Changeset 2790 for branches

Show
Ignore:
Timestamp:
08/27/08 12:53:52 (3 months ago)
Author:
cpebenito
Message:

rbacsep: add remaining compatability aliases.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/rbacsep/policy/modules/admin/su.if

    r2782 r2790  
    150150template(`su_role_template',` 
    151151        gen_require(` 
     152                attribute su_domain_type; 
    152153                type su_exec_t; 
    153154                bool secure_mode; 
    154155        ') 
    155156 
    156         type $1_su_t; 
     157        type $1_su_t, su_domain_type; 
    157158        domain_entry_file($1_su_t,su_exec_t) 
    158159        domain_type($1_su_t) 

  • branches/rbacsep/policy/modules/admin/su.te

    r2782 r2790  
    77# 
    88 
     9attribute su_domain_type; 
     10 
    911type su_exec_t; 
    1012corecmd_executable_file(su_exec_t) 

  • branches/rbacsep/policy/modules/apps/cdrecord.te

    r2782 r2790  
    1818type cdrecord_t; 
    1919type cdrecord_exec_t; 
     20typealias cdrecord_t alias { user_cdrecord_t staff_cdrecord_t sysadm_cdrecord_t }; 
     21typealias cdrecord_t alias { auditadm_cdrecord_t secadm_cdrecord_t }; 
    2022application_domain(cdrecord_t, cdrecord_exec_t) 
    2123ubac_constrained(cdrecord_t) 

  • branches/rbacsep/policy/modules/apps/ethereal.te

    r2782 r2790  
    99type ethereal_t; 
    1010type ethereal_exec_t; 
     11typealias ethereal_t alias { user_ethereal_t staff_ethereal_t sysadm_ethereal_t }; 
     12typealias ethereal_t alias { auditadm_ethereal_t secadm_ethereal_t }; 
    1113application_domain(ethereal_t, ethereal_exec_t) 
    1214ubac_constrained(ethereal_t) 
    1315 
    1416type ethereal_home_t; 
     17typealias ethereal_home_t alias { user_ethereal_home_t staff_ethereal_home_t sysadm_ethereal_home_t }; 
     18typealias ethereal_home_t alias { auditadm_ethereal_home_t secadm_ethereal_home_t }; 
    1519files_poly_member(ethereal_home_t) 
    1620userdom_user_home_content(ethereal_home_t) 
    1721 
    1822type ethereal_tmp_t; 
     23typealias ethereal_tmp_t alias { user_ethereal_tmp_t staff_ethereal_tmp_t sysadm_ethereal_tmp_t }; 
     24typealias ethereal_tmp_t alias { auditadm_ethereal_tmp_t secadm_ethereal_tmp_t }; 
    1925files_tmp_file(ethereal_tmp_t) 
    2026ubac_constrained(ethereal_tmp_t) 
    2127 
    2228type ethereal_tmpfs_t; 
     29typealias ethereal_tmpfs_t alias { user_ethereal_tmpfs_t staff_ethereal_tmpfs_t sysadm_ethereal_tmpfs_t }; 
     30typealias ethereal_tmpfs_t alias { auditadm_ethereal_tmpfs_t secadm_ethereal_tmpfs_t }; 
    2331files_tmpfs_file(ethereal_tmpfs_t) 
    2432ubac_constrained(ethereal_tmpfs_t) 

  • branches/rbacsep/policy/modules/apps/evolution.te

    r2782 r2790  
    99type evolution_t; 
    1010type evolution_exec_t; 
     11typealias evolution_t alias { user_evolution_t staff_evolution_t sysadm_evolution_t }; 
     12typealias evolution_t alias { auditadm_evolution_t secadm_evolution_t }; 
    1113application_domain(evolution_t, evolution_exec_t) 
    1214ubac_constrained(evolution_t) 
    …… 
    1416type evolution_alarm_t; 
    1517type evolution_alarm_exec_t; 
     18typealias evolution_alarm_t alias { user_evolution_alarm_t staff_evolution_alarm_t sysadm_evolution_alarm_t }; 
     19typealias evolution_alarm_t alias { auditadm_evolution_alarm_t secadm_evolution_alarm_t }; 
    1620application_domain(evolution_alarm_t, evolution_alarm_exec_t) 
    1721ubac_constrained(evolution_alarm_t) 
    1822 
    1923type evolution_alarm_tmpfs_t; 
     24typealias evolution_alarm_tmpfs_t alias { user_evolution_alarm_tmpfs_t staff_evolution_alarm_tmpfs_t sysadm_evolution_alarm_tmpfs_t }; 
     25typealias evolution_alarm_tmpfs_t alias { auditadm_evolution_alarm_tmpfs_t secadm_evolution_alarm_tmpfs_t }; 
    2026files_tmpfs_file(evolution_alarm_tmpfs_t) 
    2127ubac_constrained(evolution_alarm_tmpfs_t) 
    2228 
    2329type evolution_alarm_orbit_tmp_t; 
     30typealias evolution_alarm_orbit_tmp_t alias { user_evolution_alarm_orbit_tmp_t staff_evolution_alarm_orbit_tmp_t sysadm_evolution_alarm_orbit_tmp_t }; 
     31typealias evolution_alarm_orbit_tmp_t alias { auditadm_evolution_alarm_orbit_tmp_t secadm_evolution_alarm_orbit_tmp_t }; 
    2432files_tmp_file(evolution_alarm_orbit_tmp_t) 
    2533ubac_constrained(evolution_alarm_orbit_tmp_t) 
    …… 
    2735type evolution_exchange_t; 
    2836type evolution_exchange_exec_t; 
     37typealias evolution_exchange_t alias { user_evolution_exchange_t staff_evolution_exchange_t sysadm_evolution_exchange_t }; 
     38typealias evolution_exchange_t alias { auditadm_evolution_exchange_t secadm_evolution_exchange_t }; 
    2939application_domain(evolution_exchange_t, evolution_exchange_exec_t) 
    3040ubac_constrained(evolution_exchange_t) 
    3141 
    3242type evolution_exchange_tmpfs_t; 
     43typealias evolution_exchange_tmpfs_t alias { user_evolution_exchange_tmpfs_t staff_evolution_exchange_tmpfs_t sysadm_evolution_exchange_tmpfs_t }; 
     44typealias evolution_exchange_tmpfs_t alias { auditadm_evolution_exchange_tmpfs_t secadm_evolution_exchange_tmpfs_t }; 
    3345files_tmpfs_file(evolution_exchange_tmpfs_t) 
    3446ubac_constrained(evolution_exchange_tmpfs_t) 
    3547 
    3648type evolution_exchange_tmp_t; 
     49typealias evolution_exchange_tmp_t alias { user_evolution_exchange_tmp_t staff_evolution_exchange_tmp_t sysadm_evolution_exchange_tmp_t }; 
     50typealias evolution_exchange_tmp_t alias { auditadm_evolution_exchange_tmp_t secadm_evolution_exchange_tmp_t }; 
    3751files_tmp_file(evolution_exchange_tmp_t) 
    3852ubac_constrained(evolution_exchange_tmp_t) 
    3953 
    4054type evolution_exchange_orbit_tmp_t; 
     55typealias evolution_exchange_orbit_tmp_t alias { user_evolution_exchange_orbit_tmp_t staff_evolution_exchange_orbit_tmp_t sysadm_evolution_exchange_orbit_tmp_t }; 
     56typealias evolution_exchange_orbit_tmp_t alias { auditadm_evolution_exchange_orbit_tmp_t secadm_evolution_exchange_orbit_tmp_t }; 
    4157files_tmp_file(evolution_exchange_orbit_tmp_t) 
    4258ubac_constrained(evolution_exchange_orbit_tmp_t) 
    4359 
    4460type evolution_home_t; 
     61typealias evolution_home_t alias { user_evolution_home_t staff_evolution_home_t sysadm_evolution_home_t }; 
     62typealias evolution_home_t alias { auditadm_evolution_home_t secadm_evolution_home_t }; 
    4563files_poly_member(evolution_home_t) 
    4664userdom_user_home_content(evolution_home_t) 
    4765 
    4866type evolution_orbit_tmp_t; 
     67typealias evolution_home_t alias { user_evolution_orbit_tmp_t staff_evolution_orbit_tmp_t sysadm_evolution_orbit_tmp_t }; 
     68typealias evolution_home_t alias { auditadm_evolution_orbit_tmp_t secadm_evolution_orbit_tmp_t }; 
    4969files_tmp_file(evolution_orbit_tmp_t) 
    5070ubac_constrained(evolution_orbit_tmp_t) 
    …… 
    5272type evolution_server_t; 
    5373type evolution_server_exec_t; 
     74typealias evolution_server_t alias { user_evolution_server_t staff_evolution_server_t sysadm_evolution_server_t }; 
     75typealias evolution_server_t alias { auditadm_evolution_server_t secadm_evolution_server_t }; 
    5476application_domain(evolution_server_t, evolution_server_exec_t) 
    5577ubac_constrained(evolution_server_t) 
    5678 
    5779type evolution_server_orbit_tmp_t; 
     80typealias evolution_server_orbit_tmp_t alias { user_evolution_server_orbit_tmp_t staff_evolution_server_orbit_tmp_t sysadm_evolution_server_orbit_tmp_t }; 
     81typealias evolution_server_orbit_tmp_t alias { auditadm_evolution_server_orbit_tmp_t secadm_evolution_server_orbit_tmp_t }; 
    5882files_tmp_file(evolution_server_orbit_tmp_t) 
    5983ubac_constrained(evolution_server_orbit_tmp_t) 
    6084 
    6185type evolution_tmpfs_t; 
     86typealias evolution_tmpfs_t alias { user_evolution_tmpfs_t staff_evolution_tmpfs_t sysadm_evolution_tmpfs_t }; 
     87typealias evolution_tmpfs_t alias { auditadm_evolution_tmpfs_t secadm_evolution_tmpfs_t }; 
    6288files_tmpfs_file(evolution_tmpfs_t) 
    6389ubac_constrained(evolution_tmpfs_t) 
    …… 
    6591type evolution_webcal_t; 
    6692type evolution_webcal_exec_t; 
     93typealias evolution_webcal_t alias { user_evolution_webcal_t staff_evolution_webcal_t sysadm_evolution_webcal_t }; 
     94typealias evolution_webcal_t alias { auditadm_evolution_webcal_t secadm_evolution_webcal_t }; 
    6795application_domain(evolution_webcal_t, evolution_webcal_exec_t) 
    6896ubac_constrained(evolution_webcal_t) 
    6997 
    7098type evolution_webcal_tmpfs_t; 
     99typealias evolution_webcal_tmpfs_t alias { user_evolution_webcal_tmpfs_t staff_evolution_webcal_tmpfs_t sysadm_evolution_webcal_tmpfs_t }; 
     100typealias evolution_webcal_tmpfs_t alias { auditadm_evolution_webcal_tmpfs_t secadm_evolution_webcal_tmpfs_t }; 
    71101files_tmpfs_file(evolution_webcal_tmpfs_t) 
    72102ubac_constrained(evolution_webcal_tmpfs_t) 

  • branches/rbacsep/policy/modules/apps/games.te

    r2759 r2790  
    77# 
    88 
     9type games_t; 
     10type games_exec_t; 
     11typealias games_t alias { user_games_t staff_games_t sysadm_games_t }; 
     12typealias games_t alias { auditadm_games_t secadm_games_t }; 
     13application_domain(games_t, games_exec_t) 
     14ubac_constrained(games_t) 
     15 
    916type games_data_t; 
     17typealias games_data_t alias { user_games_data_t staff_games_data_t sysadm_games_data_t }; 
     18typealias games_data_t alias { auditadm_games_data_t secadm_games_data_t }; 
    1019files_type(games_data_t) 
    1120ubac_constrained(games_data_t) 
    1221 
    13 type games_t; 
    14 type games_exec_t; 
    15 application_domain(games_t, games_exec_t) 
    16 ubac_constrained(games_t) 
    17  
    1822type games_devpts_t; 
     23typealias games_devpts_t alias { user_games_devpts_t staff_games_devpts_t sysadm_games_devpts_t }; 
     24typealias games_devpts_t alias { auditadm_games_devpts_t secadm_games_devpts_t }; 
    1925term_pty(games_devpts_t) 
    2026ubac_constrained(games_devpts_t) 
    …… 
    2935 
    3036type games_tmp_t; 
     37typealias games_tmp_t alias { user_games_tmp_t staff_games_tmp_t sysadm_games_tmp_t }; 
     38typealias games_tmp_t alias { auditadm_games_tmp_t secadm_games_tmp_t }; 
    3139files_tmp_file(games_tmp_t) 
    3240ubac_constrained(games_tmp_t) 
    3341 
    3442type games_tmpfs_t; 
     43typealias games_tmpfs_t alias { user_games_tmpfs_t staff_games_tmpfs_t sysadm_games_tmpfs_t }; 
     44typealias games_tmpfs_t alias { auditadm_games_tmpfs_t secadm_games_tmpfs_t }; 
    3545files_tmpfs_file(games_tmpfs_t) 
    3646ubac_constrained(games_tmpfs_t) 

  • branches/rbacsep/policy/modules/apps/gift.te

    r2782 r2790  
    99type gift_t; 
    1010type gift_exec_t; 
     11typealias gift_t alias { user_gift_t staff_gift_t sysadm_gift_t }; 
     12typealias gift_t alias { auditadm_gift_t secadm_gift_t }; 
    1113application_domain(gift_t, gift_exec_t) 
    1214ubac_constrained(gift_t) 
    1315 
    1416type gift_home_t; 
     17typealias gift_home_t alias { user_gift_home_t staff_gift_home_t sysadm_gift_home_t }; 
     18typealias gift_home_t alias { auditadm_gift_home_t secadm_gift_home_t }; 
    1519files_poly_member(gift_home_t) 
    1620userdom_user_home_content(gift_home_t) 
    1721 
    1822type gift_tmpfs_t; 
     23typealias gift_tmpfs_t alias { user_gift_tmpfs_t staff_gift_tmpfs_t sysadm_gift_tmpfs_t }; 
     24typealias gift_tmpfs_t alias { auditadm_gift_tmpfs_t secadm_gift_tmpfs_t }; 
    1925files_tmpfs_file(gift_tmpfs_t) 
    2026ubac_constrained(gift_tmpfs_t) 
    …… 
    2228type giftd_t; 
    2329type giftd_exec_t; 
     30typealias giftd_t alias { user_giftd_t staff_giftd_t sysadm_giftd_t }; 
     31typealias giftd_t alias { auditadm_giftd_t secadm_giftd_t }; 
    2432application_domain(giftd_t, giftd_exec_t) 
    2533ubac_constrained(giftd_t) 

  • branches/rbacsep/policy/modules/apps/gnome.te

    r2782 r2790  
    1313 
    1414type gconf_home_t; 
     15typealias gconf_home_t alias { user_gconf_home_t staff_gconf_home_t sysadm_gconf_home_t }; 
     16typealias gconf_home_t alias { auditadm_gconf_home_t secadm_gconf_home_t }; 
    1517userdom_user_home_content(gconf_home_t) 
     18 
     19type gconf_tmp_t; 
     20typealias gconf_tmp_t alias { user_gconf_tmp_t staff_gconf_tmp_t sysadm_gconf_tmp_t }; 
     21typealias gconf_tmp_t alias { auditadm_gconf_tmp_t secadm_gconf_tmp_t }; 
     22files_tmp_file(gconf_tmp_t) 
     23ubac_constrained(gconf_tmp_t) 
    1624 
    1725type gconfd_t, gnomedomain; 
    1826type gconfd_exec_t; 
     27typealias gconfd_t alias { user_gconfd_t staff_gconfd_t sysadm_gconfd_t }; 
     28typealias gconfd_t alias { auditadm_gconfd_t secadm_gconfd_t }; 
    1929application_domain(gconfd_t, gconfd_exec_t) 
    2030ubac_constrained(gconfd_t) 
    2131 
    2232type gnome_home_t; 
     33typealias gnome_home_t alias { user_gnome_home_t staff_gnome_home_t sysadm_gnome_home_t }; 
     34typealias gnome_home_t alias { auditadm_gnome_home_t secadm_gnome_home_t }; 
    2335userdom_user_home_content(gnome_home_t) 
    24  
    25 type gconf_tmp_t; 
    26 files_tmp_file(gconf_tmp_t) 
    27 ubac_constrained(gconf_tmp_t) 
    2836 
    2937############################## 

  • branches/rbacsep/policy/modules/apps/gpg.te

    r2759 r2790  
    1717type gpg_t; 
    1818type gpg_exec_t; 
     19typealias gpg_t alias { user_gpg_t staff_gpg_t sysadm_gpg_t }; 
     20typealias gpg_t alias { auditadm_gpg_t secadm_gpg_t }; 
    1921application_domain(gpg_t, gpg_exec_t) 
    2022ubac_constrained(gpg_t) 
    …… 
    2224type gpg_agent_t; 
    2325type gpg_agent_exec_t; 
     26typealias gpg_agent_t alias { user_gpg_agent_t staff_gpg_agent_t sysadm_gpg_agent_t }; 
     27typealias gpg_agent_t alias { auditadm_gpg_agent_t secadm_gpg_agent_t }; 
    2428application_domain(gpg_agent_t, gpg_agent_exec_t) 
    2529ubac_constrained(gpg_agent_t) 
    2630 
    2731type gpg_agent_tmp_t; 
     32typealias gpg_agent_tmp_t alias { user_gpg_agent_tmp_t staff_gpg_agent_tmp_t sysadm_gpg_agent_tmp_t }; 
     33typealias gpg_agent_tmp_t alias { auditadm_gpg_agent_tmp_t secadm_gpg_agent_tmp_t }; 
    2834files_tmp_file(gpg_agent_tmp_t) 
    2935ubac_constrained(gpg_agent_tmp_t) 
    3036 
    3137type gpg_secret_t; 
     38typealias gpg_secret_t alias { user_gpg_secret_t staff_gpg_secret_t sysadm_gpg_secret_t }; 
     39typealias gpg_secret_t alias { auditadm_gpg_secret_t secadm_gpg_secret_t }; 
    3240userdom_user_home_content(gpg_secret_t) 
    3341 
    3442type gpg_helper_t; 
    3543type gpg_helper_exec_t; 
     44typealias gpg_helper_t alias { user_gpg_helper_t staff_gpg_helper_t sysadm_gpg_helper_t }; 
     45typealias gpg_helper_t alias { auditadm_gpg_helper_t secadm_gpg_helper_t }; 
    3646application_domain(gpg_helper_t, gpg_helper_exec_t) 
    3747ubac_constrained(gpg_helper_t) 
    …… 
    3949type gpg_pinentry_t; 
    4050type pinentry_exec_t; 
     51typealias gpg_pinentry_t alias { user_gpg_pinentry_t staff_gpg_pinentry_t sysadm_gpg_pinentry_t }; 
     52typealias gpg_pinentry_t alias { auditadm_gpg_pinentry_t secadm_gpg_pinentry_t }; 
    4153application_domain(gpg_pinentry_t, pinentry_exec_t) 
    4254ubac_constrained(gpg_pinentry_t) 

  • branches/rbacsep/policy/modules/apps/irc.te

    r2782 r2790  
    77# 
    88 
    9  
    109type irc_t; 
    1110type irc_exec_t; 
     11typealias irc_t alias { user_irc_t staff_irc_t sysadm_irc_t }; 
     12typealias irc_t alias { auditadm_irc_t secadm_irc_t }; 
    1213application_domain(irc_t, irc_exec_t) 
    1314ubac_constrained(irc_t) 
    1415 
    1516type irc_home_t; 
     17typealias irc_home_t alias { user_irc_home_t staff_irc_home_t sysadm_irc_home_t }; 
     18typealias irc_home_t alias { auditadm_irc_home_t secadm_irc_home_t }; 
    1619userdom_user_home_content(irc_home_t) 
    1720 
    1821type irc_tmp_t; 
     22typealias irc_tmp_t alias { user_irc_tmp_t staff_irc_tmp_t sysadm_irc_tmp_t }; 
     23typealias irc_tmp_t alias { auditadm_irc_tmp_t secadm_irc_tmp_t }; 
    1924userdom_user_home_content(irc_tmp_t) 
    2025 

  • branches/rbacsep/policy/modules/apps/lockdev.te

    r2782 r2790  
    99type lockdev_t; 
    1010type lockdev_exec_t; 
     11typealias lockdev_t alias { user_lockdev_t staff_lockdev_t sysadm_lockdev_t }; 
     12typealias lockdev_t alias { auditadm_lockdev_t secadm_lockdev_t }; 
    1113application_domain(lockdev_t, lockdev_exec_t) 
    1214ubac_constrained(lockdev_t) 
    1315 
    1416type lockdev_lock_t; 
     17typealias lockdev_lock_t alias { user_lockdev_lock_t staff_lockdev_lock_t sysadm_lockdev_lock_t }; 
     18typealias lockdev_lock_t alias { auditadm_lockdev_lock_t secadm_lockdev_lock_t }; 
    1519files_lock_file(lockdev_lock_t) 
    1620ubac_constrained(lockdev_lock_t) 

  • branches/rbacsep/policy/modules/apps/mozilla.te

    r2782 r2790  
    1616type mozilla_t; 
    1717type mozilla_exec_t; 
     18typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t }; 
     19typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t }; 
    1820application_domain(mozilla_t, mozilla_exec_t) 
    1921ubac_constrained(mozilla_t) 
    …… 
    2325 
    2426type mozilla_home_t; 
     27typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t }; 
     28typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t }; 
    2529files_poly_member(mozilla_home_t) 
    2630userdom_user_home_content(mozilla_home_t) 
    2731 
    2832type mozilla_tmpfs_t; 
     33typealias mozilla_tmpfs_t alias { user_mozilla_tmpfs_t staff_mozilla_tmpfs_t sysadm_mozilla_tmpfs_t }; 
     34typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_t }; 
    2935files_tmpfs_file(mozilla_tmpfs_t) 
    3036ubac_constrained(mozilla_tmpfs_t) 

  • branches/rbacsep/policy/modules/apps/mplayer.te

    r2782 r2790  
    1616type mencoder_t; 
    1717type mencoder_exec_t; 
     18typealias mencoder_t alias { user_mencoder_t staff_mencoder_t sysadm_mencoder_t }; 
     19typealias mencoder_t alias { auditadm_mencoder_t secadm_mencoder_t }; 
    1820application_domain(mencoder_t, mencoder_exec_t) 
    1921ubac_constrained(mencoder_t) 
    …… 
    2123type mplayer_t; 
    2224type mplayer_exec_t; 
     25typealias mplayer_t alias { user_mplayer_t staff_mplayer_t sysadm_mplayer_t }; 
     26typealias mplayer_t alias { auditadm_mplayer_t secadm_mplayer_t }; 
    2327application_domain(mplayer_t, mplayer_exec_t) 
    2428ubac_constrained(mplayer_t) 
    …… 
    2832 
    2933type mplayer_home_t; 
     34typealias mplayer_home_t alias { user_mplayer_home_t staff_mplayer_home_t sysadm_mplayer_home_t }; 
     35typealias mplayer_home_t alias { auditadm_mplayer_home_t secadm_mplayer_home_t }; 
    3036files_poly_member(mplayer_home_t) 
    3137userdom_user_home_content(mplayer_home_t) 
    3238 
    3339type mplayer_tmpfs_t; 
     40typealias mplayer_tmpfs_t alias { user_mplayer_tmpfs_t staff_mplayer_tmpfs_t sysadm_mplayer_tmpfs_t }; 
     41typealias mplayer_tmpfs_t alias { auditadm_mplayer_tmpfs_t secadm_mplayer_tmpfs_t }; 
    3442files_tmpfs_file(mplayer_tmpfs_t) 
    3543ubac_constrained(mplayer_tmpfs_t) 

  • branches/rbacsep/policy/modules/apps/rssh.if

    r2726 r2790  
    6060interface(`rssh_read_all_users_ro_content',` 
    6161        gen_require(` 
    62                 attribute rssh_ro_content_type; 
     62                type rssh_ro_t; 
    6363        ') 
    6464 
    65         allow $1 rssh_ro_content_type:dir list_dir_perms; 
    66         read_files_pattern($1,rssh_ro_content_type,rssh_ro_content_type) 
    67         read_lnk_files_pattern($1,rssh_ro_content_type,rssh_ro_content_type) 
     65        allow $1 rssh_ro_t:dir list_dir_perms; 
     66        read_files_pattern($1, rssh_ro_t, rssh_ro_t) 
     67        read_lnk_files_pattern($1, rssh_ro_t, rssh_ro_t) 
     68        refpolicywarn(`$0() and/or $1 needs to be exempt on files.') 
    6869') 

  • branches/rbacsep/policy/modules/apps/rssh.te

    r2782 r2790  
    77# 
    88 
    9 attribute rssh_domain_type; 
    10 attribute rssh_ro_content_type; 
    11  
    12 type rssh_t, rssh_domain_type; 
     9type rssh_t; 
    1310type rssh_exec_t; 
     11typealias rssh_t alias { user_rssh_t staff_rssh_t sysadm_rssh_t }; 
     12typealias rssh_t alias { auditadm_rssh_t secadm_rssh_t }; 
    1413application_domain(rssh_t, rssh_exec_t) 
    1514domain_user_exemption_target(rssh_t) 
    …… 
    1918 
    2019type rssh_devpts_t; 
     20typealias rssh_devpts_t alias { user_rssh_devpts_t staff_rssh_devpts_t sysadm_rssh_devpts_t }; 
     21typealias rssh_devpts_t alias { auditadm_rssh_devpts_t secadm_rssh_devpts_t }; 
    2122term_user_pty(rssh_t, rssh_devpts_t) 
    2223ubac_constrained(rssh_devpts_t) 
    2324 
    24 type rssh_ro_t, rssh_ro_content_type; 
     25type rssh_ro_t; 
     26typealias rssh_ro_t alias { user_rssh_ro_t staff_rssh_ro_t sysadm_rssh_ro_t }; 
     27typealias rssh_ro_t alias { auditadm_rssh_ro_t secadm_rssh_ro_t }; 
    2528userdom_user_home_content(rssh_ro_t) 
    2629 
    2730type rssh_rw_t; 
     31typealias rssh_rw_t alias { user_rssh_rw_t staff_rssh_rw_t sysadm_rssh_rw_t }; 
     32typealias rssh_rw_t alias { auditadm_rssh_rw_t secadm_rssh_rw_t }; 
    2833userdom_user_home_content(rssh_rw_t) 
    2934 

  • branches/rbacsep/policy/modules/apps/screen.te

    r2782 r2790  
    1313application_executable_file(screen_exec_t) 
    1414 
     15type screen_home_t; 
     16typealias screen_home_t alias { user_screen_home_t staff_screen_home_t sysadm_screen_home_t }; 
     17typealias screen_home_t alias { auditadm_screen_home_t secadm_screen_home_t }; 
     18userdom_user_home_content(screen_home_t) 
     19 
    1520type screen_tmp_t; 
     21typealias screen_tmp_t alias { user_screen_tmp_t staff_screen_tmp_t sysadm_screen_tmp_t }; 
     22typealias screen_tmp_t alias { auditadm_screen_tmp_t secadm_screen_tmp_t }; 
    1623files_tmp_file(screen_tmp_t) 
    1724ubac_constrained(screen_tmp_t) 
    1825 
    19 type screen_home_t; 
    20 userdom_user_home_content(screen_home_t) 
    21  
    2226type screen_var_run_t; 
     27typealias screen_var_run_t alias { user_screen_var_run_t staff_screen_var_run_t sysadm_screen_var_run_t }; 
     28typealias screen_var_run_t alias { auditadm_screen_var_run_t secadm_screen_var_run_t }; 
    2329files_pid_file(screen_var_run_t) 
    2430ubac_constrained(screen_var_run_t) 

  • branches/rbacsep/policy/modules/apps/thunderbird.te

    r2782 r2790  
    99type thunderbird_t; 
    1010type thunderbird_exec_t; 
     11typealias thunderbird_t alias { user_thunderbird_t staff_thunderbird_t sysadm_thunderbird_t }; 
     12typealias thunderbird_t alias { auditadm_thunderbird_t secadm_thunderbird_t }; 
    1113application_domain(thunderbird_t, thunderbird_exec_t) 
    1214ubac_constrained(thunderbird_t) 
    1315 
    1416type thunderbird_home_t; 
     17typealias thunderbird_home_t alias { user_thunderbird_home_t staff_thunderbird_home_t sysadm_thunderbird_home_t }; 
     18typealias thunderbird_home_t alias { auditadm_thunderbird_home_t secadm_thunderbird_home_t }; 
    1519files_poly_member(thunderbird_home_t) 
    1620userdom_user_home_content(thunderbird_home_t) 
    1721 
    1822type thunderbird_tmpfs_t; 
     23typealias thunderbird_tmpfs_t alias { user_thunderbird_tmpfs_t staff_thunderbird_tmpfs_t sysadm_thunderbird_tmpfs_t }; 
     24typealias thunderbird_tmpfs_t alias { auditadm_thunderbird_tmpfs_t secadm_thunderbird_tmpfs_t }; 
    1925files_tmpfs_file(thunderbird_tmpfs_t) 
    2026ubac_constrained(thunderbird_tmpfs_t) 

  • branches/rbacsep/policy/modules/apps/tvtime.te

    r2782 r2790  
    99type tvtime_t; 
    1010type tvtime_exec_t; 
     11typealias tvtime_t alias { user_tvtime_t staff_tvtime_t sysadm_tvtime_t }; 
     12typealias tvtime_t alias { auditadm_tvtime_t secadm_tvtime_t }; 
    1113application_domain(tvtime_t, tvtime_exec_t) 
    1214ubac_constrained(tvtime_t) 
    1315 
    1416type tvtime_home_t alias tvtime_rw_t; 
     17typealias tvtime_home_t alias { user_tvtime_home_t staff_tvtime_home_t sysadm_tvtime_home_t }; 
     18typealias tvtime_home_t alias { auditadm_tvtime_home_t secadm_tvtime_home_t }; 
    1519userdom_user_home_content(tvtime_home_t) 
    1620files_poly_member(tvtime_home_t) 
    1721 
    1822type tvtime_tmp_t; 
     23typealias tvtime_tmp_t alias { user_tvtime_tmp_t staff_tvtime_tmp_t sysadm_tvtime_tmp_t }; 
     24typealias tvtime_tmp_t alias { auditadm_tvtime_tmp_t secadm_tvtime_tmp_t }; 
    1925files_tmp_file(tvtime_tmp_t) 
    2026ubac_constrained(tvtime_tmp_t) 
    2127 
    2228type tvtime_tmpfs_t; 
     29typealias tvtime_tmpfs_t alias { user_tvtime_tmpfs_t staff_tvtime_tmpfs_t sysadm_tvtime_tmpfs_t }; 
     30typealias tvtime_tmpfs_t alias { auditadm_tvtime_tmpfs_t secadm_tvtime_tmpfs_t }; 
    2331files_tmpfs_file(tvtime_tmpfs_t) 
    2432ubac_constrained(tvtime_tmpfs_t) 

  • branches/rbacsep/policy/modules/apps/uml.te

    r2759 r2790  
    99type uml_t; 
    1010type uml_exec_t; 
     11typealias uml_t alias { user_uml_t staff_uml_t sysadm_uml_t }; 
     12typealias uml_t alias { auditadm_uml_t secadm_uml_t }; 
    1113application_domain(uml_t, uml_exec_t) 
    1214ubac_constrained(uml_t) 
    1315 
    1416type uml_ro_t; 
     17typealias uml_ro_t alias { user_uml_ro_t staff_uml_ro_t sysadm_uml_ro_t }; 
     18typealias uml_ro_t alias { auditadm_uml_ro_t secadm_uml_ro_t }; 
    1519files_type(uml_ro_t) 
    1620ubac_constrained(uml_ro_t) 
    1721 
    1822type uml_rw_t; 
     23typealias uml_rw_t alias { user_uml_rw_t staff_uml_rw_t sysadm_uml_rw_t }; 
     24typealias uml_rw_t alias { auditadm_uml_rw_t secadm_uml_rw_t }; 
    1925files_type(uml_rw_t) 
    2026ubac_constrained(uml_rw_t) 
    2127 
    2228type uml_tmp_t; 
     29typealias uml_tmp_t alias { user_uml_tmp_t staff_uml_tmp_t sysadm_uml_tmp_t }; 
     30typealias uml_tmp_t alias { auditadm_uml_tmp_t secadm_uml_tmp_t }; 
    2331files_tmp_file(uml_tmp_t) 
    2432ubac_constrained(uml_tmp_t) 
    2533 
    2634type uml_tmpfs_t; 
     35typealias uml_tmpfs_t alias { user_uml_tmpfs_t staff_uml_tmpfs_t sysadm_uml_tmpfs_t }; 
     36typealias uml_tmpfs_t alias { auditadm_uml_tmpfs_t secadm_uml_tmpfs_t }; 
    2737files_tmpfs_file(uml_tmpfs_t) 
    2838ubac_constrained(uml_tmpfs_t) 
    2939 
    3040type uml_devpts_t; 
     41typealias uml_devpts_t alias { user_uml_devpts_t staff_uml_devpts_t sysadm_uml_devpts_t }; 
     42typealias uml_devpts_t alias { auditadm_uml_devpts_t secadm_uml_devpts_t }; 
    3143term_pty(uml_devpts_t) 
    3244ubac_constrained(uml_devpts_t) 

  • branches/rbacsep/policy/modules/apps/vmware.te

    r2745 r2790  
    1010type vmware_t; 
    1111type vmware_exec_t; 
     12typealias vmware_t alias { user_vmware_t staff_vmware_t sysadm_vmware_t }; 
     13typealias vmware_t alias { auditadm_vmware_t secadm_vmware_t }; 
    1214application_domain(vmware_t, vmware_exec_t) 
     15ubac_constrained(vmware_t) 
    1316 
    1417type vmware_conf_t; 
     18typealias vmware_conf_t alias { user_vmware_conf_t staff_vmware_conf_t sysadm_vmware_conf_t }; 
     19typealias vmware_conf_t alias { auditadm_vmware_conf_t secadm_vmware_conf_t }; 
    1520userdom_user_home_content(vmware_conf_t) 
    1621 
    1722type vmware_file_t; 
     23typealias vmware_file_t alias { user_vmware_file_t staff_vmware_file_t sysadm_vmware_file_t }; 
     24typealias vmware_file_t alias { auditadm_vmware_file_t secadm_vmware_file_t }; 
    1825userdom_user_home_content(vmware_file_t) 
    1926 
    …… 
    2734 
    2835type vmware_log_t; 
     36typealias vmware_log_t alias { user_vmware_log_t staff_vmware_log_t sysadm_vmware_log_t }; 
     37typealias vmware_log_t alias { auditadm_vmware_log_t secadm_vmware_log_t }; 
    2938logging_log_file(vmware_log_t) 
     39ubac_constrained(vmware_log_t) 
    3040 
    3141type vmware_pid_t; 
     42typealias vmware_pid_t alias { user_vmware_pid_t staff_vmware_pid_t sysadm_vmware_pid_t }; 
     43typealias vmware_pid_t alias { auditadm_vmware_pid_t secadm_vmware_pid_t }; 
    3244files_pid_file(vmware_pid_t) 
     45ubac_constrained(vmware_pid_t) 
    3346 
    3447# Systemwide configuration files 
    …… 
    3750 
    3851type vmware_tmp_t; 
     52typealias vmware_tmp_t alias { user_vmware_tmp_t staff_vmware_tmp_t sysadm_vmware_tmp_t }; 
     53typealias vmware_tmp_t alias { auditadm_vmware_tmp_t secadm_vmware_tmp_t }; 
    3954files_tmp_file(vmware_tmp_t) 
     55ubac_constrained(vmware_tmp_t) 
    4056 
    4157type vmware_tmpfs_t; 
     58typealias vmware_tmpfs_t alias { user_vmware_tmpfs_t staff_vmware_tmpfs_t sysadm_vmware_tmpfs_t }; 
     59typealias vmware_tmpfs_t alias { auditadm_vmware_tmpfs_t secadm_vmware_tmpfs_t }; 
    4260files_tmpfs_file(vmware_tmpfs_t) 
     61ubac_constrained(vmware_tmpfs_t) 
    4362 
    4463######################################## 

  • branches/rbacsep/policy/modules/apps/wireshark.te

    r2782 r2790  
    99type wireshark_t; 
    1010type wireshark_exec_t; 
     11typealias wireshark_t alias { user_wireshark_t staff_wireshark_t sysadm_wireshark_t }; 
     12typealias wireshark_t alias { auditadm_wireshark_t secadm_wireshark_t }; 
    1113application_domain(wireshark_t, wireshark_exec_t) 
    1214ubac_constrained(wireshark_t) 
    1315 
    1416type wireshark_home_t; 
     17typealias wireshark_home_t alias { user_wireshark_home_t staff_wireshark_home_t sysadm_wireshark_home_t }; 
     18typealias wireshark_home_t alias { auditadm_wireshark_home_t secadm_wireshark_home_t }; 
    1519files_poly_member(wireshark_home_t) 
    1620userdom_user_home_content(wireshark_home_t) 
    1721 
    1822type wireshark_tmp_t; 
     23typealias wireshark_tmp_t alias { user_wireshark_tmp_t staff_wireshark_tmp_t sysadm_wireshark_tmp_t }; 
     24typealias wireshark_tmp_t alias { auditadm_wireshark_tmp_t secadm_wireshark_tmp_t }; 
    1925files_tmp_file(wireshark_tmp_t) 
    2026ubac_constrained(wireshark_tmp_t) 
    2127 
    2228type wireshark_tmpfs_t; 
     29typealias wireshark_tmpfs_t alias { user_wireshark_tmpfs_t staff_wireshark_tmpfs_t sysadm_wireshark_tmpfs_t }; 
     30typealias wireshark_tmpfs_t alias { auditadm_wireshark_tmpfs_t secadm_wireshark_tmpfs_t }; 
    2331files_tmpfs_file(wireshark_tmpfs_t) 
    2432ubac_constrained(wireshark_tmpfs_t) 

  • branches/rbacsep/policy/modules/services/apache.te

    r2782 r2790  
    188188 
    189189apache_content_template(user) 
     190ubac_constrained(httpd_user_content_t) 
     191ubac_constrained(httpd_user_htaccess_t) 
     192ubac_constrained(httpd_user_script_t) 
     193ubac_constrained(httpd_user_script_exec_t) 
     194ubac_constrained(httpd_user_script_ro_t) 
     195ubac_constrained(httpd_user_script_rw_t) 
     196ubac_constrained(httpd_user_script_ra_t) 
     197typealias httpd_user_content_t alias { httpd_staff_content_t httpd_sysadm_content_t }; 
     198typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t }; 
     199typealias httpd_user_htaccess_t alias { httpd_staff_htaccess_t httpd_sysadm_htaccess_t }; 
     200typealias httpd_user_htaccess_t alias { httpd_auditadm_htaccess_t httpd_secadm_htaccess_t }; 
     201typealias httpd_user_script_t alias { httpd_staff_script_t httpd_sysadm_script_t }; 
     202typealias httpd_user_script_t alias { httpd_auditadm_script_t httpd_secadm_script_t }; 
     203typealias httpd_user_script_exec_t alias { httpd_staff_script_exec_t httpd_sysadm_script_exec_t }; 
     204typealias httpd_user_script_exec_t alias { httpd_auditadm_script_exec_t httpd_secadm_script_exec_t }; 
     205typealias httpd_user_script_ro_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t }; 
     206typealias httpd_user_script_ro_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t }; 
     207typealias httpd_user_script_rw_t alias { httpd_staff_script_rw_t httpd_sysadm_script_rw_t }; 
     208typealias httpd_user_script_rw_t alias { httpd_auditadm_script_rw_t httpd_secadm_script_rw_t }; 
     209typealias httpd_user_script_ra_t alias { httpd_staff_script_ra_t httpd_sysadm_script_ra_t }; 
     210typealias httpd_user_script_ra_t alias { httpd_auditadm_script_ra_t httpd_secadm_script_ra_t }; 
    190211 
    191212# for apache2 memory mapped files 

  • branches/rbacsep/policy/modules/services/bluetooth.te

    r2782 r2790  
    1818type bluetooth_helper_t; 
    1919type bluetooth_helper_exec_t; 
     20typealias bluetooth_helper_t alias { user_bluetooth_helper_t staff_bluetooth_helper_t sysadm_bluetooth_helper_t }; 
     21typealias bluetooth_helper_t alias { auditadm_bluetooth_helper_t secadm_bluetooth_helper_t }; 
    2022application_domain(bluetooth_helper_t, bluetooth_helper_exec_t) 
    2123ubac_constrained(bluetooth_helper_t) 
    2224 
    2325type bluetooth_helper_tmp_t; 
     26typealias bluetooth_helper_tmp_t alias { user_bluetooth_helper_tmp_t staff_bluetooth_helper_tmp_t sysadm_bluetooth_helper_tmp_t }; 
     27typealias bluetooth_helper_tmp_t alias { auditadm_bluetooth_helper_tmp_t secadm_bluetooth_helper_tmp_t }; 
    2428files_tmp_file(bluetooth_helper_tmp_t) 
    2529ubac_constrained(bluetooth_helper_tmp_t) 
    2630 
    2731type bluetooth_helper_tmpfs_t; 
     32typealias bluetooth_helper_tmpfs_t alias { user_bluetooth_helper_tmpfs_t staff_bluetooth_helper_tmpfs_t sysadm_bluetooth_helper_tmpfs_t }; 
     33typealias bluetooth_helper_tmpfs_t alias { auditadm_bluetooth_helper_tmpfs_t secadm_bluetooth_helper_tmpfs_t }; 
    2834files_tmpfs_file(bluetooth_helper_tmpfs_t) 
    2935ubac_constrained(bluetooth_helper_tmpfs_t) 

  • branches/rbacsep/policy/modules/services/cron.te

    r2782 r2790  
    4444 
    4545type cronjob_t; 
     46typealias cronjob_t alias { user_crond_t staff_crond_t sysadm_crond_t }; 
     47typealias cronjob_t alias { auditadm_crond_t secadm_crond_t }; 
    4648domain_type(cronjob_t) 
    4749domain_cron_exemption_target(cronjob_t) 
    …… 
    6567 
    6668cron_common_crontab_template(admin_crontab) 
     69typealias admin_crontab_t alias sysadm_crontab_t; 
     70typealias admin_crontab_tmp_t alias sysadm_crontab_tmp_t; 
    6771 
    6872cron_common_crontab_template(crontab) 
     73typealias crontab_t alias { user_crontab_t staff_crontab_t }; 
     74typealias crontab_t alias { auditadm_crontab_t secadm_crontab_t }; 
     75typealias crontab_tmp_t alias { user_crontab_tmp_t staff_crontab_tmp_t }; 
     76typealias crontab_tmp_t alias { auditadm_crontab_tmp_t secadm_crontab_tmp_t }; 
    6977 
    7078type system_cron_spool_t, cron_spool_type; 
    …… 
    9199# Type of user crontabs once moved to cron spool. 
    92100type user_cron_spool_t, cron_spool_type; 
     101typealias user_cron_spool_t alias { staff_cron_spool_t sysadm_cron_spool_t }; 
     102typealias user_cron_spool_t alias { auditadm_cron_spool_t secadm_cron_spool_t }; 
    93103files_type(user_cron_spool_t) 
    94104ubac_constrained(user_cron_spool_t) 

  • branches/rbacsep/policy/modules/services/dbus.te

    r2782 r2790  
    2020 
    2121type session_dbusd_tmp_t; 
     22typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t }; 
     23typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t }; 
    2224files_tmp_file(session_dbusd_tmp_t) 
    2325ubac_constrained(session_dbusd_tmp_t) 

  • branches/rbacsep/policy/modules/services/lpd.te

    r2782 r2790  
    3434type lpr_t; 
    3535type lpr_exec_t; 
     36typealias lpr_t alias { user_lpr_t staff_lpr_t sysadm_lpr_t }; 
     37typealias lpr_t alias { auditadm_lpr_t secadm_lpr_t }; 
    3638application_domain(lpr_t, lpr_exec_t) 
    3739ubac_constrained(lpr_t) 
    3840 
    3941type lpr_tmp_t; 
     42typealias lpr_tmp_t alias { user_lpr_tmp_t staff_lpr_tmp_t sysadm_lpr_tmp_t }; 
     43typealias lpr_tmp_t alias { auditadm_lpr_tmp_t secadm_lpr_tmp_t }; 
    4044files_tmp_file(lpr_tmp_t) 
    4145ubac_constrained(lpr_tmp_t) 
    …… 
    4347# Type for spool files. 
    4448type print_spool_t; 
     49typealias print_spool_t alias { user_print_spool_t staff_print_spool_t sysadm_print_spool_t }; 
     50typealias print_spool_t alias { auditadm_print_spool_t secadm_print_spool_t }; 
    4551files_type(print_spool_t) 
    4652ubac_constrained(print_spool_t) 

  • branches/rbacsep/policy/modules/services/mta.te

    r2782 r2790  
    3333 
    3434mta_base_mail_template(user) 
     35typealias user_mail_t alias { staff_mail_t sysadm_mail_t }; 
     36typealias user_mail_t alias { auditadm_mail_t secadm_mail_t }; 
     37typealias user_mail_tmp_t alias { staff_mail_tmp_t sysadm_mail_tmp_t }; 
     38typealias user_mail_tmp_t alias { auditadm_mail_tmp_t secadm_mail_tmp_t }; 
    3539ubac_constrained(user_mail_t) 
    3640ubac_constrained(user_mail_tmp_t) 

  • branches/rbacsep/policy/modules/services/postgresql.te

    r2782 r2790  
    9898 
    9999type user_sepgsql_blob_t; 
     100typealias user_sepgsql_blob_t alias { staff_sepgsql_blob_t sysadm_sepgsql_blob_t }; 
     101typealias user_sepgsql_blob_t alias { auditadm_sepgsql_blob_t secadm_sepgsql_blob_t }; 
    100102postgresql_blob_object(user_sepgsql_blob_t) 
    101103 
    102104type user_sepgsql_proc_exec_t; 
     105typealias user_sepgsql_proc_exec_t alias { staff_sepgsql_proc_exec_t sysadm_sepgsql_proc_exec_t }; 
     106typealias user_sepgsql_proc_exec_t alias { auditadm_sepgsql_proc_exec_t secadm_sepgsql_proc_exec_t }; 
    103107postgresql_procedure_object(user_sepgsql_proc_exec_t) 
    104108 
    105109type user_sepgsql_sysobj_t; 
     110typealias user_sepgsql_sysobj_t alias { staff_sepgsql_sysobj_t sysadm_sepgsql_sysobj_t }; 
     111typealias user_sepgsql_sysobj_t alias { auditadm_sepgsql_sysobj_t secadm_sepgsql_sysobj_t }; 
    106112postgresql_system_table_object(user_sepgsql_sysobj_t) 
    107113 
    108114type user_sepgsql_table_t; 
     115typealias user_sepgsql_table_t alias { staff_sepgsql_table_t sysadm_sepgsql_table_t }; 
     116typealias user_sepgsql_table_t alias { auditadm_sepgsql_table_t secadm_sepgsql_table_t }; 
    109117postgresql_table_object(user_sepgsql_table_t) 
    110118 

  • branches/rbacsep/policy/modules/services/pyzor.te

    r2782 r2790  
    99type pyzor_t; 
    1010type pyzor_exec_t; 
     11typealias pyzor_t alias { user_pyzor_t staff_pyzor_t sysadm_pyzor_t }; 
     12typeali