Changeset 2738

Show
Ignore:
Timestamp:
06/25/08 14:39:10 (4 months ago)
Author:
cpebenito
Message:

rbacsep: switch over screen to role template convention.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/rbacsep/policy/modules/apps/screen.if

    r2737 r2738  
    33####################################### 
    44## <summary> 
    5 ##      The per role template for the screen module. 
     5##      The role template for the screen module. 
    66## </summary> 
    7 ## <desc> 
    8 ##      <p> 
    9 ##      This template creates a derived domains which are used 
    10 ##      for screen sessions. 
    11 ##      </p> 
    12 ##      <p> 
    13 ##      This template is invoked automatically for each user, and 
    14 ##      generally does not need to be invoked directly 
    15 ##      by policy writers. 
    16 ##      </p> 
    17 ## </desc> 
    18 ## <param name="userdomain_prefix"> 
     7## <param name="role_prefix"> 
    198##      <summary> 
    20 ##      The prefix of the user domain (e.g., user 
    21 ##      is the prefix for user_t). 
     9##      The prefix of the user role (e.g., user 
     10##      is the prefix for user_r). 
     11##      </summary> 
     12## </param> 
     13## <param name="user_role"> 
     14##      <summary> 
     15##      The role associated with the user domain. 
    2216##      </summary> 
    2317## </param> 
    …… 
    2721##      </summary> 
    2822## </param> 
    29 ## <param name="user_role"> 
    30 ##      <summary> 
    31 ##      The role associated with the user domain. 
    32 ##      </summary> 
    33 ## </param> 
    3423# 
    35 template(`screen_per_role_template',` 
     24template(`screen_role_template',` 
    3625        gen_require(` 
    3726                type screen_dir_t, screen_exec_t; 
    …… 
    4433 
    4534        type $1_screen_t; 
    46         application_domain($1_screen_t,screen_exec_t) 
     35        application_domain($1_screen_t, screen_exec_t) 
    4736        domain_interactive_fd($1_screen_t) 
    48         role $3 types $1_screen_t; 
     37        role $2 types $1_screen_t; 
    4938 
    50         type $1_screen_tmp_t; 
    51         files_tmp_file($1_screen_tmp_t) 
    52  
    53         type $1_screen_ro_home_t; 
    54         files_type($1_screen_ro_home_t) 
    55  
    56         type $1_screen_var_run_t; 
    57         files_pid_file($1_screen_var_run_t) 
    58          
    5939        ######################################## 
    6040        # 
    …… 
    7151        allow $1_screen_t self:unix_dgram_socket create_socket_perms; 
    7252 
    73         manage_dirs_pattern($1_screen_t,$1_screen_tmp_t,$1_screen_tmp_t) 
    74         manage_files_pattern($1_screen_t,$1_screen_tmp_t,$1_screen_tmp_t) 
    75         manage_fifo_files_pattern($1_screen_t,$1_screen_tmp_t,$1_screen_tmp_t) 
    76         files_tmp_filetrans($1_screen_t, $1_screen_tmp_t, { file dir }) 
     53        manage_dirs_pattern($1_screen_t, screen_tmp_t, screen_tmp_t) 
     54        manage_files_pattern($1_screen_t, screen_tmp_t, screen_tmp_t) 
     55        manage_fifo_files_pattern($1_screen_t, screen_tmp_t, screen_tmp_t) 
     56        files_tmp_filetrans($1_screen_t, screen_tmp_t, { file dir }) 
    7757 
    7858        # Create fifo 
    79         manage_fifo_files_pattern($1_screen_t,screen_dir_t,$1_screen_var_run_t) 
    80         manage_dirs_pattern($1_screen_t,screen_dir_t,screen_dir_t) 
    81         filetrans_pattern($1_screen_t,screen_dir_t,$1_screen_var_run_t,fifo_file) 
    82         files_pid_filetrans($1_screen_t,screen_dir_t,dir) 
     59        manage_fifo_files_pattern($1_screen_t, screen_dir_t, screen_var_run_t) 
     60        manage_dirs_pattern($1_screen_t, screen_dir_t, screen_dir_t) 
     61        filetrans_pattern($1_screen_t, screen_dir_t, screen_var_run_t, fifo_file) 
     62        files_pid_filetrans($1_screen_t, screen_dir_t, dir) 
    8363 
    84         allow $1_screen_t $1_screen_ro_home_t:dir list_dir_perms; 
    85         read_files_pattern($1_screen_t,$1_screen_ro_home_t,$1_screen_ro_home_t) 
    86         read_lnk_files_pattern($1_screen_t,$1_screen_ro_home_t,$1_screen_ro_home_t) 
     64        allow $1_screen_t screen_home_t:dir list_dir_perms; 
     65        read_files_pattern($1_screen_t, screen_home_t, screen_home_t) 
     66        read_lnk_files_pattern($1_screen_t, screen_home_t, screen_home_t) 
    8767 
    88         allow $1_screen_t $2:process signal; 
     68        allow $1_screen_t $3:process signal; 
    8969 
    90         domtrans_pattern($2, screen_exec_t, $1_screen_t) 
    91         allow $2 $1_screen_t:process signal; 
    92         allow $1_screen_t $2:process signal; 
     70        domtrans_pattern($3, screen_exec_t, $1_screen_t) 
     71        allow $3 $1_screen_t:process signal; 
     72        allow $1_screen_t $3:process signal; 
    9373 
    94         manage_dirs_pattern($2,$1_screen_ro_home_t,$1_screen_ro_home_t) 
    95         manage_files_pattern($2,$1_screen_ro_home_t,$1_screen_ro_home_t) 
    96         manage_lnk_files_pattern($2,$1_screen_ro_home_t,$1_screen_ro_home_t) 
    97         relabel_dirs_pattern($2,$1_screen_ro_home_t,$1_screen_ro_home_t) 
    98         relabel_files_pattern($2,$1_screen_ro_home_t,$1_screen_ro_home_t) 
    99         relabel_lnk_files_pattern($2,$1_screen_ro_home_t,$1_screen_ro_home_t) 
     74        manage_dirs_pattern($3, screen_home_t, screen_home_t) 
     75        manage_files_pattern($3, screen_home_t, screen_home_t) 
     76        manage_lnk_files_pattern($3, screen_home_t, screen_home_t) 
     77        relabel_dirs_pattern($3, screen_home_t,  screen_home_t) 
     78        relabel_files_pattern($3, screen_home_t, screen_home_t) 
     79        relabel_lnk_files_pattern($3, screen_home_t, screen_home_t) 
    10080         
    10181        kernel_read_system_state($1_screen_t) 
    …… 
    10888        corecmd_read_bin_sockets($1_screen_t) 
    10989        # Revert to the user domain when a shell is executed. 
    110         corecmd_shell_domtrans($1_screen_t,$2) 
    111         corecmd_bin_domtrans($1_screen_t,$2) 
     90        corecmd_shell_domtrans($1_screen_t, $3) 
     91        corecmd_bin_domtrans($1_screen_t, $3) 
    11292 
    11393        corenet_all_recvfrom_unlabeled($1_screen_t) 
    …… 
    154134        sysnet_read_config($1_screen_t) 
    155135 
    156         userdom_use_user_terminals($1,$1_screen_t) 
    157         userdom_create_user_pty($1,$1_screen_t) 
    158         userdom_user_home_domtrans($1,$1_screen_t,$2) 
    159         userdom_setattr_user_ptys($1,$1_screen_t) 
     136        userdom_use_user_terminals($1_screen_t) 
     137        userdom_create_user_pty($1_screen_t) 
     138        userdom_user_home_domtrans($1_screen_t, $3) 
     139        userdom_setattr_user_ptys($1_screen_t) 
    160140 
    161141        tunable_policy(`read_default_t',` 
    …… 
    168148 
    169149        tunable_policy(`use_samba_home_dirs',` 
    170                 fs_cifs_domtrans($1_screen_t,$2) 
     150                fs_cifs_domtrans($1_screen_t, $3) 
    171151                fs_read_cifs_symlinks($1_screen_t) 
    172152                fs_list_cifs($1_screen_t) 
    …… 
    174154 
    175155        tunable_policy(`use_nfs_home_dirs',` 
    176                 fs_nfs_domtrans($1_screen_t,$2) 
     156                fs_nfs_domtrans($1_screen_t, $3) 
    177157                fs_list_nfs($1_screen_t) 
    178158                fs_read_nfs_symlinks($1_screen_t) 

  • branches/rbacsep/policy/modules/apps/screen.te

    r2737 r2738  
    1212type screen_exec_t; 
    1313application_executable_file(screen_exec_t) 
     14 
     15type screen_tmp_t; 
     16files_tmp_file(screen_tmp_t) 
     17 
     18type screen_home_t; 
     19userdom_user_home_content(screen_home_t) 
     20 
     21type screen_var_run_t; 
     22files_pid_file(screen_var_run_t) 

  • branches/rbacsep/policy/modules/roles/auditadm.te

    r2736 r2738  
    125125 
    126126optional_policy(` 
    127         screen_role(auditadm_r, auditadm_t) 
     127        screen_role_template(auditadm, auditadm_r, auditadm_t) 
    128128') 
    129129 

  • branches/rbacsep/policy/modules/roles/secadm.te

    r2736 r2738  
    137137 
    138138optional_policy(` 
    139         screen_role(secadm_r, secadm_t) 
     139        screen_role_template(secadm, secadm_r, secadm_t) 
    140140') 
    141141 

  • branches/rbacsep/policy/modules/roles/staff.te

    r2736 r2738  
    105105 
    106106optional_policy(` 
    107         screen_role(staff_r, staff_t) 
     107        screen_role_template(staff, staff_r, staff_t) 
    108108') 
    109109 

  • branches/rbacsep/policy/modules/roles/sysadm.te

    r2736 r2738  
    334334 
    335335optional_policy(` 
    336         screen_role(sysadm_r, sysadm_t) 
     336        screen_role_template(sysadm, sysadm_r, sysadm_t) 
    337337') 
    338338 

  • branches/rbacsep/policy/modules/roles/unprivuser.te

    r2736 r2738  
    9999 
    100100optional_policy(` 
    101         screen_role(user_r, user_t) 
     101        screen_role_template(user, user_r, user_t) 
    102102') 
    103103