Changeset 2736

Show
Ignore:
Timestamp:
06/25/08 08:39:11 (4 months ago)
Author:
cpebenito
Message:

rbacsep: switch over su to role template convention.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/rbacsep/policy/modules/admin/su.if

    r2735 r2736  
    129129####################################### 
    130130## <summary> 
    131 ##      The per role template for the su module. 
     131##      The role template for the su module. 
    132132## </summary> 
    133 ## <desc> 
    134 ##      <p> 
    135 ##      This template creates a derived domain which is allowed 
    136 ##      to change the linux user id, to run shells as a different 
    137 ##      user. 
    138 ##      </p> 
    139 ##      <p> 
    140 ##      This template is invoked automatically for each user, and 
    141 ##      generally does not need to be invoked directly 
    142 ##      by policy writers. 
    143 ##      </p> 
    144 ## </desc> 
    145 ## <param name="userdomain_prefix"> 
    146 ##      <summary> 
    147 ##      The prefix of the user domain (e.g., user 
    148 ##      is the prefix for user_t). 
     133## <param name="role_prefix"> 
     134##      <summary> 
     135##      The prefix of the user role (e.g., user 
     136##      is the prefix for user_r). 
     137##      </summary> 
     138## </param> 
     139## <param name="user_role"> 
     140##      <summary> 
     141##      The role associated with the user domain. 
    149142##      </summary> 
    150143## </param> 
    …… 
    154147##      </summary> 
    155148## </param> 
    156 ## <param name="user_role"> 
    157 ##      <summary> 
    158 ##      The role associated with the user domain. 
    159 ##      </summary> 
    160 ## </param> 
    161149# 
    162 template(`su_per_role_template',` 
     150template(`su_role_template',` 
    163151        gen_require(` 
    164                 attribute su_domain_type; 
    165152                type su_exec_t; 
    166153                bool secure_mode; 
    167154        ') 
    168155 
    169         type $1_su_t, su_domain_type; 
     156        type $1_su_t; 
    170157        domain_entry_file($1_su_t,su_exec_t) 
    171158        domain_type($1_su_t) 
    172159        domain_interactive_fd($1_su_t) 
    173         role $3 types $1_su_t; 
    174  
    175         allow $2 $1_su_t:process signal; 
     160        role $2 types $1_su_t; 
     161 
     162        allow $3 $1_su_t:process signal; 
    176163 
    177164        allow $1_su_t self:capability { audit_control audit_write setuid setgid net_bind_service chown dac_override fowner sys_nice sys_resource }; 
    …… 
    183170 
    184171        # Transition from the user domain to this domain. 
    185         domtrans_pattern($2, su_exec_t, $1_su_t) 
     172        domtrans_pattern($3, su_exec_t, $1_su_t) 
     173 
     174        ps_process_pattern($3, $1_su_t) 
    186175 
    187176        # By default, revert to the calling domain when a shell is executed. 
    188         corecmd_shell_domtrans($1_su_t,$2) 
    189         allow $2 $1_su_t:fd use; 
    190         allow $2 $1_su_t:fifo_file rw_file_perms; 
    191         allow $2 $1_su_t:process sigchld; 
     177        corecmd_shell_domtrans($1_su_t, $3) 
     178        allow $3 $1_su_t:fd use; 
     179        allow $3 $1_su_t:fifo_file rw_file_perms; 
     180        allow $3 $1_su_t:process sigchld; 
    192181 
    193182        kernel_read_system_state($1_su_t) 
    …… 
    204193        selinux_compute_access_vector($1_su_t) 
    205194 
    206         auth_domtrans_user_chk_passwd($1,$1_su_t) 
    207         auth_dontaudit_read_shadow($1_su_t) 
     195        auth_domtrans_chk_passwd($1_su_t) 
    208196        auth_use_nsswitch($1_su_t) 
    209197        auth_rw_faillog($1_su_t) 
    …… 
    231219        miscfiles_read_localization($1_su_t) 
    232220 
    233         userdom_use_user_terminals($1,$1_su_t) 
    234         userdom_search_user_home_dirs($1,$1_su_t) 
     221        userdom_use_user_terminals($1_su_t) 
     222        userdom_search_user_home_dirs($1_su_t) 
    235223 
    236224        ifdef(`distro_rhel4',` 
    …… 
    292280        # Modify .Xauthority file (via xauth program). 
    293281        optional_policy(` 
    294                 xserver_user_home_dir_filetrans_user_xauth($1, su_domain_type) 
    295                 xserver_domtrans_user_xauth($1, $1_su_t) 
    296         ') 
    297  
    298         ifdef(`TODO',` 
    299         allow $1_su_t $1_home_t:file manage_file_perms; 
    300  
    301         # Access sshd cookie files. 
    302         allow $1_su_t sshd_tmp_t:file rw_file_perms; 
    303         file_type_auto_trans($1_su_t, sshd_tmp_t, $1_tmp_t) 
    304         ') dnl end TODO 
     282                xserver_user_home_dir_filetrans_user_xauth($1_su_t) 
     283                xserver_domtrans_xauth($1_su_t) 
     284        ') 
    305285') 
    306286 

  • branches/rbacsep/policy/modules/admin/su.te

    r2735 r2736  
    77# 
    88 
    9 attribute su_domain_type; 
    10  
    119type su_exec_t; 
    1210corecmd_executable_file(su_exec_t) 

  • branches/rbacsep/policy/modules/roles/auditadm.te

    r2727 r2736  
    141141 
    142142optional_policy(` 
    143         su_role(auditadm_r, auditadm_t) 
     143        su_role_template(auditadm, auditadm_r, auditadm_t) 
    144144') 
    145145 

  • branches/rbacsep/policy/modules/roles/secadm.te

    r2727 r2736  
    153153 
    154154optional_policy(` 
    155         su_role(secadm_r, secadm_t) 
     155        su_role_template(secadm, secadm_r, secadm_t) 
    156156') 
    157157 

  • branches/rbacsep/policy/modules/roles/staff.te

    r2727 r2736  
    121121 
    122122optional_policy(` 
    123         su_role(staff_r, staff_t) 
     123        su_role_template(staff, staff_r, staff_t) 
    124124') 
    125125 

  • branches/rbacsep/policy/modules/roles/sysadm.te

    r2727 r2736  
    359359 
    360360optional_policy(` 
    361         su_role(sysadm_r, sysadm_t) 
     361        su_role_template(sysadm, sysadm_r, sysadm_t) 
    362362') 
    363363 

  • branches/rbacsep/policy/modules/roles/unprivuser.te

    r2689 r2736  
    111111 
    112112optional_policy(` 
    113         su_role(user_r, user_t) 
     113        su_role_template(user, user_r, user_t) 
    114114') 
    115115