userdom_manage_tmpfs_role
PATCH 6/7 userdom_manage_tmpfs_role
Allow user domain for which userdom_manage_tmpfs_role template is called to manage and relabel all userdom_user_tmpfs_content. Fix userdom_user_tmp_content template (forgot some stuff)
TODO:
Remove all rules that implicitly allow login user domains to manage/relabel user tmpfs files.
Signed-off-by Dominick Grift <[email protected]>
---
:100644 100644 728d1fa... d0f53d5... M policy/modules/system/userdomain.if
policy/modules/system/userdomain.if | 30 ++++++++++++++++++------------ 1 files changed, 18 insertions(+), 12 deletions(-)
policy/modules/system/userdomain.if +17 -11
@@ -301,11 +301,11 @@ interface(`userdom_manage_tmp_role',` # Redundant: in userdomain.te files_policy_member_tmp(userdomain, user_tmp_t) files_poly_member_tmp($2, user_tmp_t) - manage_dirs_pattern($2, user_tmp_t, user_tmp_t) - manage_files_pattern($2, user_tmp_t, user_tmp_t) - manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t) - manage_sock_files_pattern($2, user_tmp_t, user_tmp_t) - manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t) + manage_dirs_pattern($2, user_tmp_type, user_tmp_type) + manage_files_pattern($2, user_tmp_type, user_tmp_type) + manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type) + manage_sock_files_pattern($2, user_tmp_type, user_tmp_type) + manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type) relabel_dirs_pattern($2, user_tmp_type, user_tmp_type) relabel_files_pattern($2, user_tmp_type, user_tmp_type) relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
@@ -362,16 +362,22 @@ interface(`userdom_exec_user_tmp_files',` # interface(`userdom_manage_tmpfs_role',` gen_require(` + attribute user_tmpfs_type; type user_tmpfs_t; ') - role $1 types user_tmpfs_t; + role $1 types user_tmpfs_type; - manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t) - manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t) - manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t) - manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t) - manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t) + manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type) + manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type) fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file }) ')
Signature · 9 lines
1.7.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100708/f3e23512/attachment.bin
PATCH 6/7 userdom_manage_tmpfs_role
Quoted 4 lines · Dominick Grift
Allow user domain for which
userdom_manage_tmpfs_roletemplate is called to manage and relabel alluserdom_user_tmpfs_content. Fixuserdom_user_tmp_contenttemplate (forgot some stuff)
TODO:
Remove all rules that implicitly allow login user domains to manage/relabel user tmpfs files.
We can't make this change (see patch 1 comments).
Quoted 63 lines
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 728d1fa... d0f53d5... M policy/modules/system/userdomain.ifpolicy/modules/system/userdomain.if | 30 ++++++++++++++++++------------ 1 files changed, 18 insertions(+), 12 deletions(-)policy/modules/system/userdomain.if +17
-11@@ -301,11 +301,11 @@ interface(`userdom_manage_tmp_role',` # Redundant: in userdomain.te files_policy_member_tmp(userdomain, user_tmp_t) files_poly_member_tmp($2, user_tmp_t) - manage_dirs_pattern($2, user_tmp_t, user_tmp_t) - manage_files_pattern($2, user_tmp_t, user_tmp_t) - manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t) - manage_sock_files_pattern($2, user_tmp_t, user_tmp_t) - manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t) + manage_dirs_pattern($2, user_tmp_type, user_tmp_type) + manage_files_pattern($2, user_tmp_type, user_tmp_type) + manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type) + manage_sock_files_pattern($2, user_tmp_type, user_tmp_type) + manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type) relabel_dirs_pattern($2, user_tmp_type, user_tmp_type) relabel_files_pattern($2, user_tmp_type, user_tmp_type) relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)@@ -362,16 +362,22 @@ interface(`userdom_exec_user_tmp_files',` # interface(`userdom_manage_tmpfs_role',` gen_require(` + attribute user_tmpfs_type; type user_tmpfs_t; ') - role $1 types user_tmpfs_t; + role $1 types user_tmpfs_type; - manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t) - manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t) - manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t) - manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t) - manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t) + manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type) + manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type) + relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type) fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file }) ')_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com