kernel: domain { allowed to transition, allowed access, to not audit }.
PATCH 1/1 kernel: domain { allowed to transition, allowed access, to not audit }.
Signed-off-by Dominick Grift <[email protected]>
---
:100644 100644 314731b... ef1d72a... M policy/modules/kernel/corecommands.if
:100644 100644 f13a505... cac0c64... M policy/modules/kernel/devices.if
:100644 100644 deb03ea... 41f36ed... M policy/modules/kernel/domain.if
:100644 100644 28cb589... 8d3dfad... M policy/modules/kernel/files.if
:100644 100644 9b79f4a... e3e17ba... M policy/modules/kernel/filesystem.if
:100644 100644 547fcf4... 5bb8b30... M policy/modules/kernel/kernel.if
:100644 100644 677f82a... f8b357c... M policy/modules/kernel/selinux.if
:100644 100644 7b8a19c... fac255a... M policy/modules/kernel/storage.if
:100644 100644 f623b72... 85655a4... M policy/modules/kernel/terminal.if
policy/modules/kernel/corecommands.if | 18 +++--- policy/modules/kernel/devices.if | 64 ++++++++++++------------ policy/modules/kernel/domain.if | 38 +++++++------- policy/modules/kernel/files.if | 56 ++++++++++---------- policy/modules/kernel/filesystem.if | 34 ++++++------ policy/modules/kernel/kernel.if | 90 ++++++++++++++++---------------- policy/modules/kernel/selinux.if | 20 ++++---- policy/modules/kernel/storage.if | 10 ++-- policy/modules/kernel/terminal.if | 38 +++++++------- 9 files changed, 184 insertions(+), 184 deletions(-)
policy/modules/kernel/corecommands.if +9 -9
@@ -131,7 +131,7 @@ interface(`corecmd_search_bin',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -167,7 +167,7 @@ interface(`corecmd_list_bin',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -410,7 +410,7 @@ interface(`corecmd_mmap_bin_files',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -453,7 +453,7 @@ interface(`corecmd_bin_spec_domtrans',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -713,7 +713,7 @@ interface(`corecmd_mmap_sbin_files',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -754,7 +754,7 @@ interface(`corecmd_sbin_domtrans',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -861,7 +861,7 @@ interface(`corecmd_exec_ls',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -896,7 +896,7 @@ interface(`corecmd_shell_spec_domtrans',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -1001,7 +1001,7 @@ interface(`corecmd_exec_all_executables',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to not audit. ## </summary> ## </param> #
policy/modules/kernel/devices.if +32 -32
256 lines not on this page · raw message
policy/modules/kernel/domain.if +19 -19
@@ -402,7 +402,7 @@ interface(`domain_use_interactive_fds',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -727,7 +727,7 @@ interface(`domain_ptrace_all_domains',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -755,7 +755,7 @@ interface(`domain_dontaudit_ptrace_all_domains',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -774,7 +774,7 @@ interface(`domain_dontaudit_ptrace_confined_domains',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -799,7 +799,7 @@ interface(`domain_dontaudit_read_all_domains_state',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -836,7 +836,7 @@ interface(`domain_getsession_all_domains',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -949,7 +949,7 @@ interface(`domain_dontaudit_getattr_all_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -968,7 +968,7 @@ interface(`domain_dontaudit_getattr_all_tcp_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -987,7 +987,7 @@ interface(`domain_dontaudit_getattr_all_udp_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1006,7 +1006,7 @@ interface(`domain_dontaudit_rw_all_udp_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1025,7 +1025,7 @@ interface(`domain_dontaudit_getattr_all_key_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1044,7 +1044,7 @@ interface(`domain_dontaudit_getattr_all_packet_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1063,7 +1063,7 @@ interface(`domain_dontaudit_getattr_all_raw_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1082,7 +1082,7 @@ interface(`domain_dontaudit_rw_all_key_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1120,7 +1120,7 @@ interface(`domain_getattr_all_stream_sockets',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1168,7 +1168,7 @@ interface(`domain_getattr_all_pipes',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1187,7 +1187,7 @@ interface(`domain_dontaudit_getattr_all_pipes',` ## </summary> ## <param name="type"> ## <summary> -## Type of subject to be allowed this. +## Domain allowed access. ## </summary> ## </param> #
@@ -1341,7 +1341,7 @@ interface(`domain_mmap_all_entry_files',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -1368,7 +1368,7 @@ interface(`domain_entry_file_spec_domtrans',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed to mmap low memory. +## Domain allowed access. ## </summary> ## </param> #
policy/modules/kernel/files.if +28 -28
224 lines not on this page · raw message
policy/modules/kernel/filesystem.if +17 -17
@@ -330,7 +330,7 @@ interface(`fs_rw_anon_inodefs_files',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1084,7 +1084,7 @@ interface(`fs_read_noxattr_fs_files',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1204,7 +1204,7 @@ interface(`fs_append_cifs_files',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> ## <rolecap/>
@@ -1343,7 +1343,7 @@ interface(`fs_manage_cifs_dirs',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1478,7 +1478,7 @@ interface(`fs_manage_cifs_named_sockets',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -1999,7 +1999,7 @@ interface(`fs_list_inotifyfs',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -2412,7 +2412,7 @@ interface(`fs_append_nfs_files',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> ## <rolecap/>
@@ -2469,7 +2469,7 @@ interface(`fs_read_nfs_symlinks',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -2918,7 +2918,7 @@ interface(`fs_manage_nfs_named_sockets',` ## </desc> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain allowed to transition. ## </summary> ## </param> ## <param name="target_domain">
@@ -3197,7 +3197,7 @@ interface(`fs_search_ramfs',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -3234,7 +3234,7 @@ interface(`fs_manage_ramfs_dirs',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -3252,7 +3252,7 @@ interface(`fs_dontaudit_read_ramfs_files',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -3308,7 +3308,7 @@ interface(`fs_write_ramfs_pipes',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -3677,7 +3677,7 @@ interface(`fs_getattr_tmpfs_dirs',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -3947,7 +3947,7 @@ interface(`fs_rw_tmpfs_chr_files',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -4341,7 +4341,7 @@ interface(`fs_dontaudit_getattr_all_fs',` ## </summary> ## <param name="domain"> ## <summary> -## The type of the domain getting quotas. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -4360,7 +4360,7 @@ interface(`fs_get_all_fs_quotas',` ## </summary> ## <param name="domain"> ## <summary> -## The type of the domain setting quotas. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
policy/modules/kernel/kernel.if +45 -45
360 lines not on this page · raw message
policy/modules/kernel/selinux.if +10 -10
@@ -213,7 +213,7 @@ interface(`selinux_dontaudit_read_fs',` ## </summary> ## <param name="domain"> ## <summary> -## The process type to allow to get the enforcing mode. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -244,7 +244,7 @@ interface(`selinux_get_enforce_mode',` ## </desc> ## <param name="domain"> ## <summary> -## The process type to allow to set the enforcement mode. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -276,7 +276,7 @@ interface(`selinux_set_enforce_mode',` ## </summary> ## <param name="domain"> ## <summary> -## The process type that will load the policy. +## Domain allowed access. ## </summary> ## </param> #
@@ -323,7 +323,7 @@ interface(`selinux_load_policy',` ## </desc> ## <param name="domain"> ## <summary> -## The process type allowed to set the Boolean. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -350,7 +350,7 @@ interface(`selinux_set_boolean',` ## </desc> ## <param name="domain"> ## <summary> -## The process type allowed to set the Boolean. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -391,7 +391,7 @@ interface(`selinux_set_generic_booleans',` ## </desc> ## <param name="domain"> ## <summary> -## The process type allowed to set the Boolean. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -433,7 +433,7 @@ interface(`selinux_set_all_booleans',` ## </desc> ## <param name="domain"> ## <summary> -## The process type to allow to set security parameters. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -457,7 +457,7 @@ interface(`selinux_set_parameters',` ## </summary> ## <param name="domain"> ## <summary> -## The process type permitted to validate contexts. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -499,7 +499,7 @@ interface(`selinux_dontaudit_validate_context',` ## </summary> ## <param name="domain"> ## <summary> -## The process type allowed to compute an access vector. +## Domain allowed access. ## </summary> ## </param> ## <rolecap/>
@@ -591,7 +591,7 @@ interface(`selinux_compute_relabel_context',` ## </summary> ## <param name="domain"> ## <summary> -## The process type allowed to compute user contexts. +## Domain allowed access. ## </summary> ## </param> #
policy/modules/kernel/storage.if +5 -5
@@ -351,7 +351,7 @@ interface(`storage_getattr_fuse_dev',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit. +## Domain allowed access. ## </summary> ## </param> #
@@ -538,7 +538,7 @@ interface(`storage_getattr_removable_dev',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -557,7 +557,7 @@ interface(`storage_dontaudit_getattr_removable_dev',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -577,7 +577,7 @@ interface(`storage_dontaudit_read_removable_device',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -616,7 +616,7 @@ interface(`storage_setattr_removable_dev',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
policy/modules/kernel/terminal.if +19 -19
@@ -245,7 +245,7 @@ interface(`term_read_console',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> ## <rolecap/>
@@ -285,7 +285,7 @@ interface(`term_use_console',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -382,7 +382,7 @@ interface(`term_getattr_pty_fs',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -420,7 +420,7 @@ interface(`term_search_ptys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -479,7 +479,7 @@ interface(`term_dontaudit_list_ptys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -498,7 +498,7 @@ interface(`term_dontaudit_manage_pty_dirs',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -557,7 +557,7 @@ interface(`term_setattr_generic_ptys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -600,7 +600,7 @@ interface(`term_use_generic_ptys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -676,7 +676,7 @@ interface(`term_dontaudit_getattr_ptmx',` ## </summary> ## <param name="domain"> ## <summary> -## The type of the process to allow access. +## Domain allowed access. ## </summary> ## </param> #
@@ -696,7 +696,7 @@ interface(`term_use_ptmx',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -739,7 +739,7 @@ interface(`term_getattr_all_ptys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -975,7 +975,7 @@ interface(`term_use_all_user_ptys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -1028,7 +1028,7 @@ interface(`term_getattr_unallocated_ttys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1068,7 +1068,7 @@ interface(`term_setattr_unallocated_ttys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1087,7 +1087,7 @@ interface(`term_dontaudit_setattr_unallocated_ttys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1206,7 +1206,7 @@ interface(`term_use_unallocated_ttys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit +## Domain to not audit. ## </summary> ## </param> #
@@ -1245,7 +1245,7 @@ interface(`term_getattr_all_ttys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1343,7 +1343,7 @@ interface(`term_use_all_ttys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
@@ -1380,7 +1380,7 @@ interface(`term_getattr_all_user_ttys',` ## </summary> ## <param name="domain"> ## <summary> -## Domain allowed access. +## Domain to not audit. ## </summary> ## </param> #
Signature · 9 lines
1.7.2 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100803/1e1812df/attachment-0001.bin