Changeset 91 for selinux/build


Ignore:
Timestamp:
Jan 20, 2007, 9:36:32 PM (18 years ago)
Author:
presbrey
Message:
Zephyr strict SELinux module
Location:
selinux/build
Files:
3 edited

Legend:

Unmodified
Added
Removed
  • selinux/build/zephyr.fc

    r84 r91  
     1# Joe Presbrey
     2# presbrey@mit.edu
     3# 2006/1/15
     4
    15/usr/sbin/zhm           --      gen_context(system_u:object_r:zephyr_exec_t,s0)
    26/usr/bin/zaway          --      gen_context(system_u:object_r:zephyr_bin_t,s0)
  • selinux/build/zephyr.if

    r84 r91  
     1# Joe Presbrey
     2# presbrey@mit.edu
     3# 2006/1/15
     4
    15interface(`zephyr_domtrans',`
    26        gen_requires(`
     
    1418template(`zephyr_access',`
    1519        require {
    16 #                type krb5_conf_t;
    1720                type zephyr_t, zephyr_bin_t;
    1821        }
    1922
    2023        allow $1 zephyr_t:udp_socket { read write };
    21 #        allow $1 krb5_conf_t:file read;
    2224        can_exec($1, zephyr_t)
    2325        can_exec($1, zephyr_bin_t)
  • selinux/build/zephyr.te

    r84 r91  
     1# Joe Presbrey
     2# presbrey@mit.edu
     3# 2006/1/15
     4
    15policy_module(zephyr,1.0.0)
    26
     
    1014type zephyr_exec_t;
    1115domain_type(zephyr_t)
     16corecmd_executable_file(zephyr_bin_t)
    1217init_daemon_domain(zephyr_t, zephyr_exec_t)
    1318
    1419########################################
    1520#
    16 # AFS local policy
     21# zephyr local policy
    1722
    1823files_read_etc_files(zephyr_t)
     
    2227miscfiles_read_localization(zephyr_t)
    2328
    24 # Init script handling
    2529init_use_fds(zephyr_t)
    2630init_use_script_ptys(zephyr_t)
    2731domain_use_interactive_fds(zephyr_t)
    2832term_use_console(zephyr_t)
    29 
    30 allow zephyr_t self:process setsched;
    31 allow zephyr_t self:capability { sys_admin sys_nice sys_tty_config};
    32 
     33corenet_udp_bind_generic_port(zephyr_t)
     34dev_read_urand(zephyr_t)
    3335sysnet_dns_name_resolve(zephyr_t)
    3436corenet_tcp_sendrecv_all_nodes(zephyr_t)
     
    3638corenet_tcp_sendrecv_all_ports(zephyr_t)
    3739corenet_udp_sendrecv_all_ports(zephyr_t)
     40kerberos_use(zephyr_t)
    3841
    39 #allow zephyr_bin_t fs_t:filesystem associate;
     42allow zephyr_t self:process setsched;
     43allow zephyr_t self:capability { sys_admin sys_nice sys_tty_config };
Note: See TracChangeset for help on using the changeset viewer.