load_t)
|
||||
kernel_dontaudit_getattr_proc(systemd_modules_load_t)
|
||||
|
||||
dev_read_sysfs(systemd_modules_load_t)
|
||||
|
||||
@ -850,6 +867,7 @@ kernel_read_kernel_sysctls(systemd_networkd_t)
|
||||
kernel_read_network_state(systemd_networkd_t)
|
||||
kernel_request_load_module(systemd_networkd_t)
|
||||
kernel_rw_net_sysctls(systemd_networkd_t)
|
||||
kernel_dontaudit_getattr_proc(systemd_networkd_t)
|
||||
|
||||
corecmd_bin_entry_type(systemd_networkd_t)
|
||||
corecmd_exec_bin(systemd_networkd_t)
|
||||
@ -1180,6 +1198,7 @@ allow systemd_resolved_t systemd_networkd_runtime_t:dir watch;
|
||||
|
||||
manage_dirs_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
|
||||
manage_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
|
||||
manage_sock_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
|
||||
init_runtime_filetrans(systemd_resolved_t, systemd_resolved_runtime_t, dir)
|
||||
|
||||
dev_read_sysfs(systemd_resolved_t)
|
||||
@ -1187,6 +1206,7 @@ dev_read_sysfs(systemd_resolved_t)
|
||||
kernel_read_crypto_sysctls(systemd_resolved_t)
|
||||
kernel_read_kernel_sysctls(systemd_resolved_t)
|
||||
kernel_read_net_sysctls(systemd_resolved_t)
|
||||
kernel_dontaudit_getattr_proc(systemd_resolved_t)
|
||||
|
||||
corenet_tcp_bind_generic_node(systemd_resolved_t)
|
||||
corenet_tcp_bind_dns_port(systemd_resolved_t)
|
||||
@ -1254,6 +1274,7 @@ allow systemd_sessions_t systemd_sessions_runtime_t:file manage_file_perms;
|
||||
files_runtime_filetrans(systemd_sessions_t, systemd_sessions_runtime_t, file)
|
||||
|
||||
kernel_read_kernel_sysctls(systemd_sessions_t)
|
||||
kernel_dontaudit_getattr_proc(systemd_sessions_t)
|
||||
|
||||
selinux_get_fs_mount(systemd_sessions_t)
|
||||
selinux_use_status_page(systemd_sessions_t)
|
||||
@ -1264,6 +1285,21 @@ seutil_read_file_contexts(systemd_sessions_t)
|
||||
|
||||
systemd_log_parse_environment(systemd_sessions_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# sysctl local policy
|
||||
#
|
||||
|
||||
dontaudit systemd_sysctl_t self:capability sys_ptrace;
|
||||
|
||||
kernel_read_kernel_sysctls(systemd_sysctl_t)
|
||||
kernel_request_load_module(systemd_sysctl_t)
|
||||
kernel_rw_all_sysctls(systemd_sysctl_t)
|
||||
kernel_dontaudit_getattr_proc(systemd_sysctl_t)
|
||||
|
||||
files_read_etc_files(systemd_sysctl_t)
|
||||
|
||||
systemd_log_parse_environment(systemd_sysctl_t)
|
||||
|
||||
#########################################
|
||||
#
|
||||
@ -1557,6 +1593,7 @@ fs_unmount_tmpfs(systemd_user_runtime_dir_t)
|
||||
fs_relabelfrom_tmpfs_dirs(systemd_user_runtime_dir_t)
|
||||
|
||||
kernel_read_kernel_sysctls(systemd_user_runtime_dir_t)
|
||||
kernel_dontaudit_getattr_proc(systemd_user_runtime_dir_t)
|
||||
|
||||
selinux_use_status_page(systemd_user_runtime_dir_t)
|
||||
|
||||
|
||||
@ -202,6 +202,46 @@ interface(`udev_manage_rules_files',`
|
||||
udev_search_runtime($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Relabel udev rules directories
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`udev_relabel_rules_dirs',`
|
||||
gen_require(`
|
||||
type udev_rules_t;
|
||||
')
|
||||
|
||||
relabel_dirs_pattern($1, udev_rules_t, udev_rules_t)
|
||||
|
||||
files_search_etc($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Relabel udev rules files
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`udev_relabel_rules_files',`
|
||||
gen_require(`
|
||||
type udev_rules_t;
|
||||
')
|
||||
|
||||
relabel_files_pattern($1, udev_rules_t, udev_rules_t)
|
||||
|
||||
files_search_etc($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit search of udev database directories. (Deprecated)
|
||||
|
||||
@ -41,7 +41,6 @@ ifdef(`enable_mcs',`
|
||||
#
|
||||
|
||||
allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid mknod net_admin net_raw setgid setuid sys_admin sys_nice sys_ptrace sys_rawio sys_resource };
|
||||
dontaudit udev_t self:capability sys_tty_config;
|
||||
allow udev_t self:capability2 { wake_alarm block_suspend };
|
||||
allow udev_t self:process { transition signal_perms ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setfscreate noatsecure siginh rlimitinh dyntransition execmem setkeycreate setsockcreate getrlimit };
|
||||
allow udev_t self:fd use;
|
||||
@ -58,6 +57,13 @@ allow udev_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
allow udev_t self:netlink_generic_socket create_socket_perms;
|
||||
allow udev_t self:rawip_socket create_socket_perms;
|
||||
|
||||
ifdef(`init_systemd',`
|
||||
# systemd-vconsole-setup will be called by udev during virtual terminal initialization
|
||||
allow udev_t self:capability sys_tty_config;
|
||||
',`
|
||||
dontaudit udev_t self:capability sys_tty_config;
|
||||
')
|
||||
|
||||
# for systemd-udevd to rename interfaces
|
||||
allow udev_t self:netlink_route_socket nlmsg_write;
|
||||
|
||||
@ -124,6 +130,10 @@ files_mmap_read_kernel_modules(udev_t)
|
||||
files_exec_etc_files(udev_t)
|
||||
files_getattr_generic_locks(udev_t)
|
||||
files_search_mnt(udev_t)
|
||||
files_dontaudit_getattr_default_files(udev_t)
|
||||
files_dontaudit_getattr_home_dir(udev_t)
|
||||
files_dontaudit_getattr_lost_found_dirs(udev_t)
|
||||
files_dontaudit_getattr_tmp_dirs(udev_t)
|
||||
|
||||
fs_getattr_all_fs(udev_t)
|
||||
fs_list_inotifyfs(udev_t)
|
||||
@ -145,6 +155,7 @@ selinux_compute_access_vector(udev_t)
|
||||
selinux_compute_create_context(udev_t)
|
||||
selinux_compute_relabel_context(udev_t)
|
||||
selinux_compute_user_contexts(udev_t)
|
||||
selinux_use_status_page(udev_t)
|
||||
|
||||
storage_watch_fixed_disk(udev_t)
|
||||
|
||||
@ -189,6 +200,7 @@ sysnet_signal_dhcpc(udev_t)
|
||||
sysnet_manage_config(udev_t)
|
||||
sysnet_etc_filetrans_config(udev_t)
|
||||
|
||||
userdom_dontaudit_getattr_user_home_dirs(udev_t)
|
||||
userdom_dontaudit_search_user_home_content(udev_t)
|
||||
|
||||
ifdef(`distro_debian',`
|
||||
@ -329,6 +341,7 @@ optional_policy(`
|
||||
|
||||
optional_policy(`
|
||||
raid_domtrans_mdadm(udev_t)
|
||||
raid_read_mdadm_runtime_files(udev_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
||||
@ -78,6 +78,7 @@ template(`userdom_base_user_template',`
|
||||
|
||||
dev_dontaudit_getattr_all_blk_files($1_t)
|
||||
dev_dontaudit_getattr_all_chr_files($1_t)
|
||||
dev_dontaudit_setattr_null_dev($1_t)
|
||||
|
||||
# for X session unlock
|
||||
allow $1_t self:netlink_audit_socket { create_socket_perms nlmsg_relay };
|
||||
@ -3104,6 +3105,25 @@ interface(`userdom_manage_user_tmp_pipes',`
|
||||
userdom_search_user_runtime($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to read and write
|
||||
## temporary pipes.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`userdom_dontaudit_rw_user_tmp_pipes',`
|
||||
gen_require(`
|
||||
type user_tmp_t;
|
||||
')
|
||||
|
||||
dontaudit $1 user_tmp_t:fifo_file rw_fifo_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete user
|
||||
|
||||
Loading…
Reference in New Issue
Block a user