Compare commits
No commits in common. 'c9' and 'i10cs' have entirely different histories.
@ -1,2 +1,2 @@
|
||||
SOURCES/container-selinux.tgz
|
||||
SOURCES/selinux-policy-0113b35.tar.gz
|
||||
SOURCES/selinux-policy-14ba8a3.tar.gz
|
||||
|
||||
@ -1,2 +1,2 @@
|
||||
484f3f9e443621ccd65c42d11229424a36bf58b9 SOURCES/container-selinux.tgz
|
||||
430470dababaa6af18348fc2f8f0fe2108b50e05 SOURCES/selinux-policy-0113b35.tar.gz
|
||||
4e860788a4fe3bb771ba2f0d0f7a4b934d1d7eee SOURCES/container-selinux.tgz
|
||||
e9156e9d0c01a68682e7a0f87772d6d3bba80a15 SOURCES/selinux-policy-14ba8a3.tar.gz
|
||||
|
||||
@ -1,248 +0,0 @@
|
||||
# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
|
||||
#
|
||||
allow_execmem = false
|
||||
|
||||
# Allow making a modified private filemapping executable (text relocation).
|
||||
#
|
||||
allow_execmod = false
|
||||
|
||||
# Allow making the stack executable via mprotect.Also requires allow_execmem.
|
||||
#
|
||||
allow_execstack = true
|
||||
|
||||
# Allow ftpd to read cifs directories.
|
||||
#
|
||||
allow_ftpd_use_cifs = false
|
||||
|
||||
# Allow ftpd to read nfs directories.
|
||||
#
|
||||
allow_ftpd_use_nfs = false
|
||||
|
||||
# Allow ftp servers to modify public filesused for public file transfer services.
|
||||
#
|
||||
allow_ftpd_anon_write = false
|
||||
|
||||
# Allow gssd to read temp directory.
|
||||
#
|
||||
allow_gssd_read_tmp = true
|
||||
|
||||
# Allow Apache to modify public filesused for public file transfer services.
|
||||
#
|
||||
allow_httpd_anon_write = false
|
||||
|
||||
# Allow Apache to use mod_auth_pam module
|
||||
#
|
||||
allow_httpd_mod_auth_pam = false
|
||||
|
||||
# Allow system to run with kerberos
|
||||
#
|
||||
allow_kerberos = true
|
||||
|
||||
# Allow rsync to modify public filesused for public file transfer services.
|
||||
#
|
||||
allow_rsync_anon_write = false
|
||||
|
||||
# Allow sasl to read shadow
|
||||
#
|
||||
allow_saslauthd_read_shadow = false
|
||||
|
||||
# Allow samba to modify public filesused for public file transfer services.
|
||||
#
|
||||
allow_smbd_anon_write = false
|
||||
|
||||
# Allow system to run with NIS
|
||||
#
|
||||
allow_ypbind = false
|
||||
|
||||
# Allow zebra to write it own configuration files
|
||||
#
|
||||
allow_zebra_write_config = false
|
||||
|
||||
# Enable extra rules in the cron domainto support fcron.
|
||||
#
|
||||
fcron_crond = false
|
||||
|
||||
#
|
||||
# allow httpd to connect to mysql/posgresql
|
||||
httpd_can_network_connect_db = false
|
||||
|
||||
#
|
||||
# allow httpd to send dbus messages to avahi
|
||||
httpd_dbus_avahi = true
|
||||
|
||||
#
|
||||
# allow httpd to network relay
|
||||
httpd_can_network_relay = false
|
||||
|
||||
# Allow httpd to use built in scripting (usually php)
|
||||
#
|
||||
httpd_builtin_scripting = true
|
||||
|
||||
# Allow http daemon to tcp connect
|
||||
#
|
||||
httpd_can_network_connect = false
|
||||
|
||||
# Allow httpd cgi support
|
||||
#
|
||||
httpd_enable_cgi = true
|
||||
|
||||
# Allow httpd to act as a FTP server bylistening on the ftp port.
|
||||
#
|
||||
httpd_enable_ftp_server = false
|
||||
|
||||
# Allow httpd to read home directories
|
||||
#
|
||||
httpd_enable_homedirs = false
|
||||
|
||||
# Run SSI execs in system CGI script domain.
|
||||
#
|
||||
httpd_ssi_exec = false
|
||||
|
||||
# Allow http daemon to communicate with the TTY
|
||||
#
|
||||
httpd_tty_comm = false
|
||||
|
||||
# Run CGI in the main httpd domain
|
||||
#
|
||||
httpd_unified = false
|
||||
|
||||
# Allow BIND to write the master zone files.Generally this is used for dynamic DNS.
|
||||
#
|
||||
named_write_master_zones = false
|
||||
|
||||
# Allow nfs to be exported read/write.
|
||||
#
|
||||
nfs_export_all_rw = true
|
||||
|
||||
# Allow nfs to be exported read only
|
||||
#
|
||||
nfs_export_all_ro = true
|
||||
|
||||
# Allow pppd to load kernel modules for certain modems
|
||||
#
|
||||
pppd_can_insmod = false
|
||||
|
||||
# Allow reading of default_t files.
|
||||
#
|
||||
read_default_t = false
|
||||
|
||||
# Allow samba to export user home directories.
|
||||
#
|
||||
samba_enable_home_dirs = false
|
||||
|
||||
# Allow squid to connect to all ports, not justHTTP, FTP, and Gopher ports.
|
||||
#
|
||||
squid_connect_any = false
|
||||
|
||||
# Support NFS home directories
|
||||
#
|
||||
use_nfs_home_dirs = true
|
||||
|
||||
# Support SAMBA home directories
|
||||
#
|
||||
use_samba_home_dirs = false
|
||||
|
||||
# Control users use of ping and traceroute
|
||||
#
|
||||
user_ping = false
|
||||
|
||||
# allow host key based authentication
|
||||
#
|
||||
allow_ssh_keysign = false
|
||||
|
||||
# Allow pppd to be run for a regular user
|
||||
#
|
||||
pppd_for_user = false
|
||||
|
||||
# Allow applications to read untrusted contentIf this is disallowed, Internet content hasto be manually relabeled for read access to be granted
|
||||
#
|
||||
read_untrusted_content = false
|
||||
|
||||
# Allow spamd to write to users homedirs
|
||||
#
|
||||
spamd_enable_home_dirs = false
|
||||
|
||||
# Allow regular users direct mouse access
|
||||
#
|
||||
user_direct_mouse = false
|
||||
|
||||
# Allow users to read system messages.
|
||||
#
|
||||
user_dmesg = false
|
||||
|
||||
# Allow user to r/w files on filesystemsthat do not have extended attributes (FAT, CDROM, FLOPPY)
|
||||
#
|
||||
user_rw_noexattrfile = false
|
||||
|
||||
# Allow users to run TCP servers (bind to ports and accept connection fromthe same domain and outside users) disabling this forces FTP passive modeand may change other protocols.
|
||||
#
|
||||
user_tcp_server = false
|
||||
|
||||
# Allow w to display everyone
|
||||
#
|
||||
user_ttyfile_stat = false
|
||||
|
||||
# Allow applications to write untrusted contentIf this is disallowed, no Internet contentwill be stored.
|
||||
#
|
||||
write_untrusted_content = false
|
||||
|
||||
# Allow all domains to talk to ttys
|
||||
#
|
||||
allow_daemons_use_tty = false
|
||||
|
||||
# Allow login domains to polyinstatiate directories
|
||||
#
|
||||
allow_polyinstantiation = false
|
||||
|
||||
# Allow all domains to dump core
|
||||
#
|
||||
allow_daemons_dump_core = true
|
||||
|
||||
# Allow samba to act as the domain controller
|
||||
#
|
||||
samba_domain_controller = false
|
||||
|
||||
# Allow samba to export user home directories.
|
||||
#
|
||||
samba_run_unconfined = false
|
||||
|
||||
# Allows XServer to execute writable memory
|
||||
#
|
||||
allow_xserver_execmem = false
|
||||
|
||||
# disallow guest accounts to execute files that they can create
|
||||
#
|
||||
allow_guest_exec_content = false
|
||||
allow_xguest_exec_content = false
|
||||
|
||||
# Only allow browser to use the web
|
||||
#
|
||||
browser_confine_xguest=false
|
||||
|
||||
# Allow postfix locat to write to mail spool
|
||||
#
|
||||
allow_postfix_local_write_mail_spool=false
|
||||
|
||||
# Allow common users to read/write noexattrfile systems
|
||||
#
|
||||
user_rw_noexattrfile=true
|
||||
|
||||
# Allow qemu to connect fully to the network
|
||||
#
|
||||
qemu_full_network=true
|
||||
|
||||
# Allow nsplugin execmem/execstack for bad plugins
|
||||
#
|
||||
allow_nsplugin_execmem=true
|
||||
|
||||
# Allow unconfined domain to transition to confined domain
|
||||
#
|
||||
allow_unconfined_nsplugin_transition=true
|
||||
|
||||
# System uses init upstart program
|
||||
#
|
||||
init_upstart = true
|
||||
|
||||
# Allow mount to mount any file/dir
|
||||
#
|
||||
allow_mount_anyfile = true
|
||||
@ -1,6 +0,0 @@
|
||||
kerberos_enabled = true
|
||||
mount_anyfile = true
|
||||
polyinstantiation_enabled = true
|
||||
ftpd_is_daemon = true
|
||||
selinuxuser_ping = true
|
||||
xserver_object_manager = true
|
||||
@ -1,24 +0,0 @@
|
||||
gssd_read_tmp = true
|
||||
httpd_builtin_scripting = true
|
||||
httpd_enable_cgi = true
|
||||
kerberos_enabled = true
|
||||
mount_anyfile = true
|
||||
nfs_export_all_ro = true
|
||||
nfs_export_all_rw = true
|
||||
nscd_use_shm = true
|
||||
openvpn_enable_homedirs = true
|
||||
postfix_local_write_mail_spool=true
|
||||
pppd_can_insmod = false
|
||||
privoxy_connect_any = true
|
||||
selinuxuser_direct_dri_enabled = true
|
||||
selinuxuser_execmem = true
|
||||
selinuxuser_execstack = true
|
||||
selinuxuser_rw_noexattrfile=true
|
||||
selinuxuser_ping = true
|
||||
squid_connect_any = true
|
||||
telepathy_tcp_connect_generic_network_ports=true
|
||||
unconfined_chrome_sandbox_transition=true
|
||||
unconfined_mozilla_plugin_transition=true
|
||||
xguest_exec_content = true
|
||||
mozilla_plugin_can_network_connect = true
|
||||
use_virtualbox = true
|
||||
@ -1,54 +0,0 @@
|
||||
allow_auditadm_exec_content auditadm_exec_content
|
||||
allow_console_login login_console_enabled
|
||||
allow_cvs_read_shadow cvs_read_shadow
|
||||
allow_daemons_dump_core daemons_dump_core
|
||||
allow_daemons_use_tcp_wrapper daemons_use_tcp_wrapper
|
||||
allow_daemons_use_tty daemons_use_tty
|
||||
allow_domain_fd_use domain_fd_use
|
||||
allow_execheap selinuxuser_execheap
|
||||
allow_execmod selinuxuser_execmod
|
||||
allow_execstack selinuxuser_execstack
|
||||
allow_ftpd_anon_write ftpd_anon_write
|
||||
allow_ftpd_full_access ftpd_full_access
|
||||
allow_ftpd_use_cifs ftpd_use_cifs
|
||||
allow_ftpd_use_nfs ftpd_use_nfs
|
||||
allow_gssd_read_tmp gssd_read_tmp
|
||||
allow_guest_exec_content guest_exec_content
|
||||
allow_httpd_anon_write httpd_anon_write
|
||||
allow_httpd_mod_auth_ntlm_winbind httpd_mod_auth_ntlm_winbind
|
||||
allow_httpd_mod_auth_pam httpd_mod_auth_pam
|
||||
allow_httpd_sys_script_anon_write httpd_sys_script_anon_write
|
||||
allow_kerberos kerberos_enabled
|
||||
allow_mplayer_execstack mplayer_execstack
|
||||
allow_mount_anyfile mount_anyfile
|
||||
allow_nfsd_anon_write nfsd_anon_write
|
||||
allow_polyinstantiation polyinstantiation_enabled
|
||||
allow_postfix_local_write_mail_spool postfix_local_write_mail_spool
|
||||
allow_rsync_anon_write rsync_anon_write
|
||||
allow_saslauthd_read_shadow saslauthd_read_shadow
|
||||
allow_secadm_exec_content secadm_exec_content
|
||||
allow_smbd_anon_write smbd_anon_write
|
||||
allow_ssh_keysign ssh_keysign
|
||||
allow_staff_exec_content staff_exec_content
|
||||
allow_sysadm_exec_content sysadm_exec_content
|
||||
allow_user_exec_content user_exec_content
|
||||
allow_user_mysql_connect selinuxuser_mysql_connect_enabled
|
||||
allow_user_postgresql_connect selinuxuser_postgresql_connect_enabled
|
||||
allow_write_xshm xserver_clients_write_xshm
|
||||
allow_xguest_exec_content xguest_exec_content
|
||||
allow_xserver_execmem xserver_execmem
|
||||
allow_ypbind nis_enabled
|
||||
allow_zebra_write_config zebra_write_config
|
||||
user_direct_dri selinuxuser_direct_dri_enabled
|
||||
user_ping selinuxuser_ping
|
||||
user_share_music selinuxuser_share_music
|
||||
user_tcp_server selinuxuser_tcp_server
|
||||
sepgsql_enable_pitr_implementation postgresql_can_rsync
|
||||
sepgsql_enable_users_ddl postgresql_selinux_users_ddl
|
||||
sepgsql_transmit_client_label postgresql_selinux_transmit_client_label
|
||||
sepgsql_unconfined_dbadm postgresql_selinux_unconfined_dbadm
|
||||
clamd_use_jit antivirus_use_jit
|
||||
amavis_use_jit antivirus_use_jit
|
||||
logwatch_can_sendmail logwatch_can_network_connect_mail
|
||||
puppet_manage_all_files puppetagent_manage_all_files
|
||||
virt_sandbox_use_nfs virt_use_nfs
|
||||
@ -1,14 +0,0 @@
|
||||
container_file_t
|
||||
sandbox_file_t
|
||||
svirt_image_t
|
||||
svirt_home_t
|
||||
svirt_sandbox_file_t
|
||||
virt_content_t
|
||||
httpd_user_htaccess_t
|
||||
httpd_user_script_exec_t
|
||||
httpd_user_rw_content_t
|
||||
httpd_user_ra_content_t
|
||||
httpd_user_content_t
|
||||
git_session_content_t
|
||||
home_bin_t
|
||||
user_tty_device_t
|
||||
@ -1,24 +0,0 @@
|
||||
/run /var/run
|
||||
/run/lock /var/lock
|
||||
/run/systemd/system /usr/lib/systemd/system
|
||||
/run/systemd/generator /usr/lib/systemd/system
|
||||
/run/systemd/generator.early /usr/lib/systemd/system
|
||||
/run/systemd/generator.late /usr/lib/systemd/system
|
||||
/lib /usr/lib
|
||||
/lib64 /usr/lib
|
||||
/usr/lib64 /usr/lib
|
||||
/usr/local/lib64 /usr/lib
|
||||
/usr/local/lib32 /usr/lib
|
||||
/etc/systemd/system /usr/lib/systemd/system
|
||||
/var/lib/xguest/home /home
|
||||
/var/named/chroot/usr/lib64 /usr/lib
|
||||
/var/named/chroot/lib64 /usr/lib
|
||||
/var/named/chroot/var /var
|
||||
/home-inst /home
|
||||
/home/home-inst /home
|
||||
/var/roothome /root
|
||||
/sbin /usr/sbin
|
||||
/sysroot/tmp /tmp
|
||||
/var/usrlocal /usr/local
|
||||
/var/mnt /mnt
|
||||
/bin /usr/bin
|
||||
@ -0,0 +1,50 @@
|
||||
apache
|
||||
application
|
||||
auditadm
|
||||
authlogin
|
||||
base
|
||||
bootloader
|
||||
clock
|
||||
dbus
|
||||
dmesg
|
||||
fstools
|
||||
getty
|
||||
hostname
|
||||
inetd
|
||||
init
|
||||
ipsec
|
||||
iptables
|
||||
kerberos
|
||||
libraries
|
||||
locallogin
|
||||
logadm
|
||||
logging
|
||||
lvm
|
||||
miscfiles
|
||||
modutils
|
||||
mount
|
||||
mta
|
||||
netlabel
|
||||
netutils
|
||||
nis
|
||||
postgresql
|
||||
secadm
|
||||
selinuxutil
|
||||
setrans
|
||||
seunshare
|
||||
ssh
|
||||
staff
|
||||
su
|
||||
sudo
|
||||
sysadm
|
||||
sysadm_secadm
|
||||
sysnetwork
|
||||
systemd
|
||||
udev
|
||||
unconfined
|
||||
unconfineduser
|
||||
unlabelednet
|
||||
unprivuser
|
||||
userdomain
|
||||
usermanage
|
||||
xserver
|
||||
@ -1,380 +0,0 @@
|
||||
# Layer: kernel
|
||||
# Module: bootloader
|
||||
#
|
||||
# Policy for the kernel modules, kernel image, and bootloader.
|
||||
#
|
||||
bootloader = module
|
||||
|
||||
# Layer: kernel
|
||||
# Module: corenetwork
|
||||
# Required in base
|
||||
#
|
||||
# Policy controlling access to network objects
|
||||
#
|
||||
corenetwork = base
|
||||
|
||||
# Layer: admin
|
||||
# Module: dmesg
|
||||
#
|
||||
# Policy for dmesg.
|
||||
#
|
||||
dmesg = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: netutils
|
||||
#
|
||||
# Network analysis utilities
|
||||
#
|
||||
netutils = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: sudo
|
||||
#
|
||||
# Execute a command with a substitute user
|
||||
#
|
||||
sudo = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: su
|
||||
#
|
||||
# Run shells with substitute user and group
|
||||
#
|
||||
su = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: usermanage
|
||||
#
|
||||
# Policy for managing user accounts.
|
||||
#
|
||||
usermanage = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: seunshare
|
||||
#
|
||||
# seunshare executable
|
||||
#
|
||||
seunshare = module
|
||||
|
||||
# Layer: kernel
|
||||
# Module: corecommands
|
||||
# Required in base
|
||||
#
|
||||
# Core policy for shells, and generic programs
|
||||
# in /bin, /sbin, /usr/bin, and /usr/sbin.
|
||||
#
|
||||
corecommands = base
|
||||
|
||||
# Module: devices
|
||||
# Required in base
|
||||
#
|
||||
# Device nodes and interfaces for many basic system devices.
|
||||
#
|
||||
devices = base
|
||||
|
||||
# Module: domain
|
||||
# Required in base
|
||||
#
|
||||
# Core policy for domains.
|
||||
#
|
||||
domain = base
|
||||
|
||||
# Layer: system
|
||||
# Module: userdomain
|
||||
#
|
||||
# Policy for user domains
|
||||
#
|
||||
userdomain = module
|
||||
|
||||
# Module: files
|
||||
# Required in base
|
||||
#
|
||||
# Basic filesystem types and interfaces.
|
||||
#
|
||||
files = base
|
||||
|
||||
# Module: filesystem
|
||||
# Required in base
|
||||
#
|
||||
# Policy for filesystems.
|
||||
#
|
||||
filesystem = base
|
||||
|
||||
# Module: kernel
|
||||
# Required in base
|
||||
#
|
||||
# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
|
||||
#
|
||||
kernel = base
|
||||
|
||||
# Module: mcs
|
||||
# Required in base
|
||||
#
|
||||
# MultiCategory security policy
|
||||
#
|
||||
mcs = base
|
||||
|
||||
# Module: mls
|
||||
# Required in base
|
||||
#
|
||||
# Multilevel security policy
|
||||
#
|
||||
mls = base
|
||||
|
||||
# Module: selinux
|
||||
# Required in base
|
||||
#
|
||||
# Policy for kernel security interface, in particular, selinuxfs.
|
||||
#
|
||||
selinux = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: storage
|
||||
#
|
||||
# Policy controlling access to storage devices
|
||||
#
|
||||
storage = base
|
||||
|
||||
# Module: terminal
|
||||
# Required in base
|
||||
#
|
||||
# Policy for terminals.
|
||||
#
|
||||
terminal = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: ubac
|
||||
#
|
||||
#
|
||||
#
|
||||
ubac = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: unlabelednet
|
||||
#
|
||||
# The unlabelednet module.
|
||||
#
|
||||
unlabelednet = module
|
||||
|
||||
# Layer: role
|
||||
# Module: auditadm
|
||||
#
|
||||
# auditadm account on tty logins
|
||||
#
|
||||
auditadm = module
|
||||
|
||||
# Layer: role
|
||||
# Module: logadm
|
||||
#
|
||||
# Minimally prived root role for managing logging system
|
||||
#
|
||||
logadm = module
|
||||
|
||||
# Layer: role
|
||||
# Module: secadm
|
||||
#
|
||||
# secadm account on tty logins
|
||||
#
|
||||
secadm = module
|
||||
|
||||
# Layer:role
|
||||
# Module: staff
|
||||
#
|
||||
# admin account
|
||||
#
|
||||
staff = module
|
||||
|
||||
# Layer:role
|
||||
# Module: sysadm_secadm
|
||||
#
|
||||
# System Administrator with Security Admin rules
|
||||
#
|
||||
sysadm_secadm = module
|
||||
|
||||
# Layer:role
|
||||
# Module: sysadm
|
||||
#
|
||||
# System Administrator
|
||||
#
|
||||
sysadm = module
|
||||
|
||||
# Layer: role
|
||||
# Module: unprivuser
|
||||
#
|
||||
# Minimally privs guest account on tty logins
|
||||
#
|
||||
unprivuser = module
|
||||
|
||||
# Layer: services
|
||||
# Module: postgresql
|
||||
#
|
||||
# PostgreSQL relational database
|
||||
#
|
||||
postgresql = module
|
||||
|
||||
# Layer: services
|
||||
# Module: ssh
|
||||
#
|
||||
# Secure shell client and server policy.
|
||||
#
|
||||
ssh = module
|
||||
|
||||
# Layer: services
|
||||
# Module: xserver
|
||||
#
|
||||
# X windows login display manager
|
||||
#
|
||||
xserver = module
|
||||
|
||||
# Module: application
|
||||
# Required in base
|
||||
#
|
||||
# Defines attributs and interfaces for all user applications
|
||||
#
|
||||
application = module
|
||||
|
||||
# Layer: system
|
||||
# Module: authlogin
|
||||
#
|
||||
# Common policy for authentication and user login.
|
||||
#
|
||||
authlogin = module
|
||||
|
||||
# Layer: system
|
||||
# Module: clock
|
||||
#
|
||||
# Policy for reading and setting the hardware clock.
|
||||
#
|
||||
clock = module
|
||||
|
||||
# Layer: system
|
||||
# Module: fstools
|
||||
#
|
||||
# Tools for filesystem management, such as mkfs and fsck.
|
||||
#
|
||||
fstools = module
|
||||
|
||||
# Layer: system
|
||||
# Module: getty
|
||||
#
|
||||
# Policy for getty.
|
||||
#
|
||||
getty = module
|
||||
|
||||
# Layer: system
|
||||
# Module: hostname
|
||||
#
|
||||
# Policy for changing the system host name.
|
||||
#
|
||||
hostname = module
|
||||
|
||||
# Layer: system
|
||||
# Module: init
|
||||
#
|
||||
# System initialization programs (init and init scripts).
|
||||
#
|
||||
init = module
|
||||
|
||||
# Layer: system
|
||||
# Module: ipsec
|
||||
#
|
||||
# TCP/IP encryption
|
||||
#
|
||||
ipsec = module
|
||||
|
||||
# Layer: system
|
||||
# Module: iptables
|
||||
#
|
||||
# Policy for iptables.
|
||||
#
|
||||
iptables = module
|
||||
|
||||
# Layer: system
|
||||
# Module: libraries
|
||||
#
|
||||
# Policy for system libraries.
|
||||
#
|
||||
libraries = module
|
||||
|
||||
# Layer: system
|
||||
# Module: locallogin
|
||||
#
|
||||
# Policy for local logins.
|
||||
#
|
||||
locallogin = module
|
||||
|
||||
# Layer: system
|
||||
# Module: logging
|
||||
#
|
||||
# Policy for the kernel message logger and system logging daemon.
|
||||
#
|
||||
logging = module
|
||||
|
||||
# Layer: system
|
||||
# Module: lvm
|
||||
#
|
||||
# Policy for logical volume management programs.
|
||||
#
|
||||
lvm = module
|
||||
|
||||
# Layer: system
|
||||
# Module: miscfiles
|
||||
#
|
||||
# Miscelaneous files.
|
||||
#
|
||||
miscfiles = module
|
||||
|
||||
# Layer: system
|
||||
# Module: modutils
|
||||
#
|
||||
# Policy for kernel module utilities
|
||||
#
|
||||
modutils = module
|
||||
|
||||
# Layer: system
|
||||
# Module: mount
|
||||
#
|
||||
# Policy for mount.
|
||||
#
|
||||
mount = module
|
||||
|
||||
# Layer: system
|
||||
# Module: netlabel
|
||||
#
|
||||
# Basic netlabel types and interfaces.
|
||||
#
|
||||
netlabel = module
|
||||
|
||||
# Layer: system
|
||||
# Module: selinuxutil
|
||||
#
|
||||
# Policy for SELinux policy and userland applications.
|
||||
#
|
||||
selinuxutil = module
|
||||
|
||||
# Module: setrans
|
||||
# Required in base
|
||||
#
|
||||
# Policy for setrans
|
||||
#
|
||||
setrans = module
|
||||
|
||||
# Layer: system
|
||||
# Module: sysnetwork
|
||||
#
|
||||
# Policy for network configuration: ifconfig and dhcp client.
|
||||
#
|
||||
sysnetwork = module
|
||||
|
||||
# Layer: system
|
||||
# Module: systemd
|
||||
#
|
||||
# Policy for systemd components
|
||||
#
|
||||
systemd = module
|
||||
|
||||
# Layer: system
|
||||
# Module: udev
|
||||
#
|
||||
# Policy for udev.
|
||||
#
|
||||
udev = module
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,393 +0,0 @@
|
||||
# Layer: kernel
|
||||
# Module: bootloader
|
||||
#
|
||||
# Policy for the kernel modules, kernel image, and bootloader.
|
||||
#
|
||||
bootloader = module
|
||||
|
||||
# Layer: kernel
|
||||
# Module: corecommands
|
||||
# Required in base
|
||||
#
|
||||
# Core policy for shells, and generic programs
|
||||
# in /bin, /sbin, /usr/bin, and /usr/sbin.
|
||||
#
|
||||
corecommands = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: corenetwork
|
||||
# Required in base
|
||||
#
|
||||
# Policy controlling access to network objects
|
||||
#
|
||||
corenetwork = base
|
||||
|
||||
# Layer: admin
|
||||
# Module: dmesg
|
||||
#
|
||||
# Policy for dmesg.
|
||||
#
|
||||
dmesg = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: netutils
|
||||
#
|
||||
# Network analysis utilities
|
||||
#
|
||||
netutils = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: sudo
|
||||
#
|
||||
# Execute a command with a substitute user
|
||||
#
|
||||
sudo = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: su
|
||||
#
|
||||
# Run shells with substitute user and group
|
||||
#
|
||||
su = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: usermanage
|
||||
#
|
||||
# Policy for managing user accounts.
|
||||
#
|
||||
usermanage = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: seunshare
|
||||
#
|
||||
# seunshare executable
|
||||
#
|
||||
seunshare = module
|
||||
|
||||
# Module: devices
|
||||
# Required in base
|
||||
#
|
||||
# Device nodes and interfaces for many basic system devices.
|
||||
#
|
||||
devices = base
|
||||
|
||||
# Module: domain
|
||||
# Required in base
|
||||
#
|
||||
# Core policy for domains.
|
||||
#
|
||||
domain = base
|
||||
|
||||
# Layer: system
|
||||
# Module: userdomain
|
||||
#
|
||||
# Policy for user domains
|
||||
#
|
||||
userdomain = module
|
||||
|
||||
# Module: files
|
||||
# Required in base
|
||||
#
|
||||
# Basic filesystem types and interfaces.
|
||||
#
|
||||
files = base
|
||||
|
||||
# Layer: system
|
||||
# Module: miscfiles
|
||||
#
|
||||
# Miscelaneous files.
|
||||
#
|
||||
miscfiles = module
|
||||
|
||||
# Module: filesystem
|
||||
# Required in base
|
||||
#
|
||||
# Policy for filesystems.
|
||||
#
|
||||
filesystem = base
|
||||
|
||||
# Module: kernel
|
||||
# Required in base
|
||||
#
|
||||
# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
|
||||
#
|
||||
kernel = base
|
||||
|
||||
# Module: mcs
|
||||
# Required in base
|
||||
#
|
||||
# MultiCategory security policy
|
||||
#
|
||||
mcs = base
|
||||
|
||||
# Module: mls
|
||||
# Required in base
|
||||
#
|
||||
# Multilevel security policy
|
||||
#
|
||||
mls = base
|
||||
|
||||
# Module: selinux
|
||||
# Required in base
|
||||
#
|
||||
# Policy for kernel security interface, in particular, selinuxfs.
|
||||
#
|
||||
selinux = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: storage
|
||||
#
|
||||
# Policy controlling access to storage devices
|
||||
#
|
||||
storage = base
|
||||
|
||||
# Module: terminal
|
||||
# Required in base
|
||||
#
|
||||
# Policy for terminals.
|
||||
#
|
||||
terminal = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: ubac
|
||||
#
|
||||
#
|
||||
#
|
||||
ubac = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: unconfined
|
||||
#
|
||||
# The unlabelednet module.
|
||||
#
|
||||
unlabelednet = module
|
||||
|
||||
# Layer: role
|
||||
# Module: auditadm
|
||||
#
|
||||
# auditadm account on tty logins
|
||||
#
|
||||
auditadm = module
|
||||
|
||||
# Layer: role
|
||||
# Module: logadm
|
||||
#
|
||||
# Minimally prived root role for managing logging system
|
||||
#
|
||||
logadm = module
|
||||
|
||||
# Layer: role
|
||||
# Module: secadm
|
||||
#
|
||||
# secadm account on tty logins
|
||||
#
|
||||
secadm = module
|
||||
|
||||
# Layer:role
|
||||
# Module: sysadm_secadm
|
||||
#
|
||||
# System Administrator with Security Admin rules
|
||||
#
|
||||
sysadm_secadm = module
|
||||
|
||||
# Module: staff
|
||||
#
|
||||
# admin account
|
||||
#
|
||||
staff = module
|
||||
|
||||
# Layer:role
|
||||
# Module: sysadm
|
||||
#
|
||||
# System Administrator
|
||||
#
|
||||
sysadm = module
|
||||
|
||||
# Layer: role
|
||||
# Module: unconfineduser
|
||||
#
|
||||
# The unconfined user domain.
|
||||
#
|
||||
unconfineduser = module
|
||||
|
||||
# Layer: role
|
||||
# Module: unprivuser
|
||||
#
|
||||
# Minimally privs guest account on tty logins
|
||||
#
|
||||
unprivuser = module
|
||||
|
||||
# Layer: services
|
||||
# Module: postgresql
|
||||
#
|
||||
# PostgreSQL relational database
|
||||
#
|
||||
postgresql = module
|
||||
|
||||
# Layer: services
|
||||
# Module: ssh
|
||||
#
|
||||
# Secure shell client and server policy.
|
||||
#
|
||||
ssh = module
|
||||
|
||||
# Layer: services
|
||||
# Module: xserver
|
||||
#
|
||||
# X windows login display manager
|
||||
#
|
||||
xserver = module
|
||||
|
||||
# Module: application
|
||||
# Required in base
|
||||
#
|
||||
# Defines attributs and interfaces for all user applications
|
||||
#
|
||||
application = module
|
||||
|
||||
# Layer: system
|
||||
# Module: authlogin
|
||||
#
|
||||
# Common policy for authentication and user login.
|
||||
#
|
||||
authlogin = module
|
||||
|
||||
# Layer: system
|
||||
# Module: clock
|
||||
#
|
||||
# Policy for reading and setting the hardware clock.
|
||||
#
|
||||
clock = module
|
||||
|
||||
# Layer: system
|
||||
# Module: fstools
|
||||
#
|
||||
# Tools for filesystem management, such as mkfs and fsck.
|
||||
#
|
||||
fstools = module
|
||||
|
||||
# Layer: system
|
||||
# Module: getty
|
||||
#
|
||||
# Policy for getty.
|
||||
#
|
||||
getty = module
|
||||
|
||||
# Layer: system
|
||||
# Module: hostname
|
||||
#
|
||||
# Policy for changing the system host name.
|
||||
#
|
||||
hostname = module
|
||||
|
||||
# Layer: system
|
||||
# Module: init
|
||||
#
|
||||
# System initialization programs (init and init scripts).
|
||||
#
|
||||
init = module
|
||||
|
||||
# Layer: system
|
||||
# Module: ipsec
|
||||
#
|
||||
# TCP/IP encryption
|
||||
#
|
||||
ipsec = module
|
||||
|
||||
# Layer: system
|
||||
# Module: iptables
|
||||
#
|
||||
# Policy for iptables.
|
||||
#
|
||||
iptables = module
|
||||
|
||||
# Layer: system
|
||||
# Module: libraries
|
||||
#
|
||||
# Policy for system libraries.
|
||||
#
|
||||
libraries = module
|
||||
|
||||
# Layer: system
|
||||
# Module: locallogin
|
||||
#
|
||||
# Policy for local logins.
|
||||
#
|
||||
locallogin = module
|
||||
|
||||
# Layer: system
|
||||
# Module: logging
|
||||
#
|
||||
# Policy for the kernel message logger and system logging daemon.
|
||||
#
|
||||
logging = module
|
||||
|
||||
# Layer: system
|
||||
# Module: lvm
|
||||
#
|
||||
# Policy for logical volume management programs.
|
||||
#
|
||||
lvm = module
|
||||
|
||||
# Layer: system
|
||||
# Module: modutils
|
||||
#
|
||||
# Policy for kernel module utilities
|
||||
#
|
||||
modutils = module
|
||||
|
||||
# Layer: system
|
||||
# Module: mount
|
||||
#
|
||||
# Policy for mount.
|
||||
#
|
||||
mount = module
|
||||
|
||||
# Layer: system
|
||||
# Module: netlabel
|
||||
#
|
||||
# Basic netlabel types and interfaces.
|
||||
#
|
||||
netlabel = module
|
||||
|
||||
# Layer: system
|
||||
# Module: selinuxutil
|
||||
#
|
||||
# Policy for SELinux policy and userland applications.
|
||||
#
|
||||
selinuxutil = module
|
||||
|
||||
# Module: setrans
|
||||
# Required in base
|
||||
#
|
||||
# Policy for setrans
|
||||
#
|
||||
setrans = module
|
||||
|
||||
# Layer: system
|
||||
# Module: sysnetwork
|
||||
#
|
||||
# Policy for network configuration: ifconfig and dhcp client.
|
||||
#
|
||||
sysnetwork = module
|
||||
|
||||
# Layer: system
|
||||
# Module: systemd
|
||||
#
|
||||
# Policy for systemd components
|
||||
#
|
||||
systemd = module
|
||||
|
||||
# Layer: system
|
||||
# Module: udev
|
||||
#
|
||||
# Policy for udev.
|
||||
#
|
||||
udev = module
|
||||
|
||||
# Layer: system
|
||||
# Module: unconfined
|
||||
#
|
||||
# The unconfined domain.
|
||||
#
|
||||
unconfined = module
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,2 +0,0 @@
|
||||
(roleattributeset cil_gen_require system_r)
|
||||
|
||||
@ -1,4 +0,0 @@
|
||||
console_device_t
|
||||
sysadm_tty_device_t
|
||||
user_tty_device_t
|
||||
staff_tty_device_t
|
||||
@ -1,6 +0,0 @@
|
||||
console_device_t
|
||||
sysadm_tty_device_t
|
||||
user_tty_device_t
|
||||
staff_tty_device_t
|
||||
auditadm_tty_device_t
|
||||
secureadm_tty_device_t
|
||||
@ -1,4 +0,0 @@
|
||||
console_device_t
|
||||
sysadm_tty_device_t
|
||||
user_tty_device_t
|
||||
staff_tty_device_t
|
||||
@ -0,0 +1 @@
|
||||
selinux-policy-mls
|
||||
@ -0,0 +1 @@
|
||||
selinux-policy-targeted
|
||||
@ -1,19 +0,0 @@
|
||||
#
|
||||
# Multi-Category Security translation table for SELinux
|
||||
#
|
||||
# Uncomment the following to disable translation libary
|
||||
# disable=1
|
||||
#
|
||||
# Objects can be categorized with 0-1023 categories defined by the admin.
|
||||
# Objects can be in more than one category at a time.
|
||||
# Categories are stored in the system as c0-c1023. Users can use this
|
||||
# table to translate the categories into a more meaningful output.
|
||||
# Examples:
|
||||
# s0:c0=CompanyConfidential
|
||||
# s0:c1=PatientRecord
|
||||
# s0:c2=Unclassified
|
||||
# s0:c3=TopSecret
|
||||
# s0:c1,c3=CompanyConfidentialRedHat
|
||||
s0=SystemLow
|
||||
s0-s0:c0.c1023=SystemLow-SystemHigh
|
||||
s0:c0.c1023=SystemHigh
|
||||
@ -1,52 +0,0 @@
|
||||
#
|
||||
# Multi-Level Security translation table for SELinux
|
||||
#
|
||||
# Uncomment the following to disable translation libary
|
||||
# disable=1
|
||||
#
|
||||
# Objects can be labeled with one of 16 levels and be categorized with 0-1023
|
||||
# categories defined by the admin.
|
||||
# Objects can be in more than one category at a time.
|
||||
# Users can modify this table to translate the MLS labels for different purpose.
|
||||
#
|
||||
# Assumptions: using below MLS labels.
|
||||
# SystemLow
|
||||
# SystemHigh
|
||||
# Unclassified
|
||||
# Secret with compartments A and B.
|
||||
#
|
||||
# SystemLow and SystemHigh
|
||||
s0=SystemLow
|
||||
s15:c0.c1023=SystemHigh
|
||||
s0-s15:c0.c1023=SystemLow-SystemHigh
|
||||
|
||||
# Unclassified level
|
||||
s1=Unclassified
|
||||
|
||||
# Secret level with compartments
|
||||
s2=Secret
|
||||
s2:c0=A
|
||||
s2:c1=B
|
||||
|
||||
# ranges for Unclassified
|
||||
s0-s1=SystemLow-Unclassified
|
||||
s1-s2=Unclassified-Secret
|
||||
s1-s15:c0.c1023=Unclassified-SystemHigh
|
||||
|
||||
# ranges for Secret with compartments
|
||||
s0-s2=SystemLow-Secret
|
||||
s0-s2:c0=SystemLow-Secret:A
|
||||
s0-s2:c1=SystemLow-Secret:B
|
||||
s0-s2:c0,c1=SystemLow-Secret:AB
|
||||
s1-s2:c0=Unclassified-Secret:A
|
||||
s1-s2:c1=Unclassified-Secret:B
|
||||
s1-s2:c0,c1=Unclassified-Secret:AB
|
||||
s2-s2:c0=Secret-Secret:A
|
||||
s2-s2:c1=Secret-Secret:B
|
||||
s2-s2:c0,c1=Secret-Secret:AB
|
||||
s2-s15:c0.c1023=Secret-SystemHigh
|
||||
s2:c0-s2:c0,c1=Secret:A-Secret:AB
|
||||
s2:c0-s15:c0.c1023=Secret:A-SystemHigh
|
||||
s2:c1-s2:c0,c1=Secret:B-Secret:AB
|
||||
s2:c1-s15:c0.c1023=Secret:B-SystemHigh
|
||||
s2:c0,c1-s15:c0.c1023=Secret:AB-SystemHigh
|
||||
@ -1,19 +0,0 @@
|
||||
#
|
||||
# Multi-Category Security translation table for SELinux
|
||||
#
|
||||
# Uncomment the following to disable translation libary
|
||||
# disable=1
|
||||
#
|
||||
# Objects can be categorized with 0-1023 categories defined by the admin.
|
||||
# Objects can be in more than one category at a time.
|
||||
# Categories are stored in the system as c0-c1023. Users can use this
|
||||
# table to translate the categories into a more meaningful output.
|
||||
# Examples:
|
||||
# s0:c0=CompanyConfidential
|
||||
# s0:c1=PatientRecord
|
||||
# s0:c2=Unclassified
|
||||
# s0:c3=TopSecret
|
||||
# s0:c1,c3=CompanyConfidentialRedHat
|
||||
s0=SystemLow
|
||||
s0-s0:c0.c1023=SystemLow-SystemHigh
|
||||
s0:c0.c1023=SystemHigh
|
||||
@ -1,39 +0,0 @@
|
||||
##################################
|
||||
#
|
||||
# Core User configuration.
|
||||
#
|
||||
|
||||
#
|
||||
# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_catetories])
|
||||
#
|
||||
# Note: Identities without a prefix wil not be listed
|
||||
# in the users_extra file used by genhomedircon.
|
||||
|
||||
#
|
||||
# system_u is the user identity for system processes and objects.
|
||||
# There should be no corresponding Unix user identity for system,
|
||||
# and a user process should never be assigned the system user
|
||||
# identity.
|
||||
#
|
||||
gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
|
||||
#
|
||||
# user_u is a generic user identity for Linux users who have no
|
||||
# SELinux user identity defined. The modified daemons will use
|
||||
# this user identity in the security context if there is no matching
|
||||
# SELinux user identity for a Linux user. If you do not want to
|
||||
# permit any access to such users, then remove this entry.
|
||||
#
|
||||
gen_user(user_u, user, user_r, s0, s0)
|
||||
gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
|
||||
#
|
||||
# The following users correspond to Unix identities.
|
||||
# These identities are typically assigned as the user attribute
|
||||
# when login starts the user shell. Users with access to the sysadm_r
|
||||
# role should use the staff_r role instead of the user_r role when
|
||||
# not in the sysadm_r.
|
||||
#
|
||||
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
@ -1,40 +0,0 @@
|
||||
##################################
|
||||
#
|
||||
# Core User configuration.
|
||||
#
|
||||
|
||||
#
|
||||
# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_catetories])
|
||||
#
|
||||
# Note: Identities without a prefix wil not be listed
|
||||
# in the users_extra file used by genhomedircon.
|
||||
|
||||
#
|
||||
# system_u is the user identity for system processes and objects.
|
||||
# There should be no corresponding Unix user identity for system,
|
||||
# and a user process should never be assigned the system user
|
||||
# identity.
|
||||
#
|
||||
gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
|
||||
#
|
||||
# user_u is a generic user identity for Linux users who have no
|
||||
# SELinux user identity defined. The modified daemons will use
|
||||
# this user identity in the security context if there is no matching
|
||||
# SELinux user identity for a Linux user. If you do not want to
|
||||
# permit any access to such users, then remove this entry.
|
||||
#
|
||||
gen_user(user_u, user, user_r, s0, s0)
|
||||
gen_user(staff_u, user, staff_r system_r sysadm_r secadm_r auditadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
|
||||
#
|
||||
# The following users correspond to Unix identities.
|
||||
# These identities are typically assigned as the user attribute
|
||||
# when login starts the user shell. Users with access to the sysadm_r
|
||||
# role should use the staff_r role instead of the user_r role when
|
||||
# not in the sysadm_r.
|
||||
#
|
||||
gen_user(root, user, sysadm_r staff_r secadm_r auditadm_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(guest_u, user, guest_r, s0, s0)
|
||||
gen_user(xguest_u, user, xguest_r, s0, s0)
|
||||
@ -1,41 +0,0 @@
|
||||
##################################
|
||||
#
|
||||
# Core User configuration.
|
||||
#
|
||||
|
||||
#
|
||||
# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_catetories])
|
||||
#
|
||||
# Note: Identities without a prefix wil not be listed
|
||||
# in the users_extra file used by genhomedircon.
|
||||
|
||||
#
|
||||
# system_u is the user identity for system processes and objects.
|
||||
# There should be no corresponding Unix user identity for system,
|
||||
# and a user process should never be assigned the system user
|
||||
# identity.
|
||||
#
|
||||
gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
|
||||
#
|
||||
# user_u is a generic user identity for Linux users who have no
|
||||
# SELinux user identity defined. The modified daemons will use
|
||||
# this user identity in the security context if there is no matching
|
||||
# SELinux user identity for a Linux user. If you do not want to
|
||||
# permit any access to such users, then remove this entry.
|
||||
#
|
||||
gen_user(user_u, user, user_r, s0, s0)
|
||||
gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
|
||||
#
|
||||
# The following users correspond to Unix identities.
|
||||
# These identities are typically assigned as the user attribute
|
||||
# when login starts the user shell. Users with access to the sysadm_r
|
||||
# role should use the staff_r role instead of the user_r role when
|
||||
# not in the sysadm_r.
|
||||
#
|
||||
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(guest_u, user, guest_r, s0, s0)
|
||||
gen_user(xguest_u, user, xguest_r, s0, s0)
|
||||
@ -0,0 +1,95 @@
|
||||
#!/usr/bin/bash
|
||||
### varrun-convert.sh
|
||||
### convert legacy filecontext entries containing /var/run to /run
|
||||
### and load an extra selinux module with the new content
|
||||
### the script takes a policy name as an argument
|
||||
|
||||
# Set DEBUG=yes before running the script to get more verbose output
|
||||
# on the terminal and to the $LOG file
|
||||
if [ "${DEBUG}" = "yes" ]; then
|
||||
set -x
|
||||
fi
|
||||
|
||||
# Auxiliary and log files will be created in OUTPUTDIR
|
||||
OUTPUTDIR="/run/selinux-policy"
|
||||
LOG="$OUTPUTDIR/log"
|
||||
mkdir -p ${OUTPUTDIR}
|
||||
|
||||
if [ -z ${1} ]; then
|
||||
[ "${DEBUG}" = "yes" ] && echo "Error: Policy name required as an argument (e.g. targeted)" >> $LOG
|
||||
exit
|
||||
fi
|
||||
|
||||
SEMODULEOPT="-s ${1}"
|
||||
[ "${DEBUG}" = "yes" ] && SEMODULEOPT="-v ${SEMODULEOPT}"
|
||||
|
||||
# Take current file_contexts and unify whitespace separators
|
||||
FILE_CONTEXTS="/etc/selinux/${1}/contexts/files/file_contexts"
|
||||
FILE_CONTEXTS_UNIFIED="$OUTPUTDIR/file_contexts_unified"
|
||||
if [ ! -f ${FILE_CONTEXTS} ]; then
|
||||
[ "${DEBUG}" = "yes" ] && echo "Error: File context database file does not exist" >> $LOG
|
||||
exit
|
||||
fi
|
||||
|
||||
if ! grep -q ^/var/run ${FILE_CONTEXTS}; then
|
||||
[ "${DEBUG}" = "yes" ] && echo "Info: No entries containing /var/run" >> $LOG
|
||||
exit
|
||||
fi
|
||||
|
||||
EXTRA_VARRUN_ENTRIES_WITHDUP="$OUTPUTDIR/extra_varrun_entries_dup.txt"
|
||||
EXTRA_VARRUN_ENTRIES="$OUTPUTDIR/extra_varrun_entries.txt"
|
||||
EXTRA_VARRUN_CIL="$OUTPUTDIR/extra_varrun.cil"
|
||||
|
||||
# Print only /var/run entries
|
||||
grep ^/var/run ${FILE_CONTEXTS} > ${EXTRA_VARRUN_ENTRIES_WITHDUP}
|
||||
|
||||
# Unify whitespace separators
|
||||
sed -i 's/[ \t]\+/ /g' ${EXTRA_VARRUN_ENTRIES_WITHDUP}
|
||||
sed 's/[ \t]\+/ /g' ${FILE_CONTEXTS} > ${FILE_CONTEXTS_UNIFIED}
|
||||
|
||||
# Deduplicate already existing /var/run=/run entries
|
||||
while read line
|
||||
do
|
||||
subline="${line#/var}"
|
||||
if ! grep -q "^${subline}" ${FILE_CONTEXTS_UNIFIED}; then
|
||||
echo "$line"
|
||||
fi
|
||||
done < ${EXTRA_VARRUN_ENTRIES_WITHDUP} > ${EXTRA_VARRUN_ENTRIES}
|
||||
|
||||
# Change /var/run to /run
|
||||
sed -i 's|^/var/run|/run|' ${EXTRA_VARRUN_ENTRIES}
|
||||
|
||||
# Exception handling: packages with already duplicate entries
|
||||
sed -i '/^\/run\/snapd/d' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i '/^\/run\/vfrnav/d' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i '/^\/run\/waydroid/d' ${EXTRA_VARRUN_ENTRIES}
|
||||
|
||||
# Change format to cil
|
||||
sed -i 's/^\([^ ]\+\) \([^-]\)/\1 any \2/' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/^\([^ ]\+\) -- /\1 file /' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/^\([^ ]\+\) -b /\1 block /' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/^\([^ ]\+\) -c /\1 char /' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/^\([^ ]\+\) -d /\1 dir /' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/^\([^ ]\+\) -l /\1 symlink /' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/^\([^ ]\+\) -p /\1 pipe /' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/^\([^ ]\+\) -s /\1 socket /' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/^\([^ ]\+\) /(filecon "\1" /' ${EXTRA_VARRUN_ENTRIES}
|
||||
sed -i 's/system_u:object_r:\([^:]*\):\(.*\)$/(system_u object_r \1 ((\2) (\2))))/' ${EXTRA_VARRUN_ENTRIES}
|
||||
|
||||
# Handle entries with <<none>> which do not match previous regexps
|
||||
sed -i s'/ <<none>>$/ ())/' ${EXTRA_VARRUN_ENTRIES}
|
||||
|
||||
# Wrap each line with an optional block
|
||||
i=1
|
||||
while read line
|
||||
do
|
||||
echo "(optional extra_var_run_${i}"
|
||||
echo " $line"
|
||||
echo ")"
|
||||
((i++))
|
||||
done < ${EXTRA_VARRUN_ENTRIES} > ${EXTRA_VARRUN_CIL}
|
||||
|
||||
# Load module
|
||||
[ -s ${EXTRA_VARRUN_CIL} ] &&
|
||||
/usr/sbin/semodule ${SEMODULEOPT} -i ${EXTRA_VARRUN_CIL}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue