|
Chris PeBenito |
1a411e9 |
policy_module(oddjob, 1.9.0)
|
|
 |
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Declarations
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type oddjob_t;
|
|
|
1ec3d1a |
type oddjob_exec_t;
|
|
Chris PeBenito |
9401ae1 |
domain_type(oddjob_t)
|
|
|
1ec3d1a |
init_daemon_domain(oddjob_t, oddjob_exec_t)
|
|
|
1ec3d1a |
domain_obj_id_change_exemption(oddjob_t)
|
|
|
1ec3d1a |
domain_role_change_exemption(oddjob_t)
|
|
|
1ec3d1a |
domain_subj_id_change_exemption(oddjob_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type oddjob_mkhomedir_t;
|
|
|
1ec3d1a |
type oddjob_mkhomedir_exec_t;
|
|
Chris PeBenito |
9401ae1 |
domain_type(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
domain_obj_id_change_exemption(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
init_system_domain(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t)
|
|
|
1ec3d1a |
oddjob_system_entry(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# pid files
|
|
|
1ec3d1a |
type oddjob_var_run_t;
|
|
|
1ec3d1a |
files_pid_file(oddjob_var_run_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
ifdef(`enable_mcs',`
|
|
|
1ec3d1a |
init_ranged_daemon_domain(oddjob_t, oddjob_exec_t, s0 - mcs_systemhigh)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# oddjob local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow oddjob_t self:capability setgid;
|
|
|
1ec3d1a |
allow oddjob_t self:process { setexec signal };
|
|
|
1ec3d1a |
allow oddjob_t self:fifo_file rw_fifo_file_perms;
|
|
|
1ec3d1a |
allow oddjob_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(oddjob_t, oddjob_var_run_t, oddjob_var_run_t)
|
|
|
1ec3d1a |
manage_sock_files_pattern(oddjob_t, oddjob_var_run_t, oddjob_var_run_t)
|
|
|
1ec3d1a |
files_pid_filetrans(oddjob_t, oddjob_var_run_t, { file sock_file })
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
kernel_read_system_state(oddjob_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_exec_bin(oddjob_t)
|
|
|
1ec3d1a |
corecmd_exec_shell(oddjob_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
mcs_process_set_categories(oddjob_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
selinux_compute_create_context(oddjob_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
auth_use_nsswitch(oddjob_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
locallogin_dontaudit_use_fds(oddjob_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
dbus_system_bus_client(oddjob_t)
|
|
|
1ec3d1a |
dbus_connect_system_bus(oddjob_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
unconfined_domtrans(oddjob_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# oddjob_mkhomedir local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow oddjob_mkhomedir_t self:capability { chown fowner fsetid dac_override };
|
|
|
1ec3d1a |
allow oddjob_mkhomedir_t self:process setfscreate;
|
|
|
1ec3d1a |
allow oddjob_mkhomedir_t self:fifo_file rw_fifo_file_perms;
|
|
|
1ec3d1a |
allow oddjob_mkhomedir_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
kernel_read_system_state(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
auth_use_nsswitch(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
logging_send_syslog_msg(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
selinux_get_fs_mount(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
selinux_validate_context(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
selinux_compute_access_vector(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
selinux_compute_create_context(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
selinux_compute_relabel_context(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
selinux_compute_user_contexts(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
seutil_read_config(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
seutil_read_file_contexts(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
seutil_read_default_contexts(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# Add/remove user home directories
|
|
|
1ec3d1a |
userdom_home_filetrans_user_home_dir(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
userdom_manage_user_home_dirs(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
userdom_manage_user_home_content_dirs(oddjob_mkhomedir_t)
|
|
|
1ec3d1a |
userdom_manage_user_home_content(oddjob_mkhomedir_t)
|
|
 |
fca1c6e |
userdom_home_manager(oddjob_mkhomedir_t)
|
|
|
f84d342 |
userdom_stream_connect(oddjob_mkhomedir_t)
|
|
|
f84d342 |
|