Changeset 475

Timestamp:

07/07/05 12:25:53 (3 years ago)

Author:

cpebenito

Message:

tag for 20050707 release

Files:

• tags/RELEASE_20050707 (copied) (copied from trunk)
• tags/RELEASE_20050707/docs/macro_conversion_guide (modified) (43 diffs)
• tags/RELEASE_20050707/refpolicy/VERSION (modified) (1 diff)
• tags/RELEASE_20050707/www (copied) (copied from trunk/www)
• trunk/docs/macro_conversion_guide (modified) (43 diffs)
• trunk/refpolicy/VERSION (modified) (1 diff)

tags/RELEASE_20050707/docs/macro_conversion_guide

@@ -9 +9 @@
-########################################
-#
-# Object class sets
-#
-
-#
-# devfile_class_set
-#
-{ chr_file blk_file }
-
-#
-# dgram_socket_class_set
-#
-{ udp_socket unix_dgram_socket }
-
-#
-# dir_file_class_set
-#
-{ dir file lnk_file sock_file fifo_file chr_file blk_file }
-
-#
-# file_class_set
-#
-{ file lnk_file sock_file fifo_file chr_file blk_file }
-
-#
-# notdevfile_class_set
-#
-{ file lnk_file sock_file fifo_file }
-
-#
-# socket_class_set
-#
-{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket }
-
-#
-# stream_socket_class_set
-#
-{ tcp_socket unix_stream_socket }
-
-#
-# unpriv_socket_class_set
-#
-{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket }
-
-########################################
-#
-# Permission Sets
-#
-
-#
-# connected_socket_perms
-#
-{ create ioctl read getattr write setattr append bind getopt setopt shutdown }
-
-#
-# connected_stream_socket_perms
-#
-{ create ioctl read getattr write setattr append bind getopt setopt shutdown listen accept }
-
-#
-# create_dir_perms
-#
-{ create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir }
-
-#
-# create_file_perms
-#
-{ create ioctl read getattr lock write setattr append link unlink rename }
-
-#
-# create_lnk_perms
-#
-{ create read getattr setattr link unlink rename }
-
-#
-# create_msgq_perms
-#
-{ associate getattr setattr create destroy read write enqueue unix_read unix_write }
-
-#
-# create_netlink_socket_perms
-#
-{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }
-
-#
-# create_sem_perms
-#
-{ associate getattr setattr create destroy read write unix_read unix_write }
-
-#
-# create_shm_perms
-#
-{ associate getattr setattr create destroy read write lock unix_read unix_write }
-
-#
-# create_socket_perms
-#
-{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown }
-
-#
-# create_stream_socket_perms
-#
-{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept }
-
-#
-# link_file_perms
-#
-{ getattr link unlink rename }
-
-#
-# mount_fs_perms
-#
-{ mount remount unmount getattr }
-
-#
-# packet_perms
-#
-{ tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send }
-
-#
-# r_dir_perms
-#
-{ read getattr lock search ioctl }
-
-#
-# r_file_perms
-#
-{ read getattr lock ioctl }
-
-#
-# r_msgq_perms
-#
-{ associate getattr read unix_read }
-
-#
-# r_netlink_socket_perms
-#
-{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read }
-
-#
-# r_sem_perms
-#
-{ associate getattr read unix_read }
-
-#
-# r_shm_perms
-#
-{ associate getattr read unix_read }
-
-#
-# ra_dir_perms
-#
-{ read getattr lock search ioctl add_name write }
-
-#
-# ra_file_perms
-#
-{ ioctl read getattr lock append }
-
-#
-# rw_dir_perms
-#
-{ read getattr lock search ioctl add_name remove_name write }
-
-#
-# rw_file_perms
-#
-{ getattr read write append ioctl lock }
-
-#
-# rw_msgq_perms
-#
-{ associate getattr read write enqueue unix_read unix_write }
-
-#
-# rw_netlink_socket_perms
-#
-{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }
-
-#
-# rw_sem_perms
-#
-{ associate getattr read write unix_read unix_write }
-
-#
-# rw_shm_perms
-#
-{ associate getattr read write lock unix_read unix_write }
-
-#
-# rw_socket_perms
-#
-{ ioctl read getattr write setattr append bind connect getopt setopt shutdown }
-
-#
-# rw_stream_socket_perms
-#
-{ ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept }
-
-#
-# rx_file_perms
-#
-{ read getattr lock execute ioctl }
-
-#
-# signal_perms
-#
-{ sigchld sigkill sigstop signull signal }
-
-#
-# stat_file_perms
-#
-{ getattr }
-
-#
-# x_file_perms
-#
-{ getattr execute }
-
-########################################
-#
-# Attributes
-#
@@ -241 +21 @@
-# auth: complete
-#
-login_read_shadow_passwords
+_read_shadow
-
-#
-# auth_chkpwd: complete
-#
-login_check_password_transition
+_domtrans_chk_passwd
-
-#
-# file_type: complete
-#
-make_fil
+file_typ
-
-#
@@ -263 +43 @@
-# privfd: complete
-#
-make_file_descriptors_widely_inheritable
+wide_inherit_fd
-
-#
-# privlog: complete
-#
-tem_log_message
+log_msg
-
-#
@@ -282 +62 @@
-# privmodule: complete
-#
-insmod_transition
+domtrans_insmod
-
-#
-# privowner: complete
-#
-kernel_make_object_identity_change_constraint_exception
+domain_obj_id_change_exempt
-
-#
-# privrole: complete
-#
-kernel_make_role_change_constraint_exception
+domain_role_change_exempt
-
-#
-# privuser: complete
-#
-kernel_make_process_identity_change_constraint_exception
+domain_subj_id_change_exempt
-
-########################################
@@ -313 +93 @@
-
-#
-# admin_domain():
-#
-
-#
-# append_log_domain():
-#
-type $1_log_t;
-make_
+
-allow $1_t var_log_t:dir ra_dir_perms;
-allow $1_t $1_log_t:file  { create ra_file_perms };
@@ -329 +105 @@
-#
-type $1_log_t;
-make_
+
-allow $1_t var_log_t:dir ra_dir_perms;
-allow $1_t $1_log_t:dir { setattr ra_dir_perms };
@@ -340 +116 @@
-type $1_t;
-type $1_exec_t;
-make_domain
-make_entrypoint
+type
+entry
-role sysadm_r types $1_t;
-domain_auto_trans(sysadm_t, $1_exec_t, $1_t)
-raries_use_dynamic_loader
-raries_use_shared_librarie
+s_use_ld_so
+s_use_shared_lib
-
-#
-# base_can_network($1,$2):
-#
-{ create ioctl read getattr write setattr append bind getopt setopt shutdown }
-work_network_$2_on_all_interfaces
-work_network_raw_on_all_interfaces
-work_network_$2_on
-work_network_raw_on
-work_bind_$2_on_all_node
-work_network_$2_on_all_port
-work_read_network
+connected_socket_perms
+_$2_sendrecv_all_if
+_raw_sendrecv_all_if
+_$2_sendrecv
+_raw_sendrecv
+_$2_sendrecv_all_port
+_$2_bind_all_node
+_read
-
-#
-# base_can_network($1,$2,$3):
-#
-{ create ioctl read getattr write setattr append bind getopt setopt shutdown }
-work_network_$2_on_all_interfaces
-work_network_raw_on_all_interfaces
-work_network_$2_on
-work_network_raw_on
-work_bind_$2_on
-work_network_$2_on
-work_read_network
+connected_socket_perms
+_$2_sendrecv_all_if
+_raw_sendrecv_all_if
+_$2_sendrecv
+_raw_sendrecv
+_$2_bind
+_$2_sendrecv
+_read
-
-#
-# base_file_read_access():
-#
-_directories
-general_application_resourc
+
+usr_fil
-allow $1 bin_t:dir r_dir_perms;
-allow $1 bin_t:notdevfile_class_set r_file_perms;
@@ -381 +157 @@
-allow $1 sbin_t:notdevfile_class_set r_file_perms;
-kernel_read_kernel_sysctl($1)
-linux
+util
-if (read_default_t) {
-allow $1 default_t:dir r_dir_perms;
@@ -396 +172 @@
-
-#
-# base_user_domain():
-#
-
-#
-# can_create():
-#
@@ -423 +195 @@
-# can_create_other_pty(): complete
-#
-inal_create_private_pseudoterminal
+_create_pty
-allow $1_t $2_devpts_t:chr_file { setattr ioctl read getattr lock write append };
-
@@ -431 +203 @@
-# $2 may require more conversion
-type $1_devpts_t $2;
-inal_make_pseudoterminal
+_pty
-allow $1_t $1_devpts_t:chr_file { setattr ioctl read getattr lock write append };
-
-
-
-
-
-
+
-
-#
-# can_exec_any(): complete
-#
-ute_all_entrypoint_program
-ute_system_config_script
-ommands_execute_general_programs
-ommands_execute_system_programs
-raries_use_dynamic_loader
-raries_use_shared_librarie
-raries_execute_dynamic_loader
-raries_execute_library_script
+_all_entry_file
+_generic_etc_files
+md_exec_bin
+md_exec_sbin
+s_use_ld_so
+s_use_shared_lib
+s_exec_ld_so
+s_exec_lib_file
-
-#
@@ -461 +228 @@
-# can_getsecurity(): complete
-#
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-')
-
@@ -490 +259 @@
-# can_loadpol(): complete
-#
-kernel_get_selinuxfs_mount_poi
-kernel_load_selinux
+selinux_get_fs_mou
+selinux_load
-
-#
@@ -511 +280 @@
-# can_network_client_tcp($1): complete
-#
-{ create connect ioctl read getattr write setattr append bind getopt setopt shutdown }
-work_network_tcp_on_all_interfaces
-work_network_raw_on_all_interfaces
-work_network_tcp_on
-work_network_raw_on
-work_bind_tcp_on_all_node
-work_network_tcp_on_all_port
-work_read_network
+create_socket_perms
+_tcp_sendrecv_all_if
+_raw_sendrecv_all_if
+_tcp_sendrecv
+_raw_sendrecv
+_tcp_sendrecv_all_port
+_tcp_bind_all_node
+_read
-
-#
@@ -524 +293 @@
-#
-# remove _port_t from $2
-system_mail_t self:tcp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown }
-work_network_tcp_on_all_interfaces(system_mail_t
-work_network_raw_on_all_interfaces(system_mail_t
-work_network_tcp_on_all_nodes(system_mail_t
-work_network_raw_on_all_nodes(system_mail_t
-work_bind_tcp_on_all_nodes(system_mail_t
-work_network_tcp_on_$2_port(system_mail_t
-work_read_network_config(system_mail_t
+$1 self:tcp_socket create_socket_perms
+_tcp_sendrecv_all_if($1
+_raw_sendrecv_all_if($1
+_tcp_sendrecv_all_nodes($1
+_raw_sendrecv_all_nodes($1
+_tcp_sendrecv_$2_port($1
+_tcp_bind_all_nodes($1
+_read_config($1
-
-#
-# can_network_server():
-#
-{ listen accept }
+create_stream_socket_perms
-base_can_network($1, tcp, `$2')
-
@@ -542 +311 @@
-# can_network_server_tcp():
-#
-{ listen accept }
+create_stream_socket_perms
-base_can_network($1, tcp, `$2')
-
@@ -576 +345 @@
-
-#
-
+ complete
-#
-tunable_policy(`use_dns',`
-allow $1 self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect }
-corenetwork_network_udp_on_all_interfaces
-corenetwork_network_raw_on_all_interfaces
-corenetwork_network_udp_on
-corenetwork_network_raw_on
-corenetwork_bind_udp_on_all_nodes
-corenetwork_network_udp_on_dns_port
-sysnetwork_read_network
+       allow $1 self:udp_socket create_socket_perms
+       corenet_udp_sendrecv_all_if
+       corenet_raw_sendrecv_all_if
+       corenet_udp_sendrecv
+       corenet_raw_sendrecv
+       corenet_udp_sendrecv_dns_port
+       corenet_udp_bind_all_nodes
+       sysnet_read
-')
-
@@ -592 +361 @@
-# can_setbool(): complete
-#
-kernel_get_selinuxfs_mount_poi
-kernel_set_selinux
+selinux_get_fs_mou
+selinux_set
-
-#
@@ -601 +370 @@
-#
-allow $1 self:process setcurrent;
-kernel_get_selinuxfs_mount_poi
+selinux_get_fs_mou
-
-#
@@ -608 +377 @@
-# get mount point is due to libselinux init
-#
-kernel_get_selinuxfs_mount_poi
-kernel_set_selinux_enforcement
+selinux_get_fs_mou
+selinux_set_enforce
-
-#
@@ -617 +386 @@
-#
-allow $1 self:process setexec;
-kernel_get_selinuxfs_mount_poi
+selinux_get_fs_mou
-
-#
@@ -625 +394 @@
-#
-allow $1 self:process setfscreate;
-kernel_get_selinuxfs_mount_poi
+selinux_get_fs_mou
-
-#
@@ -632 +401 @@
-# get mount point is due to libselinux init
-#
-kernel_get_selinuxfs_mount_poi
+selinux_get_fs_mou
-kernel_setsecparam($1)
-
@@ -638 +407 @@
-# can_sysctl(): complete
-#
-modify
+rw
-
-#
-# can_tcp_connect
-
-
-
-
-
-
-
+
+
+
+
+
-
-#
-# can_udp_send():
-
-
-
-
-
+
+
+
-
-#
@@ -669 +434 @@
-
-#
-
-
+
+
+
+
+
-
-#
@@ -697 +465 @@
-type $1_t;
-type $1_exec_t;
-make_
+
-role system_r types $1_t;
-dontaudit $1_t self:capability sys_tty_config;
-allow $1_t self:process { sigchld sigkill sigstop signull signal };
-kernel_read_kernel_sysctl($1_t)
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-allow $1_t proc_t:dir r_dir_perms;
-allow $1_t proc_t:lnk_file read;
-tunable_policy(`direct_sysadm_daemon', `
-dontaudit $1_t admin_tty_type:chr_file rw_file_perms;
-')
-tunable_policy(`targeted_policy', `
-terminal_ignore_use_general_physical_terminal($1_t)
-terminal_ignore_use_general_pseudoterminal($1_t)
-files_ignore_read_rootfs_file($1_t)
-')
-optional_policy(`rhgb.te', `
-allow $1_t rhgb_t:process sigchld;
-allow $1_t rhgb_t:fd use;
-allow $1_t rhgb_t:fifo_file { read write };
-')
-optional_policy(`selinux.te',`
-selinux_newrole_sigchld($1_t)
-')
-optional_policy(`udev.te', `
-udev_read_database($1_t)
-')
-dontaudit $1_t unpriv_userdomain:fd use;
-allow $1_t autofs_t:dir { search getattr };
-
-
@@ -740 +503 @@
-type $1_t;
-type $1_exec_t;
-make_
+
-type $1_var_run_t;
-
+
+
-allow $1_t $1_var_run_t:file { getattr create read write append setattr unlink };
-
-
+
-kernel_read_kernel_sysctl($1_t)
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-miscfiles_read_localization($1_t)
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-')
-optional_policy(`selinux.te',`
-selinux
+       seutil
-')
-optional_policy(`udev.te', `
-udev_read_database
+       udev_read_db
-')
-allow $1_t proc_t:dir r_dir_perms;
-allow $1_t proc_t:lnk_file read;
-dontaudit $1_t unpriv_userdomain:fd use;
-allow $1_t autofs_t:dir { search getattr };
-dontaudit $1_t sysadm_home_dir_t:dir search;
-
@@ -791 +552 @@
-allow $2_t $1:process sigchld;
-allow $2_t self:process signal_perms;
-raries_use_dynamic_loader
-raries_use_shared_librarie
+s_use_ld_so
+s_use_shared_lib
-allow $2_t proc_t:dir r_dir_perms;
-allow $2_t proc_t:lnk_file read;
@@ -801 +562 @@
-#
-type $1_etc_t; #, usercanread;
-make_fil
+file_typ
-allow $1_t $1_etc_t:file { getattr read };
-
@@ -808 +569 @@
-#
-type $1_etc_t; #, usercanread;
-make_fil
+file_typ
-allow $1_t $1_etc_t:file r_file_perms;
-allow $1_t $1_etc_t:dir r_dir_perms;
@@ -832 +593 @@
-
-#
-
-
-
-
-
+
-#
-allow $1 self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem dyntransition };
-allow $1 self:fd use;
-{ read getattr lock ioctl write append }
-{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown }
-{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept }
+rw_file_perms
+create_socket_perms
+create_stream_socket_perms
-allow $1 self:unix_dgram_socket sendto;
-allow $1 self:unix_stream_socket connectto;
-{ associate getattr setattr create destroy read write lock unix_read unix_write }
-{ associate getattr setattr create destroy read write unix_read unix_write }
-{ associate getattr setattr create destroy read write enqueue unix_read unix_write }
+create_shm_perms
+create_sem_perms
+create_msgq_perms
-allow $1 self:msg { send receive };
-
-can_ypbin
-ifdef(`automount.te', 
-
+
+userdom_use_unpriv_user_f
+optional_policy(`nis.te',
+
-')
-
@@ -859 +616 @@
-#
-kernel_read_system_state($1)
-network
+sendrecv
-kernel_read_software_raid_state($1)
-_core_interface_attributes
-_message_interface_attributes
+attr_core
+attr_message_if
-kernel_read_kernel_sysctl($1)
-
@@ -892 +649 @@
-type $1_t;
-type $1_exec_t;
-make_
+
-dontaudit $1_t self:capability sys_tty_config;
-kernel_read_hardware_state
-inal_ignore
-ile_descriptors
-raries_use_dynamic_loader
-raries_use_shared_librarie
-tem_log_message
+dev_read_sysfs
+_dontaudit
+d
+s_use_ld_so
+s_use_shared_lib
+log_msg
-tunable_policy(`targeted_policy', `
-inal_ignore_use_general_physical_terminal
-inal_ignore_use_general_pseudoterminal
-ignore_read_rootfs
+_dontaudit_use_unallocated_tty
+_dontaudit_use_generic_pty
+dontaudit_read_root
-')dnl end targeted_policy tunable
-allow $1_t proc_t:dir r_dir_perms;
-allow $1_t proc_t:lnk_file read;
-optional_policy(`udev.te', `
-atabase
+b
-')
-allow $1_t autofs_t:dir { search getattr };
@@ -914 +671 @@
-
-#
+# inetd_child_domain():
+#
+type $1_t; #, nscd_client_domain;
+type $1_exec_t;
+inetd_(udp_|tcp_)?service_domain($1_t,$1_exec_t)
+role system_r types $1_t;
+type $1_tmp_t;
+files_tmp_file($1_tmp_t)
+type $1_var_run_t;
+files_pid_file($1_var_run_t)
+allow $1_t self:process signal_perms;
+allow $1_t self:fifo_file rw_file_perms;
+allow $1_t self:tcp_socket { listen accept connected_socket_perms }
+# for identd
+# cjp: this should probably only be inetd_child rules?
+allow $1_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
+allow $1_t self:capability { setuid setgid };
+allow $1_t self:dir search;
+allow $1_t self:{ lnk_file file } { getattr read };
+#allow $1_t home_root_t:dir search;
+#can_kerberos($1_t)
+#end for identd
+allow $1_t $1_tmp_t:dir create_dir_perms;
+allow $1_t $1_tmp_t:file create_file_perms;
+files_create_tmp_files($1_t, $1_tmp_t, { file dir })
+allow $1_t $1_var_run_t:file create_file_perms;
+files_create_pid($1_t,$1_var_run_t)
+kernel_read_kernel_sysctl($1_t)
+kernel_read_system_state($1_t)
+kernel_read_network_state($1_t)
+corenet_sendrecv_tcp_on_all_interfaces($1_t)
+corenet_sendrecv_raw_on_all_interfaces($1_t)
+corenet_sendrecv_tcp_on_all_nodes($1_t)
+corenet_sendrecv_raw_on_all_nodes($1_t)
+corenet_bind_tcp_on_all_nodes($1_t)
+corenet_sendrecv_tcp_on_all_ports($1_t)
+dev_read_urand($1_t)
+fs_getattr_xattr_fs($1_t)
+files_read_generic_etc_files($1_t)
+libs_use_ld_so($1_t)
+libs_use_shared_libs($1_t)
+logging_send_syslog_msg($1_t)
+miscfiles_read_localization($1_t)
+sysnet_read_config($1_t)
+optional_policy(`nis.te',`
+        nis_use_ypbind($1_t)
+')
+
+#
-# legacy_domain(): complete
-#
-allow $1_t self:process execmem;
-raries_legacy_use_shared_librarie
-raries_legacy_use_dynamic_loader
+s_legacy_use_shared_lib
+s_legacy_use_ld_so
-
-#
@@ -924 +730 @@
-#
-type $1_lock_t;
-make_
-{ create ioctl read getattr lock write setattr append link unlink rename }
-private_
+
+create_file_perms
+
-
-#
@@ -932 +738 @@
-#
-type $1_log_t;
-make_
-{ create ioctl read getattr lock write setattr append link unlink rename }
-private_
+
+create_file_perms
+
-
-#
@@ -940 +746 @@
-#
-type $1_log_t;
-make_
-{ create ioctl read getattr lock write setattr append link unlink rename }
-{ getattr search read lock ioctl add_name remove_name write setattr }
-create_private_log
+
+create_file_perms
+rw_dir_perms
+search_logs
-
-#
@@ -1027 +833 @@
-#
-type $1_t;
-make_domain
+type
-role system_r types $1_t;
-type $1_exec_t;
-make_entrypoint
-raries_use_dynamic_loader
-raries_use_shared_librarie
-tem_log_message
+entry
+s_use_ld_so
+s_use_shared_lib
+log_msg
-allow $1_t etc_t:dir r_dir_perms;
-
@@ -1042 +848 @@
-#
-type $1_tmp_t $2;
-make_temporary
+tmp
-# no class specified:
-{ create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir }
-{ create ioctl read getattr lock write setattr append link unlink rename }
-private_tmp_data
+create_dir_perms
+create_file_perms
+tmp_files
-# class specified:
-private_tmp_data
+tmp_files
-# $3 manage object perms here
-
@@ -1057 +863 @@
-#
-type $1_tmp_t $2;
-make_temporary
-private_tmp_data
+tmp
+tmp_files
-allow $1_t $1_tmp_t:$3 manage_obj_perms;
-
-#
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-
-#
@@ -1079 +890 @@
-role sysadm_r types $1_t;
-domain_auto_trans(sysadm_t, $1_exec_t, $1_t)
-raries_use_dynamic_loader
-raries_use_shared_librarie
+s_use_ld_so
+s_use_shared_lib
-in_user_role($1_t)
-domain_auto_trans(userdomain, $1_exec_t, $1_t)
-
-#
-# user_domain():
-#
-
-#
@@ -1097 +904 @@
-
-#
-# uses_shlib(): complete
-#
-libraries_use_dynamic_loader($1)
-libraries_use_shared_libraries($1)
-
-#
-# var_lib_domain():
-#
@@ -1108 +909 @@
-typealias $1_var_lib_t alias var_lib_$1_t;
-file_type_auto_trans($1_t, var_lib_t, $1_var_lib_t, file)
-{ read getattr lock search ioctl add_name remove_name write }
+rw_dir_perms
-
-#
-# var_run_domain($1):
-#
-, file_type, sysadmfile, pidfile
-_type_auto_trans($1_t, var_run_t, $1_var_run_t, file
-var_t:dir search
-
+
+s_pid_file($1_var_run_t
+$1_var_run_t:file create_file_perms
+
-
-#

tags/RELEASE_20050707/refpolicy/VERSION

@@ -1 @@
-615
+707

trunk/docs/macro_conversion_guide

@@ -9 +9 @@
-########################################
-#
-# Object class sets
-#
-
-#
-# devfile_class_set
-#
-{ chr_file blk_file }
-
-#
-# dgram_socket_class_set
-#
-{ udp_socket unix_dgram_socket }
-
-#
-# dir_file_class_set
-#
-{ dir file lnk_file sock_file fifo_file chr_file blk_file }
-
-#
-# file_class_set
-#
-{ file lnk_file sock_file fifo_file chr_file blk_file }
-
-#
-# notdevfile_class_set
-#
-{ file lnk_file sock_file fifo_file }
-
-#
-# socket_class_set
-#
-{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket }
-
-#
-# stream_socket_class_set
-#
-{ tcp_socket unix_stream_socket }
-
-#
-# unpriv_socket_class_set
-#
-{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket }
-
-########################################
-#
-# Permission Sets
-#
-
-#
-# connected_socket_perms
-#
-{ create ioctl read getattr write setattr append bind getopt setopt shutdown }
-
-#
-# connected_stream_socket_perms
-#
-{ create ioctl read getattr write setattr append bind getopt setopt shutdown listen accept }
-
-#
-# create_dir_perms
-#
-{ create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir }
-
-#
-# create_file_perms
-#
-{ create ioctl read getattr lock write setattr append link unlink rename }
-
-#
-# create_lnk_perms
-#
-{ create read getattr setattr link unlink rename }
-
-#
-# create_msgq_perms
-#
-{ associate getattr setattr create destroy read write enqueue unix_read unix_write }
-
-#
-# create_netlink_socket_perms
-#
-{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }
-
-#
-# create_sem_perms
-#
-{ associate getattr setattr create destroy read write unix_read unix_write }
-
-#
-# create_shm_perms
-#
-{ associate getattr setattr create destroy read write lock unix_read unix_write }
-
-#