diff --git a/refpolicy/Changelog b/refpolicy/Changelog index 95edd9a..456d58f 100644 --- a/refpolicy/Changelog +++ b/refpolicy/Changelog @@ -1,3 +1,5 @@ +- Merge systemuser back in to users, as these files + do not need to be split. - Add check for duplicate interface/template definitions. - Move domain, files, and corecommands modules to kernel layer to resolve some layering inconsistencies. diff --git a/refpolicy/Makefile b/refpolicy/Makefile index f9ce2b6..0e39ad2 100644 --- a/refpolicy/Makefile +++ b/refpolicy/Makefile @@ -139,7 +139,7 @@ APPCONF := config/appconfig-$(TYPE) APPDIR := $(CONTEXTPATH) APPFILES := $(addprefix $(APPDIR)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts) $(CONTEXTPATH)/files/media CONTEXTFILES += $(wildcard $(APPCONF)/*_context*) $(APPCONF)/media -USER_FILES := $(POLDIR)/systemuser $(POLDIR)/users +USER_FILES := $(POLDIR)/users ALL_LAYERS := $(filter-out $(MODDIR)/CVS,$(shell find $(wildcard $(MODDIR)/*) -maxdepth 0 -type d)) diff --git a/refpolicy/policy/systemuser b/refpolicy/policy/systemuser deleted file mode 100644 index 5b0cf0b..0000000 --- a/refpolicy/policy/systemuser +++ /dev/null @@ -1,19 +0,0 @@ -################################## -# -# System User configuration. -# - -# -# gen_user(username, role_set, mls_defaultlevel, mls_range, [mcs_categories]) -# - -# -# system_u is the user identity for system processes and objects. -# There should be no corresponding Unix user identity for system, -# and a user process should never be assigned the system user -# identity. -# -gen_user(system_u, system_r, s0, s0 - s15:c0.c255, c0.c255) - -# Normal users should not be added to this file, -# but instead added to the users file. diff --git a/refpolicy/policy/users b/refpolicy/policy/users index 0dc5772..5327ab7 100644 --- a/refpolicy/policy/users +++ b/refpolicy/policy/users @@ -9,6 +9,14 @@ # # +# system_u is the user identity for system processes and objects. +# There should be no corresponding Unix user identity for system, +# and a user process should never be assigned the system user +# identity. +# +gen_user(system_u, system_r, s0, s0 - s15:c0.c255, c0.c255) + +# # user_u is a generic user identity for Linux users who have no # SELinux user identity defined. The modified daemons will use # this user identity in the security context if there is no matching