Cleanup boolean descriptions and fix files_relabel_all_tmp interfaces

diff --git a/policy/global_booleans b/policy/global_booleans
index d707353acb459910939cbbf897c1f715c0b02081..9df7b5ec30752a98605ee5885b895b99b0eb8fbe 100644 (file)
--- a/policy/global_booleans
+++ b/policy/global_booleans
@@ -15,7 +15,7 @@ gen_bool(secure_mode,false)
 
 ## <desc>
 ## <p>
-## Disable transitions to insmod.
+## disallow programs and users from transitioning to insmod domain.
 ## </p>
 ## </desc>
 gen_bool(secure_mode_insmod,false)

diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 62796d8462c318bc192dece2d5e9b2ea655b8633..7099120c4ae073ce537d583e53e75bf7d55d8fd9 100644 (file)
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -7,7 +7,7 @@ policy_module(mozilla, 2.2.2)
 
 ## <desc>
 ## <p>
-## Control mozilla content access
+## allow confined web browsers to read home directory content
 ## </p>
 ## </desc>
 gen_tunable(mozilla_read_content, false)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 1216203a71cd1e4d91c809b644ccfcf7fde83e1d..eaae4762924a2c147538494f8e3a4cd9d5a77828 100644 (file)
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -4278,7 +4278,7 @@ interface(`files_relabelfrom_tmp_files',`
 ## </param>
 ## <rolecap/>
 #
-interface(`files_relabel_all_tmp_files',`
+interface(`files_relabel_all_tmp_dirs',`
        gen_require(`
                attribute tmpfile;
                type var_t;
@@ -4290,7 +4290,7 @@ interface(`files_relabel_all_tmp_files',`
 
 ########################################
 ## <summary>
-##     Relabel all tmp dirs.
+##     Relabel all tmp files.
 ## </summary>
 ## <param name="domain">
 ##     <summary>
@@ -4299,14 +4299,14 @@ interface(`files_relabel_all_tmp_files',`
 ## </param>
 ## <rolecap/>
 #
-interface(`files_relabelto_all_tmp_dirs',`
+interface(`files_relabel_all_tmp_files',`
        gen_require(`
                attribute tmpfile;
                type var_t;
        ')
 
        allow $1 var_t:dir search_dir_perms;
-       relabelto_dirs_pattern($1, tmpfile, tmpfile)
+       relabel_files_pattern($1, tmpfile, tmpfile)
 ')
 
 ########################################

diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index cc71032a57bc9771faec184d54553e6bc788a449..a52927902a25b95e73f9400700ba1557d1785c01 100644 (file)
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -8,14 +8,14 @@ attribute unconfined_login_domain;
 
 ## <desc>
 ## <p>
-##  allow unconfined user to transition to the nsplugin domains when running nspluginviewer
+##  allow unconfined users to transition to the nsplugin domains when running nspluginviewer
 ## </p>
 ## </desc>
 gen_tunable(allow_unconfined_nsplugin_transition, false)
 
 ## <desc>
 ## <p>
-## Allow unconfined user to transisition to the mozilla plugin domain when running xulrunner plugin-container.
+## Allow unconfined users to transisition to the Mozilla plugin domain when running xulrunner plugin-container.
 ## </p>
 ## </desc>
 gen_tunable(unconfined_mozilla_plugin_transition, false)

diff --git a/policy/modules/roles/xguest.te b/policy/modules/roles/xguest.te
index b8b5c152c1428f57c0354e35c446cce07d9fdde7..89290654ef3044f67df747289a702fef24a75623 100644 (file)
--- a/policy/modules/roles/xguest.te
+++ b/policy/modules/roles/xguest.te
@@ -14,14 +14,14 @@ gen_tunable(xguest_mount_media, true)
 
 ## <desc>
 ## <p>
-## Allow xguest to configure Network Manager and connect to apache ports
+## Allow xguest users to configure Network Manager and connect to apache ports
 ## </p>
 ## </desc>
 gen_tunable(xguest_connect_network, true)
 
 ## <desc>
 ## <p>
-## Allow xguest to use blue tooth devices
+## Allow xguest users to use blue tooth devices
 ## </p>
 ## </desc>
 gen_tunable(xguest_use_bluetooth, true)

diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index 77b50f9982819f0bd5cf75e8c38e0e12a94a5cee..a48a8628d5c51fe47cb3a030a88ad140b3188c58 100644 (file)
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -9,49 +9,49 @@ attribute virsh_transition_domain;
 
 ## <desc>
 ##     <p>
-##     Allow virt to use serial/parallel communication ports
+##     Allow confined virtual guests to use serial/parallel communication ports
 ##     </p>
 ## </desc>
 gen_tunable(virt_use_comm, false)
 
 ## <desc>
 ##     <p>
-##     Allow virt to read fuse files
+##     Allow confined virtual guests to read fuse files
 ##     </p>
 ## </desc>
 gen_tunable(virt_use_fusefs, false)
 
 ## <desc>
 ##     <p>
-##     Allow virt to manage nfs files
+##     Allow confined virtual guests to manage nfs files
 ##     </p>
 ## </desc>
 gen_tunable(virt_use_nfs, false)
 
 ## <desc>
 ##     <p>
-##     Allow virt to manage cifs files
+##     Allow confined virtual guests to manage cifs files
 ##     </p>
 ## </desc>
 gen_tunable(virt_use_samba, false)
 
 ## <desc>
 ##     <p>
-##     Allow virt to manage device configuration, (pci)
+##     Allow confined virtual guests to manage device configuration, (pci)
 ##     </p>
 ## </desc>
 gen_tunable(virt_use_sysfs, false)
 
 ## <desc>
 ##     <p>
-##     Allow virtual machine to interact with the xserver
+##     Allow confined virtual guests to interact with the xserver
 ##     </p>
 ## </desc>
 gen_tunable(virt_use_xserver, false)
 
 ## <desc>
 ##     <p>
-##     Allow virt to use usb devices
+##     Allow confined virtual guests to use usb devices
 ##     </p>
 ## </desc>
 gen_tunable(virt_use_usb, true)

diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index eb4294ee0995add5fe238493d5b3341e37b3bd61..df3116a6ac055f3c292abc9893b32c96f3d475c2 100644 (file)
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -42,14 +42,14 @@ gen_tunable(allow_xserver_execmem, false)
 
 ## <desc>
 ## <p>
-## Allows xdm to execute bootloader
+## Allow the graphical login program to execute bootloader
 ## </p>
 ## </desc>
 gen_tunable(xdm_exec_bootloader, false)
 
 ## <desc>
 ##     <p>
-##     Allow xdm logins as sysadm
+##     Allow graphical login program to login as sysadm_r:sysadm_t
 ##     </p>
 ## </desc>
 gen_tunable(xdm_sysadm_login, false)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index db079c22c7c89894328296c9979d9b22ba3e4b5b..2981ecec0e0bed8ce9d638078f1f9d9e363a9345 100644 (file)
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -295,7 +295,7 @@ tunable_policy(`init_systemd',`
        files_relabelfrom_tmp_dirs(init_t)
        files_relabelfrom_tmp_files(init_t)
        files_relabel_all_tmp_dirs(init_t)
-       files_relabelto_all_tmp_files(init_t)
+       files_relabel_all_tmp_files(init_t)
 
        auth_manage_faillog(init_t)
        auth_relabel_faillog(init_t)

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index 5119d1ea612fa0f6ad4a5ffca4d146a6ccbf4226..87fd10a650b53cc5fc56650c7d6ce9bcfb5e2470 100644 (file)
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -7,7 +7,7 @@ policy_module(userdomain, 4.4.4)
 
 ## <desc>
 ## <p>
-## Allow users to connect to mysql
+## Allow users to connect to mysql server
 ## </p>
 ## </desc>
 gen_tunable(allow_user_mysql_connect, false)