Additional rearrangement in corecommands, along with module version bump.
This commit is contained in:
Chris PeBenito
parent
c60f75ad0f
commit
98f8408519
|
|
@ -1,4 +1,3 @@
|
|||
|
||||
#
|
||||
# /bin
|
||||
#
|
||||
|
|
@ -69,12 +68,18 @@ ifdef(`distro_redhat',`
|
|||
|
||||
/etc/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/kde/env(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/kde/shutdown(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/mail/make -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/mgetty\+sendfax/new_fax -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/netplug\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/PackageKit/events(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/PackageKit/events(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/pki/tls/certs/make-dummy-cert -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/pki/tls/misc(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/pm/power\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/pm/sleep\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
|
@ -84,32 +89,32 @@ ifdef(`distro_redhat',`
|
|||
/etc/ppp/ipv6-up\..* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/ppp/ipv6-down\..* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/profile.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/racoon/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/security/namespace.init -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/sysconfig/crond -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/init -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/libvirtd -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/netconsole -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/readonly-root -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/crond -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/init -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/libvirtd -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/netconsole -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/readonly-root -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/sysconfig/network-scripts/ifup.* gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/network-scripts/ifdown.* gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/network-scripts/net.* gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/sysconfig/network-scripts/init.* gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/vmware-tools(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/X11/xdm/GiveConsole -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/X11/xdm/TakeConsole -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/X11/xdm/Xsetup_0 -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/X11/xinit(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/pki/tls/certs/make-dummy-cert -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/pki/tls/misc(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/profile.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/xen/qemu-ifup -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/xen/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
|
|
@ -117,14 +122,19 @@ ifdef(`distro_debian',`
|
|||
/etc/mysql/debian-start -- gen_context(system_u:object_r:bin_t,s0)
|
||||
')
|
||||
|
||||
/etc/vmware-tools(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
#
|
||||
# /lib
|
||||
#
|
||||
|
||||
/lib/readahead(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib/systemd/systemd.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib/udev/[^/]* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib/udev/scsi_id -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib/upstart(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
|
||||
/lib64/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib64/udev/[^/]* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
ifdef(`distro_gentoo',`
|
||||
|
|
@ -136,8 +146,6 @@ ifdef(`distro_gentoo',`
|
|||
/lib/rcscripts/net\.modules\.d/helpers\.d/dhclient-.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib/rcscripts/net\.modules\.d/helpers\.d/udhcpc-.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
')
|
||||
/lib/readahead(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib/upstart(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
#
|
||||
# /sbin
|
||||
|
|
@ -187,25 +195,32 @@ ifdef(`distro_gentoo',`
|
|||
/usr/lib/fence(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/pgsql/test/regress/.*\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/qt.*/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/mediawiki/math/texvc.* gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/wicd/monitor\.py -- gen_context(system_u:object_r:bin_t, s0)
|
||||
/usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/ConsoleKit/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/ConsoleKit/run-session.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/courier(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/cups(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/usr/lib(64)?/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/mailman/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/mailman/mail(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/mediawiki/math/texvc.* gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/misc/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/netsaint/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/news/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/nspluginwrapper/np.* gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/portage/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/pm-utils(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/rpm/rpmd -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/rpm/rpmk -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/rpm/rpmq -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/vte/gnome-pty-helper -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
|
|
@ -238,8 +253,8 @@ ifdef(`distro_gentoo',`
|
|||
/usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||
/usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||
|
||||
/usr/share/ajaxterm/qweb.py.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/ajaxterm/ajaxterm.py.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/ajaxterm/qweb.py.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/apr-0/build/[^/]+\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/apr-0/build/libtool -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/dayplanner/dayplanner -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
|
@ -247,11 +262,11 @@ ifdef(`distro_gentoo',`
|
|||
/usr/share/denyhosts/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/denyhosts/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/gedit-2/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/gitolite/hooks/common/update -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/gitolite/hooks/common/update -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/gitolite/hooks/gitolite-admin/post-update -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
|
@ -339,7 +354,7 @@ ifdef(`distro_redhat', `
|
|||
/usr/share/texmf/web2c/mktexdir -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/texmf/web2c/mktexnam -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/texmf/web2c/mktexupd -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0)
|
||||
')
|
||||
|
||||
ifdef(`distro_suse', `
|
||||
|
|
@ -356,6 +371,7 @@ ifdef(`distro_suse', `
|
|||
|
||||
/var/ftp/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/var/lib/asterisk/agi-bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/yp/.+ -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib64/yp/.+ -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
|
|
@ -366,27 +382,3 @@ ifdef(`distro_suse', `
|
|||
ifdef(`distro_suse',`
|
||||
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
|
||||
')
|
||||
/var/lib/asterisk/agi-bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/lib64/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/lib/systemd/systemd.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/usr/lib/oracle/xe/apps(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/usr/lib(64)?/pm-utils(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/usr/lib/wicd/monitor.py -- gen_context(system_u:object_r:bin_t, s0)
|
||||
|
||||
/usr/lib(64)?/nspluginwrapper/np.* gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/usr/lib(64)?/rpm/rpmd -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/rpm/rpmq -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/rpm/rpmk -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/usr/lib(64)?/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/etc/kde/env(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/etc/kde/shutdown(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
|
|
|||
|
|
@ -179,24 +179,6 @@ interface(`corecmd_dontaudit_write_bin_dirs',`
|
|||
dontaudit $1 bin_t:dir write;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to write bin files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`corecmd_dontaudit_write_bin_files',`
|
||||
gen_require(`
|
||||
type bin_t;
|
||||
')
|
||||
|
||||
dontaudit $1 bin_t:file write;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Get the attributes of files in bin directories.
|
||||
|
|
@ -252,6 +234,24 @@ interface(`corecmd_read_bin_files',`
|
|||
read_files_pattern($1, bin_t, bin_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to write bin files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`corecmd_dontaudit_write_bin_files',`
|
||||
gen_require(`
|
||||
type bin_t;
|
||||
')
|
||||
|
||||
dontaudit $1 bin_t:file write;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read symbolic links in bin directories.
|
||||
|
|
@ -1049,7 +1049,6 @@ interface(`corecmd_manage_all_executables',`
|
|||
type bin_t;
|
||||
')
|
||||
|
||||
manage_dirs_pattern($1, bin_t, exec_type)
|
||||
manage_files_pattern($1, bin_t, exec_type)
|
||||
manage_lnk_files_pattern($1, bin_t, bin_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
policy_module(corecommands, 1.13.2)
|
||||
policy_module(corecommands, 1.13.3)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
|
|
|||
Loading…
Reference in New Issue