Skip to contentSkip to conversation

userdom_manage_tmp_role

PATCH New Dominick Grift 2 participants 2 messages Jul 8, 2010 – Jul 9, 2010

lore
Share & tools
lore

Dominick Grift

author
#0 lore raw

PATCH 4/7 userdom_manage_tmp_role

Allow callers of the userdom_manage_tmp_role template full control over userdom_user_tmp_content.

Signed-off-by Dominick Grift <[email protected]>

---
:100644 100644 162d103... 7aec719... M policy/modules/system/userdomain.if

 policy/modules/system/userdomain.if |    9 ++++++++-
 1 files changed, 8 insertions(+), 1 deletions(-)
policy/modules/system/userdomain.if +8 -1
index 162d103..7aec719 100644
@@ -292,11 +292,13 @@ interface(`userdom_manage_home_role',`
 #
 interface(`userdom_manage_tmp_role',`
 	gen_require(`
+		attribute user_tmp_type;
 		type user_tmp_t;
 	')
 
-	role $1 types user_tmp_t;
+	role $1 types user_tmp_type;
 
+	# Redundant: in userdomain.te files_policy_member_tmp(userdomain, user_tmp_t)
 	files_poly_member_tmp($2, user_tmp_t)
 
 	manage_dirs_pattern($2, user_tmp_t, user_tmp_t)

@@ -304,6 +306,11 @@ interface(`userdom_manage_tmp_role',`
 	manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 	manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 	manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
+	relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
+	relabel_files_pattern($2, user_tmp_type, user_tmp_type)
+	relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
+	relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
+	relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 	files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 ')
Signature · 9 lines
1.7.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100708/5405617f/attachment.bin
#1 lore raw

PATCH 4/7 userdom_manage_tmp_role

Quoted 13 lines · Dominick Grift

Allow callers of the userdom_manage_tmp_role template full control over userdom_user_tmp_content.

Signed-off-by Dominick Grift<[email protected]>

---
:100644 100644 162d103... 7aec719... M policy/modules/system/userdomain.if

  policy/modules/system/userdomain.if |    9 ++++++++-
  1 files changed, 8 insertions(+), 1 deletions(-)
policy/modules/system/userdomain.if +0 -0
index 162d103..7aec719 100644

policy/modules/system/userdomain.if interface(`userdom_manage_home_role',` · line 299

Quoted 9 lines
policy/modules/system/userdomain.if +2 -1
@@ -292,11 +292,13 @@ interface(`userdom_manage_home_role',`
  #
  interface(`userdom_manage_tmp_role',`
  	gen_require(`
+		attribute user_tmp_type;
  		type user_tmp_t;
  	')
 
-	role $1 types user_tmp_t;
+	role $1 types user_tmp_type;

This is wrong.

Quoted 5 lines
policy/modules/system/userdomain.if +1 -0
+	# Redundant: in userdomain.te files_policy_member_tmp(userdomain, user_tmp_t)
  	files_poly_member_tmp($2, user_tmp_t)
 
  	manage_dirs_pattern($2, user_tmp_t, user_tmp_t)

policy/modules/system/userdomain.if interface(`userdom_manage_tmp_role',` · line 315

Quoted 10 lines
policy/modules/system/userdomain.if +5 -0
@@ -304,6 +306,11 @@ interface(`userdom_manage_tmp_role',`
  	manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
  	manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
  	manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
+	relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
+	relabel_files_pattern($2, user_tmp_type, user_tmp_type)
+	relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
+	relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
+	relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
  	files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
  ')

We can't make this change (see comments for patch 1)

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com