44bedbfad0
On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
27 lines
1.2 KiB
Plaintext
27 lines
1.2 KiB
Plaintext
/bin/kmod -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
|
|
/etc/modules\.conf.* -- gen_context(system_u:object_r:modules_conf_t,s0)
|
|
/etc/modprobe\.conf.* -- gen_context(system_u:object_r:modules_conf_t,s0)
|
|
/etc/modprobe\.d(/.*)? gen_context(system_u:object_r:modules_conf_t,s0)
|
|
|
|
ifdef(`distro_gentoo',`
|
|
# gentoo init scripts still manage this file
|
|
# even if devfs is off
|
|
/etc/modprobe.devfs.* -- gen_context(system_u:object_r:modules_conf_t,s0)
|
|
')
|
|
|
|
/lib/modules/[^/]+/modules\..+ -- gen_context(system_u:object_r:modules_dep_t,s0)
|
|
|
|
/lib/modules/modprobe\.conf -- gen_context(system_u:object_r:modules_conf_t,s0)
|
|
|
|
/sbin/depmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
/sbin/generate-modprobe\.conf -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
/sbin/insmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
/sbin/modprobe.* -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
/sbin/modules-update -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
/sbin/rmmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
/sbin/update-modules -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
|
|
/usr/bin/kmod -- gen_context(system_u:object_r:kmod_exec_t,s0)
|
|
/var/run/tmpfiles.d(/.*)? gen_context(system_u:object_r:kmod_var_run_t,s0)
|