Changeset 2679

Timestamp:

05/12/08 09:08:02 (7 months ago)

Author:

pebenito

Message:

rbacsep: initial collapse of user terminals.

Files:

• branches/rbacsep/policy/modules/system/userdomain.if (modified) (13 diffs)
• branches/rbacsep/policy/modules/system/userdomain.te (modified) (1 diff)

branches/rbacsep/policy/modules/system/userdomain.if

@@ -26 +26 @@
-        gen_require(`
-                attribute userdomain;
+                type user_devpts_t, user_tty_device_t;
-                class context contains;
-        ')
@@ -39 +40 @@
-        allow system_r $1_r;
-
-
-
-
-
-
-
+
+
+
+
+
-
-        allow $1_t self:process { signal_perms getsched setsched share getpgid setpgid setcap getsession getattr };
@@ -58 +58 @@
-        dontaudit $1_t self:socket create;
-
-
-
-
-
+
+
+
+
+
+
+
-
-        kernel_read_kernel_sysctls($1_t)
@@ -609 +612 @@
-template(`userdom_change_password_template',`
-        gen_require(`
-$1_devpts_t, $1
+user_devpts_t, user
-                role $1_r;
-        ')
-
-        optional_policy(`
-$1_devpts_t $1
-$1_devpts_t $1
+user_devpts_t user
+user_devpts_t user
-        ')
-')
@@ -621 +624 @@
-#######################################
-## <summary>
-
+  (Deprecated)
-## </summary>
-## <param name="src_role_prefix">
@@ -637 +640 @@
-#
-template(`userdom_role_change_template',`
+        refpolicywarn(`$0($*) has been deprecated, use a regular role allow statement instead.')
+
-        gen_require(`
-                role $1_r, $2_r;
-                type $1_t, $2_t;
-                type $1_devpts_t, $2_devpts_t;
-                type $1_tty_device_t, $2_tty_device_t;
-        ')
-
-        allow $1_r $2_r;
-        type_change $2_t $1_devpts_t:chr_file $2_devpts_t;
-        type_change $2_t $1_tty_device_t:chr_file $2_tty_device_t;
-        # avoid annoying messages on terminal hangup
-        dontaudit $1_t { $2_devpts_t $2_tty_device_t }:chr_file ioctl;
-')
-
@@ -738 +736 @@
-        auth_read_login_records($1_t)
-        auth_search_pam_console_data($1_t)
-$1_tty_device_t $1
-$1_tty_device_t $1
+user_tty_device_t user
+user_tty_device_t user
-
-        init_read_utmp($1_t)
@@ -745 +743 @@
-        seutil_read_file_contexts($1_t)
-        seutil_read_default_contexts($1_t)
-$1_devpts_t $1
+user_devpts_t user
-        seutil_exec_checkpolicy($1_t)
-        seutil_exec_setfiles($1_t)
@@ -873 +871 @@
-
-        optional_policy(`
-$1_devpts_t $1
+user_devpts_t user
-        ')
-')
@@ -1020 +1018 @@
-        domain_interactive_fd($1_t)
-
-        typeattribute $1_devpts_t user_ptynode;
-        typeattribute $1_home_dir_t user_home_dir_type;
-        typeattribute $1_home_t user_home_type;
-        typeattribute $1_tmp_t user_tmpfile;
-        typeattribute $1_tty_device_t user_ttynode;
-
-        ##############################
@@ -1040 +1036 @@
-
-        optional_policy(`
-$1
+ user
-        ')
-')
@@ -1198 +1194 @@
-
-        optional_policy(`
-$1_tty_device_t $1
-$1_tty_device_t $1
+user_tty_device_t user
+user_tty_device_t user
-        ')
-
-        # Run pppd in pppd_t by default for user
-        optional_policy(`
-$1_tty_device_t $1
+user_tty_device_t user
-        ')
-
@@ -1263 +1259 @@
-                domain_system_change_exemption($1_t)
-        ')
-        
-        typeattribute $1_devpts_t admin_terminal;
-
-        typeattribute $1_tty_device_t admin_terminal;
-
-        ##############################

branches/rbacsep/policy/modules/system/userdomain.te

@@ -85 +85 @@
-attribute untrusted_content_type;
-attribute untrusted_content_tmp_type;
+
+type user_devpts_t alias { staff_devpts_t sysadm_devpts_t secadm_devpts_t auditadm_devpts_t unconfined_devpts_t };
+dev_node(user_devpts_t)
+files_type(user_devpts_t)
+
+type user_tty_device_t alias { staff_tty_device_t sysadm_tty_device_t secadm_tty_device_t auditadm_tty_device_t unconfined_tty_device_t };
+dev_node(user_tty_device_t)