|
 |
1ec3d1a |
## <summary>GNU terminal multiplexer</summary>
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#######################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## The role template for the screen module.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="role_prefix">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## The prefix of the user role (e.g., user
|
|
|
1ec3d1a |
## is the prefix for user_r).
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
## <param name="user_role">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## The role associated with the user domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
## <param name="user_domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## The type of the user domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
template(`screen_role_template',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type screen_exec_t, screen_tmp_t;
|
|
|
1ec3d1a |
type screen_home_t, screen_var_run_t;
|
|
|
1ec3d1a |
attribute screen_domain;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Declarations
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type $1_screen_t, screen_domain;
|
|
|
1ec3d1a |
application_domain($1_screen_t, screen_exec_t)
|
|
|
1ec3d1a |
domain_interactive_fd($1_screen_t)
|
|
|
1ec3d1a |
ubac_constrained($1_screen_t)
|
|
|
1ec3d1a |
role $2 types $1_screen_t;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
userdom_home_reader($1_screen_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
domtrans_pattern($3, screen_exec_t, $1_screen_t)
|
|
|
1ec3d1a |
allow $3 $1_screen_t:process { signal sigchld };
|
|
|
1ec3d1a |
dontaudit $3 $1_screen_t:unix_stream_socket { read write };
|
|
|
1ec3d1a |
allow $1_screen_t $3:unix_stream_socket { connectto };
|
|
|
1ec3d1a |
allow $1_screen_t $3:process signal;
|
|
|
1ec3d1a |
ps_process_pattern($1_screen_t, $3)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_fifo_files_pattern($3, screen_home_t, screen_home_t)
|
|
|
1ec3d1a |
manage_dirs_pattern($3, screen_home_t, screen_home_t)
|
|
|
1ec3d1a |
manage_files_pattern($3, screen_home_t, screen_home_t)
|
|
|
1ec3d1a |
manage_lnk_files_pattern($3, screen_home_t, screen_home_t)
|
|
|
1ec3d1a |
relabel_dirs_pattern($3, screen_home_t, screen_home_t)
|
|
|
1ec3d1a |
relabel_files_pattern($3, screen_home_t, screen_home_t)
|
|
|
1ec3d1a |
relabel_lnk_files_pattern($3, screen_home_t, screen_home_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_dirs_pattern($3, screen_var_run_t, screen_var_run_t)
|
|
|
1ec3d1a |
manage_fifo_files_pattern($3, screen_var_run_t, screen_var_run_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# Revert to the user domain when a shell is executed.
|
|
|
1ec3d1a |
corecmd_shell_domtrans($1_screen_t, $3)
|
|
|
1ec3d1a |
corecmd_bin_domtrans($1_screen_t, $3)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
auth_domtrans_chk_passwd($1_screen_t)
|
|
|
1ec3d1a |
auth_use_nsswitch($1_screen_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
userdom_user_home_domtrans($1_screen_t, $3)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
tunable_policy(`use_samba_home_dirs',`
|
|
|
1ec3d1a |
fs_cifs_domtrans($1_screen_t, $3)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
tunable_policy(`use_nfs_home_dirs',`
|
|
|
1ec3d1a |
fs_nfs_domtrans($1_screen_t, $3)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#######################################
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Execute the rssh program
|
|
|
1ec3d1a |
## in the caller domain.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## <param name="domain">
|
|
|
1ec3d1a |
## <summary>
|
|
|
1ec3d1a |
## Domain allowed access.
|
|
|
1ec3d1a |
## </summary>
|
|
|
1ec3d1a |
## </param>
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
interface(`screen_exec',`
|
|
|
1ec3d1a |
gen_require(`
|
|
|
1ec3d1a |
type screen_exec_t;
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
can_exec($1, screen_exec_t)
|
|
|
1ec3d1a |
')
|