diff --git a/accountsd.fc b/accountsd.fc index b1de34f..18e0e41 100644 --- a/accountsd.fc +++ b/accountsd.fc @@ -1,8 +1,5 @@ -<<<<<<< HEAD /usr/lib/systemd/system/accountsd.* -- gen_context(system_u:object_r:accountsd_unit_file_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /usr/libexec/accounts-daemon -- gen_context(system_u:object_r:accountsd_exec_t,s0) /var/lib/AccountsService(/.*)? gen_context(system_u:object_r:accountsd_var_lib_t,s0) diff --git a/accountsd.if b/accountsd.if index 64256d4..10a0cd6 100644 --- a/accountsd.if +++ b/accountsd.if @@ -5,15 +5,9 @@ ## Execute a domain transition to run accountsd. ## ## -<<<<<<< HEAD ## ## Domain allowed access. ## -======= -## -## Domain allowed access. -## ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## # interface(`accountsd_domtrans',` @@ -31,11 +25,7 @@ interface(`accountsd_domtrans',` ## ## ## -<<<<<<< HEAD ## Domain to not audit. -======= -## Domain allowed access. ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## ## # @@ -128,7 +118,6 @@ interface(`accountsd_manage_lib_files',` ######################################## ## -<<<<<<< HEAD ## Execute accountsd server in the accountsd domain. ## ## @@ -152,8 +141,6 @@ interface(`accountsd_systemctl',` ######################################## ## -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## All of the rules required to administrate ## an accountsd environment ## @@ -172,7 +159,6 @@ interface(`accountsd_systemctl',` interface(`accountsd_admin',` gen_require(` type accountsd_t; -<<<<<<< HEAD type accountsd_unit_file_t; ') @@ -188,12 +174,4 @@ interface(`accountsd_admin',` accountsd_systemctl($1) admin_pattern($1, accountsd_unit_file_t) allow $1 accountsd_unit_file_t:service all_service_perms; -======= - ') - - allow $1 accountsd_t:process { ptrace signal_perms getattr }; - ps_process_pattern($1, accountsd_t) - - accountsd_manage_lib_files($1) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') diff --git a/accountsd.te b/accountsd.te index 7e9b5fe..67cd103 100644 --- a/accountsd.te +++ b/accountsd.te @@ -1,12 +1,9 @@ policy_module(accountsd, 1.0.0) -<<<<<<< HEAD gen_require(` class passwd { passwd chfn chsh rootok crontab }; ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # Declarations @@ -15,69 +12,46 @@ gen_require(` type accountsd_t; type accountsd_exec_t; dbus_system_domain(accountsd_t, accountsd_exec_t) -<<<<<<< HEAD init_daemon_domain(accountsd_t, accountsd_exec_t) role system_r types accountsd_t; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 type accountsd_var_lib_t; files_type(accountsd_var_lib_t) -<<<<<<< HEAD type accountsd_unit_file_t; systemd_unit_file(accountsd_unit_file_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # accountsd local policy # -<<<<<<< HEAD allow accountsd_t self:capability { dac_override setuid setgid }; allow accountsd_t self:process signal; allow accountsd_t self:fifo_file rw_fifo_file_perms; allow accountsd_t self:passwd { rootok passwd chfn chsh }; -======= -allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace }; -allow accountsd_t self:fifo_file rw_fifo_file_perms; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 manage_dirs_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t) manage_files_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t) files_var_lib_filetrans(accountsd_t, accountsd_var_lib_t, { file dir }) -<<<<<<< HEAD kernel_read_system_state(accountsd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 kernel_read_kernel_sysctls(accountsd_t) corecmd_exec_bin(accountsd_t) -<<<<<<< HEAD dev_read_sysfs(accountsd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 files_read_usr_files(accountsd_t) files_read_mnt_files(accountsd_t) fs_list_inotifyfs(accountsd_t) -<<<<<<< HEAD fs_getattr_xattr_fs(accountsd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 fs_read_noxattr_fs_files(accountsd_t) auth_use_nsswitch(accountsd_t) auth_read_shadow(accountsd_t) -<<<<<<< HEAD auth_read_login_records(accountsd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 miscfiles_read_localization(accountsd_t) @@ -92,21 +66,15 @@ usermanage_domtrans_passwd(accountsd_t) optional_policy(` consolekit_read_log(accountsd_t) -<<<<<<< HEAD consolekit_dbus_chat(accountsd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` policykit_dbus_chat(accountsd_t) ') -<<<<<<< HEAD optional_policy(` xserver_read_state_xdm(accountsd_t) xserver_dbus_chat_xdm(accountsd_t) xserver_manage_xdm_etc_files(accountsd_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4