]>
Commit | Line | Data |
---|---|---|
826d0142 | 1 | policy_module(prelink, 1.10.0) |
2c243586 CP |
2 | |
3 | ######################################## | |
4 | # | |
5 | # Declarations | |
6 | ||
7 | attribute prelink_object; | |
8 | ||
9 | type prelink_t; | |
10 | type prelink_exec_t; | |
0bfccda4 | 11 | init_system_domain(prelink_t, prelink_exec_t) |
87eb5c84 | 12 | domain_obj_id_change_exemption(prelink_t) |
2c243586 CP |
13 | |
14 | type prelink_cache_t; | |
15 | files_type(prelink_cache_t) | |
16 | ||
9fe1b540 CP |
17 | type prelink_cron_system_t; |
18 | type prelink_cron_system_exec_t; | |
19 | domain_type(prelink_cron_system_t) | |
20 | domain_entry_file(prelink_cron_system_t, prelink_cron_system_exec_t) | |
21 | ||
2c243586 CP |
22 | type prelink_log_t; |
23 | logging_log_file(prelink_log_t) | |
24 | ||
6b19be33 CP |
25 | type prelink_tmp_t; |
26 | files_tmp_file(prelink_tmp_t) | |
27 | ||
9fe1b540 CP |
28 | type prelink_tmpfs_t; |
29 | files_tmpfs_file(prelink_tmpfs_t) | |
30 | ||
adea5875 | 31 | type prelink_var_lib_t; |
9fe1b540 | 32 | files_type(prelink_var_lib_t) |
adea5875 | 33 | |
2c243586 CP |
34 | ######################################## |
35 | # | |
36 | # Local policy | |
37 | # | |
38 | ||
57f81c62 | 39 | allow prelink_t self:capability { chown dac_override fowner fsetid setfcap sys_resource }; |
d9845ae9 | 40 | allow prelink_t self:process { execheap execmem execstack signal }; |
c0868a7a | 41 | allow prelink_t self:fifo_file rw_fifo_file_perms; |
2c243586 CP |
42 | |
43 | allow prelink_t prelink_cache_t:file manage_file_perms; | |
103fe280 | 44 | files_etc_filetrans(prelink_t, prelink_cache_t, file) |
2c243586 | 45 | |
c0868a7a | 46 | allow prelink_t prelink_log_t:dir setattr; |
0bfccda4 CP |
47 | create_files_pattern(prelink_t, prelink_log_t, prelink_log_t) |
48 | append_files_pattern(prelink_t, prelink_log_t, prelink_log_t) | |
49 | read_lnk_files_pattern(prelink_t, prelink_log_t, prelink_log_t) | |
1c1ac67f | 50 | logging_log_filetrans(prelink_t, prelink_log_t, file) |
2c243586 | 51 | |
adea5875 | 52 | allow prelink_t prelink_tmp_t:file { manage_file_perms execute relabelfrom execmod }; |
6b19be33 | 53 | files_tmp_filetrans(prelink_t, prelink_tmp_t, file) |
9fe1b540 CP |
54 | |
55 | allow prelink_t prelink_tmpfs_t:file { manage_file_perms execute relabelfrom execmod }; | |
56 | fs_tmpfs_filetrans(prelink_t, prelink_tmpfs_t, file) | |
6b19be33 | 57 | |
adea5875 CP |
58 | manage_dirs_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t) |
59 | manage_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t) | |
9fe1b540 CP |
60 | relabel_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t) |
61 | files_var_lib_filetrans(prelink_t, prelink_var_lib_t, { dir file }) | |
3eaa9939 | 62 | files_search_var_lib(prelink_t) |
adea5875 | 63 | |
2c243586 CP |
64 | # prelink misc objects that are not system |
65 | # libraries or entrypoints | |
83029ff3 | 66 | allow prelink_t prelink_object:file { manage_file_perms execute relabel_file_perms }; |
2c243586 CP |
67 | |
68 | kernel_read_system_state(prelink_t) | |
adea5875 | 69 | kernel_read_kernel_sysctls(prelink_t) |
2c243586 | 70 | |
fb63d0b5 CP |
71 | corecmd_manage_all_executables(prelink_t) |
72 | corecmd_relabel_all_executables(prelink_t) | |
73 | corecmd_mmap_all_executables(prelink_t) | |
46551033 | 74 | corecmd_read_bin_symlinks(prelink_t) |
2c243586 CP |
75 | |
76 | dev_read_urand(prelink_t) | |
3eaa9939 | 77 | dev_getattr_all_chr_files(prelink_t) |
2c243586 | 78 | |
2c243586 CP |
79 | files_list_all(prelink_t) |
80 | files_getattr_all_files(prelink_t) | |
9e04f5c5 | 81 | files_write_non_security_dirs(prelink_t) |
a524921a | 82 | files_read_etc_files(prelink_t) |
2c243586 | 83 | files_read_etc_runtime_files(prelink_t) |
d6d16b97 | 84 | files_dontaudit_read_all_symlinks(prelink_t) |
adea5875 CP |
85 | files_manage_usr_files(prelink_t) |
86 | files_manage_var_files(prelink_t) | |
87 | files_relabelfrom_usr_files(prelink_t) | |
2c243586 CP |
88 | |
89 | fs_getattr_xattr_fs(prelink_t) | |
90 | ||
3eaa9939 DW |
91 | storage_getattr_fixed_disk_dev(prelink_t) |
92 | ||
a5e2133b CP |
93 | selinux_get_enforce_mode(prelink_t) |
94 | ||
b0d2243c | 95 | libs_exec_ld_so(prelink_t) |
9fe1b540 | 96 | libs_legacy_use_shared_libs(prelink_t) |
2c243586 CP |
97 | libs_manage_ld_so(prelink_t) |
98 | libs_relabel_ld_so(prelink_t) | |
2c243586 CP |
99 | libs_manage_shared_libs(prelink_t) |
100 | libs_relabel_shared_libs(prelink_t) | |
8cf67141 | 101 | libs_delete_lib_symlinks(prelink_t) |
2c243586 CP |
102 | |
103 | miscfiles_read_localization(prelink_t) | |
104 | ||
af2d8802 | 105 | userdom_use_inherited_user_terminals(prelink_t) |
3eaa9939 | 106 | userdom_manage_user_home_content(prelink_t) |
9da344bc | 107 | userdom_relabel_user_home_files(prelink_t) |
3eaa9939 | 108 | userdom_execmod_user_home_files(prelink_t) |
8c85cd22 | 109 | userdom_exec_user_home_content_files(prelink_t) |
296273a7 | 110 | |
21fd3a28 DW |
111 | systemd_read_unit_files(prelink_t) |
112 | ||
1852e28a DW |
113 | term_use_all_inherited_terms(prelink_t) |
114 | ||
d6d16b97 CP |
115 | optional_policy(` |
116 | amanda_manage_lib(prelink_t) | |
d9845ae9 CP |
117 | ') |
118 | ||
bb7170f6 | 119 | optional_policy(` |
2c243586 CP |
120 | cron_system_entry(prelink_t, prelink_exec_t) |
121 | ') | |
adea5875 | 122 | |
9fe1b540 CP |
123 | optional_policy(` |
124 | rpm_manage_tmp_files(prelink_t) | |
125 | ') | |
126 | ||
3044f38f DW |
127 | optional_policy(` |
128 | unconfined_domain(prelink_t) | |
129 | ') | |
9fe1b540 CP |
130 | |
131 | ######################################## | |
132 | # | |
133 | # Prelink Cron system Policy | |
134 | # | |
135 | ||
136 | optional_policy(` | |
137 | allow prelink_cron_system_t self:capability setuid; | |
a9ef84b5 | 138 | allow prelink_cron_system_t self:process { setsched setfscreate signal }; |
9fe1b540 CP |
139 | allow prelink_cron_system_t self:fifo_file rw_fifo_file_perms; |
140 | allow prelink_cron_system_t self:unix_dgram_socket { write bind create setopt }; | |
141 | ||
142 | read_files_pattern(prelink_cron_system_t, prelink_cache_t, prelink_cache_t) | |
143 | allow prelink_cron_system_t prelink_cache_t:file unlink; | |
3eaa9939 | 144 | files_delete_etc_dir_entry(prelink_cron_system_t) |
9fe1b540 CP |
145 | |
146 | domtrans_pattern(prelink_cron_system_t, prelink_exec_t, prelink_t) | |
147 | allow prelink_cron_system_t prelink_t:process noatsecure; | |
148 | ||
149 | manage_files_pattern(prelink_cron_system_t, prelink_log_t, prelink_log_t) | |
150 | ||
151 | manage_files_pattern(prelink_cron_system_t, prelink_var_lib_t, prelink_var_lib_t) | |
152 | files_var_lib_filetrans(prelink_cron_system_t, prelink_var_lib_t, file) | |
153 | allow prelink_cron_system_t prelink_var_lib_t:file { relabelfrom relabelto }; | |
154 | ||
155 | kernel_read_system_state(prelink_cron_system_t) | |
156 | ||
157 | corecmd_exec_bin(prelink_cron_system_t) | |
158 | corecmd_exec_shell(prelink_cron_system_t) | |
159 | ||
a9ef84b5 | 160 | files_dontaudit_search_all_mountpoints(prelink_cron_system_t) |
9fe1b540 | 161 | files_read_etc_files(prelink_cron_system_t) |
a9ef84b5 | 162 | files_search_var_lib(prelink_cron_system_t) |
9fe1b540 | 163 | |
56ad7147 MG |
164 | fs_search_cgroup_dirs(prelink_cron_system_t) |
165 | ||
3eaa9939 | 166 | init_telinit(prelink_cron_system_t) |
9fe1b540 CP |
167 | |
168 | libs_exec_ld_so(prelink_cron_system_t) | |
169 | ||
170 | logging_search_logs(prelink_cron_system_t) | |
171 | ||
aa7e2b88 DW |
172 | init_stream_connect(prelink_cron_system_t) |
173 | ||
9fe1b540 CP |
174 | miscfiles_read_localization(prelink_cron_system_t) |
175 | ||
176 | cron_system_entry(prelink_cron_system_t, prelink_cron_system_exec_t) | |
177 | ||
3eaa9939 DW |
178 | userdom_dontaudit_list_admin_dir(prelink_cron_system_t) |
179 | ||
9fe1b540 CP |
180 | optional_policy(` |
181 | rpm_read_db(prelink_cron_system_t) | |
182 | ') | |
183 | ') | |
3fdb12de DW |
184 | ifdef(`hide_broken_symptoms', ` |
185 | optional_policy(` | |
186 | dbus_read_config(prelink_t) | |
187 | ') | |
3e576fcc | 188 | miscfiles_read_man_pages(prelink_t) |
3fdb12de | 189 | ') |