Changes to the user domain policy module
PATCH 1/1 Changes to the user domain policy module
Content that (at least) common users need to be able to relabel and create with a type transition
Signed-off-by Dominick Grift <[email protected]>
policy/modules/system/userdomain.if +23 -0
@@ -575,6 +575,7 @@ ') optional_policy(` + alsa_home_filetrans_alsa_home($1_t, file, ".asoundrc") alsa_manage_home_files($1_t) alsa_read_rw_config($1_t) alsa_relabel_home_files($1_t)
@@ -629,7 +630,18 @@ ') optional_policy(` + kerberos_manage_krb5_home_files($1_t) + kerberos_relabel_krb5_home_files($1_t) + kerberos_home_filetrans_krb5_home($1_t, file, ".k5login") + ') + + optional_policy(` locate_read_lib_files($1_t) + ') + + optional_policy(` + mpd_manage_user_data_content($1_t) + mpd_relabel_user_data_content($1_t) ') # for running depmod as part of the kernel packaging process
@@ -645,11 +657,16 @@ tunable_policy(`allow_user_mysql_connect',` mysql_stream_connect($1_t) ') + + mysql_manage_mysqld_home_files($1_t) + mysql_relabel_mysqld_home_files($1_t) + mysql_home_filetrans_mysqld_home($1_t, file, ".my.cnf") ') optional_policy(` oident_manage_user_content($1_t) oident_relabel_user_content($1_t) + oident_home_filetrans_oidentd_home($1_t, file, ".oidentd.conf") ') optional_policy(`
@@ -670,6 +687,12 @@ ') optional_policy(` + ppp_manage_home_files($1_t) + ppp_relabel_home_files($1_t) + ppp_home_filetrans_ppp_home($1_t, file, ".ppprc") + ') + + optional_policy(` resmgr_stream_connect($1_t) ')
PATCH 1/1 Changes to the user domain policy module
Quoted 54 lines · Dominick Grift
Content that (at least) common users need to be able to relabel and create with a type transition
Signed-off-by Dominick Grift <[email protected]>policy/modules/system/userdomain.if +17
-0@@ -575,6 +575,7 @@ ') optional_policy(` + alsa_home_filetrans_alsa_home($1_t, file, ".asoundrc") alsa_manage_home_files($1_t) alsa_read_rw_config($1_t) alsa_relabel_home_files($1_t)@@ -629,7 +630,18 @@ ') optional_policy(` + kerberos_manage_krb5_home_files($1_t) + kerberos_relabel_krb5_home_files($1_t) + kerberos_home_filetrans_krb5_home($1_t, file, ".k5login") + ') + + optional_policy(` locate_read_lib_files($1_t) + ') + + optional_policy(` + mpd_manage_user_data_content($1_t) + mpd_relabel_user_data_content($1_t) ') # for running depmod as part of the kernel packaging process@@ -645,11 +657,16 @@ tunable_policy(`allow_user_mysql_connect',` mysql_stream_connect($1_t) ') + + mysql_manage_mysqld_home_files($1_t) + mysql_relabel_mysqld_home_files($1_t) + mysql_home_filetrans_mysqld_home($1_t, file, ".my.cnf") ') optional_policy(` oident_manage_user_content($1_t) oident_relabel_user_content($1_t) + oident_home_filetrans_oidentd_home($1_t, file, ".oidentd.conf") ') optional_policy(`
policy/modules/system/userdomain.if line 695
Quoted 9 lines
policy/modules/system/userdomain.if +6
-0@@ -670,6 +687,12 @@ ') optional_policy(` + ppp_manage_home_files($1_t) + ppp_relabel_home_files($1_t) + ppp_home_filetrans_ppp_home($1_t, file, ".ppprc") + ') + + optional_policy(`
I don't have a problem with the transitions, but I have to think about if it makes sense to abstract away the names inside the interface (i.e. hardcode them) since those details likely belong in the respective modules.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Changes to the user domain policy module
Quoted 57 lines · Christopher J. PeBenito
Quoted 56 lines · Dominick Grift
Content that (at least) common users need to be able to relabel and create with a type transition
Signed-off-by Dominick Grift <[email protected]>policy/modules/system/userdomain.if +17
-0@@ -575,6 +575,7 @@ ') optional_policy(` + alsa_home_filetrans_alsa_home($1_t, file, ".asoundrc") alsa_manage_home_files($1_t) alsa_read_rw_config($1_t) alsa_relabel_home_files($1_t)@@ -629,7 +630,18 @@ ') optional_policy(` + kerberos_manage_krb5_home_files($1_t) + kerberos_relabel_krb5_home_files($1_t) + kerberos_home_filetrans_krb5_home($1_t, file, ".k5login") + ') + + optional_policy(` locate_read_lib_files($1_t) + ') + + optional_policy(` + mpd_manage_user_data_content($1_t) + mpd_relabel_user_data_content($1_t) ') # for running depmod as part of the kernel packaging process@@ -645,11 +657,16 @@ tunable_policy(`allow_user_mysql_connect',` mysql_stream_connect($1_t) ') + + mysql_manage_mysqld_home_files($1_t) + mysql_relabel_mysqld_home_files($1_t) + mysql_home_filetrans_mysqld_home($1_t, file, ".my.cnf") ') optional_policy(` oident_manage_user_content($1_t) oident_relabel_user_content($1_t) + oident_home_filetrans_oidentd_home($1_t, file, ".oidentd.conf") ') optional_policy(`@@ -670,6 +687,12 @@ ')
Quoted 10 lines
policy/modules/system/userdomain.if line 695
Quoted 7 lines
policy/modules/system/userdomain.if +6
-0optional_policy(` + ppp_manage_home_files($1_t) + ppp_relabel_home_files($1_t) + ppp_home_filetrans_ppp_home($1_t, file, ".ppprc") + ') + + optional_policy(`I don't have a problem with the transitions, but I have to think about if it makes sense to abstract away the names inside the interface (i.e. hardcode them) since those details likely belong in the respective modules.
What is the use of that? that only takes away flexibility.
PATCH 1/1 Changes to the user domain policy module
In reply to Dominick GriftHave you thought about this? I really prefer this It is much more flexible and will keep things cleaner
I have used this throughout the policy already can changing it will be much extra work
Can this be merged?
Quoted 65 lines · Dominick Grift
Content that (at least) common users need to be able to relabel and create with a type transition
Signed-off-by Dominick Grift <[email protected]>policy/modules/system/userdomain.if +23
-0@@ -575,6 +575,7 @@ ') optional_policy(` + alsa_home_filetrans_alsa_home($1_t, file, ".asoundrc") alsa_manage_home_files($1_t) alsa_read_rw_config($1_t) alsa_relabel_home_files($1_t)@@ -629,7 +630,18 @@ ') optional_policy(` + kerberos_manage_krb5_home_files($1_t) + kerberos_relabel_krb5_home_files($1_t) + kerberos_home_filetrans_krb5_home($1_t, file, ".k5login") + ') + + optional_policy(` locate_read_lib_files($1_t) + ') + + optional_policy(` + mpd_manage_user_data_content($1_t) + mpd_relabel_user_data_content($1_t) ') # for running depmod as part of the kernel packaging process@@ -645,11 +657,16 @@ tunable_policy(`allow_user_mysql_connect',` mysql_stream_connect($1_t) ') + + mysql_manage_mysqld_home_files($1_t) + mysql_relabel_mysqld_home_files($1_t) + mysql_home_filetrans_mysqld_home($1_t, file, ".my.cnf") ') optional_policy(` oident_manage_user_content($1_t) oident_relabel_user_content($1_t) + oident_home_filetrans_oidentd_home($1_t, file, ".oidentd.conf") ') optional_policy(`@@ -670,6 +687,12 @@ ') optional_policy(` + ppp_manage_home_files($1_t) + ppp_relabel_home_files($1_t) + ppp_home_filetrans_ppp_home($1_t, file, ".ppprc") + ') + + optional_policy(` resmgr_stream_connect($1_t) ')
PATCH 1/1 Changes to the user domain policy module
In reply to Dominick GriftQuoted 2 lines · Dominick Grift
Content that (at least) common users need to be able to relabel and create with a type transition
Merged.
Quoted 61 lines
Signed-off-by Dominick Grift <[email protected]>policy/modules/system/userdomain.if +23
-0@@ -575,6 +575,7 @@ ') optional_policy(` + alsa_home_filetrans_alsa_home($1_t, file, ".asoundrc") alsa_manage_home_files($1_t) alsa_read_rw_config($1_t) alsa_relabel_home_files($1_t)@@ -629,7 +630,18 @@ ') optional_policy(` + kerberos_manage_krb5_home_files($1_t) + kerberos_relabel_krb5_home_files($1_t) + kerberos_home_filetrans_krb5_home($1_t, file, ".k5login") + ') + + optional_policy(` locate_read_lib_files($1_t) + ') + + optional_policy(` + mpd_manage_user_data_content($1_t) + mpd_relabel_user_data_content($1_t) ') # for running depmod as part of the kernel packaging process@@ -645,11 +657,16 @@ tunable_policy(`allow_user_mysql_connect',` mysql_stream_connect($1_t) ') + + mysql_manage_mysqld_home_files($1_t) + mysql_relabel_mysqld_home_files($1_t) + mysql_home_filetrans_mysqld_home($1_t, file, ".my.cnf") ') optional_policy(` oident_manage_user_content($1_t) oident_relabel_user_content($1_t) + oident_home_filetrans_oidentd_home($1_t, file, ".oidentd.conf") ') optional_policy(`@@ -670,6 +687,12 @@ ') optional_policy(` + ppp_manage_home_files($1_t) + ppp_relabel_home_files($1_t) + ppp_home_filetrans_ppp_home($1_t, file, ".ppprc") + ') + + optional_policy(` resmgr_stream_connect($1_t) ')
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com