nnd
/
selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add can_exec

This commit is contained in:
Chris PeBenito 2005-06-08 13:41:05 +00:00
parent 763c441e3b
commit a7197232e8
2 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
refpolicy/policy/modules/system/clock.if
View File

@ -15,10 +15,7 @@
define(`clock_transition',`
requires_block_template(`$0'_depend)
allow $1 hwclock_exec_t:file { getattr read execute };
allow $1 hwclock_t:process transition;
type_transition $1 hwclock_exec_t:process hwclock_t;
dontaudit $1 hwclock_t:process { noatsecure siginh rlimitinh };
domain_auto_trans($1,hwclock_exec_t,hwclock_t)
allow $1 hwclock_t:fd use;
allow hwclock_t $1:fd use;
@ -81,7 +78,7 @@ define(`clock_transition_add_role_use_terminal_depend',`
define(`clock_execute',`
requires_block_template(`$0'_depend)
allow $1 hwclock_exec_t:file { getattr read execute execute_no_trans };
can_exec($1,hwclock_exec_t)
')
define(`clock_execute_depend',`
@ -104,14 +101,14 @@ define(`clock_execute_depend',`
define(`clock_modify_drift_records',`
requires_block_template(`$0'_depend)
allow $1 adjtime_t:file { getattr read write ioctl lock append };
allow $1 adjtime_t:file rw_file_perms;
files_read_general_system_config_directory($1)
')
define(`clock_modify_drift_records_depend',`
type adjtime_t;
class file { getattr read write ioctl lock append };
class file rw_file_perms;
')
## </module>

1
refpolicy/policy/support/support_macros
View File

@ -25,3 +25,4 @@ define(`context_template',`ifdef(`enable_mls',`$1:$2',`$1')') dnl
#
define(`user_mls',`ifdef(`enable_mls',`level $1 range $2')') dnl
define(`can_exec',`allow $1 $2:file { getattr read execute execute_no_trans };')