From: Stefan Schantl Date: Sun, 1 Jan 2012 15:10:49 +0000 (+0100) Subject: Remove module for mozilla. X-Git-Tag: 001~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f04d8ee6ee7adc74ee8196b5657b3b408f2531bc;p=people%2Fstevee%2Fselinux-policy.git Remove module for mozilla. --- diff --git a/policy/modules/admin/prelink.te b/policy/modules/admin/prelink.te index 5d940f84..20fd89c1 100644 --- a/policy/modules/admin/prelink.te +++ b/policy/modules/admin/prelink.te @@ -125,10 +125,6 @@ optional_policy(` gnome_dontaudit_read_inherited_gconf_config_files(prelink_t) ') -optional_policy(` - mozilla_plugin_manage_rw_files(prelink_t) -') - optional_policy(` rpm_manage_tmp_files(prelink_t) ') diff --git a/policy/modules/apps/evolution.te b/policy/modules/apps/evolution.te index e8c94b14..c6cbb69e 100644 --- a/policy/modules/apps/evolution.te +++ b/policy/modules/apps/evolution.te @@ -316,11 +316,6 @@ optional_policy(` lpd_domtrans_lpr(evolution_t) ') -optional_policy(` - mozilla_read_user_home_files(evolution_t) - mozilla_domtrans(evolution_t) -') - ### Junk mail filtering (start spamd) optional_policy(` spamassassin_exec_spamd(evolution_t) diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te index 80f8c318..9e7ad4b8 100644 --- a/policy/modules/apps/gpg.te +++ b/policy/modules/apps/gpg.te @@ -161,11 +161,6 @@ optional_policy(` mta_read_spool(gpg_t) ') -optional_policy(` - mozilla_read_user_home_files(gpg_t) - mozilla_write_user_home_files(gpg_t) -') - optional_policy(` spamassassin_read_spamd_tmp_files(gpg_t) ') @@ -284,10 +279,6 @@ tunable_policy(`gpg_agent_env_file',` userdom_home_manager(gpg_agent_t) -optional_policy(` - mozilla_dontaudit_rw_user_home_files(gpg_agent_t) -') - ############################## # # Pinentry local policy diff --git a/policy/modules/apps/mozilla.fc b/policy/modules/apps/mozilla.fc deleted file mode 100644 index 65ef6ab5..00000000 --- a/policy/modules/apps/mozilla.fc +++ /dev/null @@ -1,38 +0,0 @@ -HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.java(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.mozilla(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.thunderbird(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.netscape(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.adobe(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.macromedia(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.gnash(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.gcjwebplugin(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.icedteaplugin(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) - -# -# /bin -# -/usr/bin/netscape -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/bin/mozilla -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/bin/mozilla-snapshot -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/bin/epiphany-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/bin/epiphany -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/bin/mozilla-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/bin/mozilla-bin-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0) - -# -# /lib -# -/usr/lib/galeon/galeon -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/netscape/.+/communicator/communicator-smotif\.real -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/netscape/base-4/wrapper -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/mozilla[^/]*/reg.+ -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/mozilla[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/firefox[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) - -/usr/lib/xulrunner[^/]*/plugin-container -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0) - -/usr/lib/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:mozilla_plugin_rw_t,s0) diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if deleted file mode 100644 index 7b4441a9..00000000 --- a/policy/modules/apps/mozilla.if +++ /dev/null @@ -1,423 +0,0 @@ -## Policy for Mozilla and related web browsers - -######################################## -## -## Role access for mozilla -## -## -## -## Role allowed access -## -## -## -## -## User domain for the role -## -## -# -interface(`mozilla_role',` - gen_require(` - type mozilla_t, mozilla_exec_t, mozilla_home_t; - ') - - role $1 types mozilla_t; - - domain_auto_trans($2, mozilla_exec_t, mozilla_t) - # Unrestricted inheritance from the caller. - allow $2 mozilla_t:process { noatsecure siginh rlimitinh }; - allow mozilla_t $2:fd use; - allow mozilla_t $2:process { sigchld signull }; - allow mozilla_t $2:unix_stream_socket connectto; - - mozilla_run_plugin(mozilla_t, $1) - - # Allow the user domain to signal/ps. - ps_process_pattern($2, mozilla_t) - allow $2 mozilla_t:process signal_perms; - - allow $2 mozilla_t:fd use; - allow $2 mozilla_t:shm { associate getattr }; - allow $2 mozilla_t:shm { unix_read unix_write }; - allow $2 mozilla_t:unix_stream_socket connectto; - - # X access, Home files - manage_dirs_pattern($2, mozilla_home_t, mozilla_home_t) - manage_files_pattern($2, mozilla_home_t, mozilla_home_t) - manage_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t) - relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t) - relabel_files_pattern($2, mozilla_home_t, mozilla_home_t) - relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t) - - mozilla_run_plugin(mozilla_t, $1) - mozilla_dbus_chat($2) - - userdom_manage_tmp_role($1, mozilla_t) - - optional_policy(` - pulseaudio_role($1, mozilla_t) - pulseaudio_filetrans_admin_home_content(mozilla_t) - pulseaudio_filetrans_home_content(mozilla_t) - ') - - mozilla_filetrans_home_content($2) -') - -######################################## -## -## Read mozilla home directory content -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_read_user_home_files',` - gen_require(` - type mozilla_home_t; - ') - - allow $1 mozilla_home_t:dir list_dir_perms; - allow $1 mozilla_home_t:file read_file_perms; - allow $1 mozilla_home_t:lnk_file read_lnk_file_perms; - userdom_search_user_home_dirs($1) -') - -######################################## -## -## Write mozilla home directory content -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_write_user_home_files',` - gen_require(` - type mozilla_home_t; - ') - - write_files_pattern($1, mozilla_home_t, mozilla_home_t) - userdom_search_user_home_dirs($1) -') - -######################################## -## -## Dontaudit attempts to read/write mozilla home directory content -## -## -## -## Domain to not audit. -## -## -# -interface(`mozilla_dontaudit_rw_user_home_files',` - gen_require(` - type mozilla_home_t; - ') - - dontaudit $1 mozilla_home_t:file rw_inherited_file_perms; -') - -######################################## -## -## Dontaudit attempts to write mozilla home directory content -## -## -## -## Domain to not audit. -## -## -# -interface(`mozilla_dontaudit_manage_user_home_files',` - gen_require(` - type mozilla_home_t; - ') - - dontaudit $1 mozilla_home_t:dir manage_dir_perms; - dontaudit $1 mozilla_home_t:file manage_file_perms; -') - -######################################## -## -## Execute mozilla home directory content. -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_exec_user_home_files',` - gen_require(` - type mozilla_home_t; - ') - - can_exec($1, mozilla_home_t) -') - -######################################## -## -## Execmod mozilla home directory content. -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_execmod_user_home_files',` - gen_require(` - type mozilla_home_t; - ') - - allow $1 mozilla_home_t:file execmod; -') - -######################################## -## -## Run mozilla in the mozilla domain. -## -## -## -## Domain allowed to transition. -## -## -# -interface(`mozilla_domtrans',` - gen_require(` - type mozilla_t, mozilla_exec_t; - ') - - domtrans_pattern($1, mozilla_exec_t, mozilla_t) -') - -######################################## -## -## Execute a domain transition to run mozilla_plugin. -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_domtrans_plugin',` - gen_require(` - type mozilla_plugin_t, mozilla_plugin_exec_t; - type mozilla_plugin_config_t, mozilla_plugin_config_exec_t; - type mozilla_plugin_rw_t; - class dbus send_msg; - ') - - domtrans_pattern($1, mozilla_plugin_exec_t, mozilla_plugin_t) - domtrans_pattern($1, mozilla_plugin_config_exec_t, mozilla_plugin_config_t) - allow mozilla_plugin_t $1:process signull; - allow $1 mozilla_plugin_t:unix_stream_socket { connectto rw_socket_perms }; - allow $1 mozilla_plugin_t:fd use; - - allow mozilla_plugin_t $1:unix_stream_socket rw_socket_perms; - allow mozilla_plugin_t $1:shm { rw_shm_perms destroy }; - allow mozilla_plugin_t $1:sem create_sem_perms; - - ps_process_pattern($1, mozilla_plugin_t) - allow $1 mozilla_plugin_t:process signal_perms; - - list_dirs_pattern($1, mozilla_plugin_rw_t, mozilla_plugin_rw_t) - read_files_pattern($1, mozilla_plugin_rw_t, mozilla_plugin_rw_t) - read_lnk_files_pattern($1, mozilla_plugin_rw_t, mozilla_plugin_rw_t) - can_exec($1, mozilla_plugin_rw_t) - - #mozilla_filetrans_home_content($1) -') - -######################################## -## -## Execute mozilla_plugin in the mozilla_plugin domain, and -## allow the specified role the mozilla_plugin domain. -## -## -## -## Domain allowed access -## -## -## -## -## The role to be allowed the mozilla_plugin domain. -## -## -# -interface(`mozilla_run_plugin',` - gen_require(` - type mozilla_plugin_t; - ') - - mozilla_domtrans_plugin($1) - role $2 types mozilla_plugin_t; - role $2 types mozilla_plugin_config_t; -') - -####################################### -## -## Execute qemu unconfined programs in the role. -## -## -## -## The role to allow the mozilla_plugin domain. -## -## -## -# -interface(`mozilla_role_plugin',` - gen_require(` - type mozilla_plugin_t; - ') - - role $1 types mozilla_plugin_t; - role $1 types mozilla_plugin_config_t; -') - -######################################## -## -## Send and receive messages from -## mozilla over dbus. -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_dbus_chat',` - gen_require(` - type mozilla_t; - class dbus send_msg; - ') - - allow $1 mozilla_t:dbus send_msg; - allow mozilla_t $1:dbus send_msg; -') - -######################################## -## -## read/write mozilla per user tcp_socket -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_rw_tcp_sockets',` - gen_require(` - type mozilla_t; - ') - - allow $1 mozilla_t:tcp_socket rw_socket_perms; -') - -####################################### -## -## Read mozilla_plugin tmpfs files -## -## -## -## Domain allowed access -## -## -# -interface(`mozilla_plugin_read_tmpfs_files',` - gen_require(` - type mozilla_plugin_tmpfs_t; - ') - - allow $1 mozilla_plugin_tmpfs_t:file read_file_perms; -') - -######################################## -## -## Delete mozilla_plugin tmpfs files -## -## -## -## Domain allowed access -## -## -# -interface(`mozilla_plugin_delete_tmpfs_files',` - gen_require(` - type mozilla_plugin_tmpfs_t; - ') - - allow $1 mozilla_plugin_tmpfs_t:file delete_file_perms; -') - -######################################## -## -## Dontaudit read/write to a mozilla_plugin leaks -## -## -## -## Domain to not audit. -## -## -# -interface(`mozilla_plugin_dontaudit_leaks',` - gen_require(` - type mozilla_plugin_t; - ') - - dontaudit $1 mozilla_plugin_t:unix_stream_socket { read write }; -') - -######################################## -## -## Create, read, write, and delete -## mozilla_plugin rw files. -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_plugin_manage_rw_files',` - gen_require(` - type mozilla_plugin_rw_t; - ') - - allow $1 mozilla_plugin_rw_t:file manage_file_perms; - allow $1 mozilla_plugin_rw_t:dir rw_dir_perms; -') - -######################################## -## -## Create mozilla content in the user home directory -## with an correct label. -## -## -## -## Domain allowed access. -## -## -# -interface(`mozilla_filetrans_home_content',` - - gen_require(` - type mozilla_home_t; - ') - - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".galeon") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".java") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".mozilla") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".thunderbird") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".netscape") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".phoenix") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".adobe") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".macromedia") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".gnash") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".gcjwebplugin") - userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".icedteaplugin") -') - diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te deleted file mode 100644 index a89214c7..00000000 --- a/policy/modules/apps/mozilla.te +++ /dev/null @@ -1,547 +0,0 @@ -policy_module(mozilla, 2.3.3) - -######################################## -# -# Declarations -# - -## -##

-## Allow confined web browsers to read home directory content -##

-## -gen_tunable(mozilla_read_content, false) - -type mozilla_t; -type mozilla_exec_t; -typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t }; -typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t }; -application_domain(mozilla_t, mozilla_exec_t) -ubac_constrained(mozilla_t) - -type mozilla_conf_t; -files_config_file(mozilla_conf_t) - -type mozilla_home_t; -typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t }; -typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t }; -files_poly_member(mozilla_home_t) -userdom_user_home_content(mozilla_home_t) - -type mozilla_plugin_t; -type mozilla_plugin_exec_t; -application_domain(mozilla_plugin_t, mozilla_plugin_exec_t) -role system_r types mozilla_plugin_t; - -type mozilla_plugin_tmp_t; -userdom_user_tmp_content(mozilla_plugin_tmp_t) -files_tmp_file(mozilla_plugin_tmp_t) -ubac_constrained(mozilla_plugin_tmp_t) - -type mozilla_plugin_tmpfs_t; -userdom_user_tmpfs_content(mozilla_plugin_tmpfs_t) -files_tmpfs_file(mozilla_plugin_tmpfs_t) -ubac_constrained(mozilla_plugin_tmpfs_t) - -type mozilla_plugin_rw_t; -files_type(mozilla_plugin_rw_t) - -type mozilla_plugin_config_t; -type mozilla_plugin_config_exec_t; -application_domain(mozilla_plugin_config_t, mozilla_plugin_config_exec_t) - -type mozilla_tmp_t; -files_tmp_file(mozilla_tmp_t) -ubac_constrained(mozilla_tmp_t) - -type mozilla_tmpfs_t; -typealias mozilla_tmpfs_t alias { user_mozilla_tmpfs_t staff_mozilla_tmpfs_t sysadm_mozilla_tmpfs_t }; -typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_t }; -files_tmpfs_file(mozilla_tmpfs_t) -ubac_constrained(mozilla_tmpfs_t) - -######################################## -# -# Local policy -# - -allow mozilla_t self:capability { sys_nice setgid setuid }; -allow mozilla_t self:process { sigkill signal setsched getsched setrlimit }; -allow mozilla_t self:fifo_file rw_fifo_file_perms; -allow mozilla_t self:shm { unix_read unix_write read write destroy create }; -allow mozilla_t self:sem create_sem_perms; -allow mozilla_t self:socket create_socket_perms; -allow mozilla_t self:unix_stream_socket { listen accept }; -# Browse the web, connect to printer -allow mozilla_t self:tcp_socket create_socket_perms; -allow mozilla_t self:netlink_route_socket r_netlink_socket_perms; - -# for bash - old mozilla binary -can_exec(mozilla_t, mozilla_exec_t) - -# X access, Home files -manage_dirs_pattern(mozilla_t, mozilla_home_t, mozilla_home_t) -manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t) -manage_lnk_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t) -userdom_search_user_home_dirs(mozilla_t) -userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir) - -# Mozpluggerrc -allow mozilla_t mozilla_conf_t:file read_file_perms; - -manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) -manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) -files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir }) - -manage_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) -manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) -manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) -manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) -fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) - -kernel_read_kernel_sysctls(mozilla_t) -kernel_read_network_state(mozilla_t) -# Access /proc, sysctl -kernel_read_system_state(mozilla_t) -kernel_read_net_sysctls(mozilla_t) - -# Look for plugins -corecmd_list_bin(mozilla_t) -# for bash - old mozilla binary -corecmd_exec_shell(mozilla_t) -corecmd_exec_bin(mozilla_t) - -# Browse the web, connect to printer -corenet_all_recvfrom_unlabeled(mozilla_t) -corenet_all_recvfrom_netlabel(mozilla_t) -corenet_tcp_sendrecv_generic_if(mozilla_t) -corenet_raw_sendrecv_generic_if(mozilla_t) -corenet_tcp_sendrecv_generic_node(mozilla_t) -corenet_raw_sendrecv_generic_node(mozilla_t) -corenet_tcp_sendrecv_http_port(mozilla_t) -corenet_tcp_sendrecv_http_cache_port(mozilla_t) -corenet_tcp_sendrecv_squid_port(mozilla_t) -corenet_tcp_connect_flash_port(mozilla_t) -corenet_tcp_sendrecv_ftp_port(mozilla_t) -corenet_tcp_connect_all_ephemeral_ports(mozilla_t) -corenet_tcp_sendrecv_ipp_port(mozilla_t) -corenet_tcp_connect_http_port(mozilla_t) -corenet_tcp_connect_http_cache_port(mozilla_t) -corenet_tcp_connect_squid_port(mozilla_t) -corenet_tcp_connect_ftp_port(mozilla_t) -corenet_tcp_connect_ipp_port(mozilla_t) -corenet_tcp_connect_generic_port(mozilla_t) -corenet_tcp_connect_soundd_port(mozilla_t) -corenet_sendrecv_http_client_packets(mozilla_t) -corenet_sendrecv_http_cache_client_packets(mozilla_t) -corenet_sendrecv_squid_client_packets(mozilla_t) -corenet_sendrecv_ftp_client_packets(mozilla_t) -corenet_sendrecv_ipp_client_packets(mozilla_t) -corenet_sendrecv_generic_client_packets(mozilla_t) -# Should not need other ports -corenet_dontaudit_tcp_sendrecv_generic_port(mozilla_t) -corenet_dontaudit_tcp_bind_generic_port(mozilla_t) -corenet_tcp_connect_speech_port(mozilla_t) - -dev_read_urand(mozilla_t) -dev_read_rand(mozilla_t) -dev_write_sound(mozilla_t) -dev_read_sound(mozilla_t) -dev_dontaudit_rw_dri(mozilla_t) -dev_getattr_sysfs_dirs(mozilla_t) - -domain_dontaudit_read_all_domains_state(mozilla_t) - -files_read_etc_runtime_files(mozilla_t) -files_read_usr_files(mozilla_t) -files_read_etc_files(mozilla_t) -# /var/lib -files_read_var_lib_files(mozilla_t) -# interacting with gstreamer -files_read_var_files(mozilla_t) -files_read_var_symlinks(mozilla_t) -files_dontaudit_getattr_boot_dirs(mozilla_t) - -fs_search_auto_mountpoints(mozilla_t) -fs_list_inotifyfs(mozilla_t) -fs_rw_tmpfs_files(mozilla_t) - -term_dontaudit_getattr_pty_dirs(mozilla_t) - -auth_use_nsswitch(mozilla_t) - -logging_send_syslog_msg(mozilla_t) - -miscfiles_read_fonts(mozilla_t) -miscfiles_read_localization(mozilla_t) -miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) - -# Browse the web, connect to printer -sysnet_dns_name_resolve(mozilla_t) - -userdom_use_inherited_user_ptys(mozilla_t) - -xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t) -xserver_dontaudit_read_xdm_tmp_files(mozilla_t) -xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t) - -tunable_policy(`allow_execstack',` - allow mozilla_t self:process execstack; -') - -tunable_policy(`deny_execmem',`',` - allow mozilla_t self:process execmem; -') - -userdom_home_manager(mozilla_t) - -# Uploads, local html -tunable_policy(`mozilla_read_content && use_nfs_home_dirs',` - fs_list_auto_mountpoints(mozilla_t) - files_list_home(mozilla_t) - fs_read_nfs_files(mozilla_t) - fs_read_nfs_symlinks(mozilla_t) - -',` - files_dontaudit_list_home(mozilla_t) - fs_dontaudit_list_auto_mountpoints(mozilla_t) - fs_dontaudit_read_nfs_files(mozilla_t) - fs_dontaudit_list_nfs(mozilla_t) -') - -tunable_policy(`mozilla_read_content && use_samba_home_dirs',` - fs_list_auto_mountpoints(mozilla_t) - files_list_home(mozilla_t) - fs_read_cifs_files(mozilla_t) - fs_read_cifs_symlinks(mozilla_t) -',` - files_dontaudit_list_home(mozilla_t) - fs_dontaudit_list_auto_mountpoints(mozilla_t) - fs_dontaudit_read_cifs_files(mozilla_t) - fs_dontaudit_list_cifs(mozilla_t) -') - -tunable_policy(`mozilla_read_content',` - userdom_list_user_tmp(mozilla_t) - userdom_read_user_tmp_files(mozilla_t) - userdom_read_user_tmp_symlinks(mozilla_t) - userdom_read_user_home_content_files(mozilla_t) - userdom_read_user_home_content_symlinks(mozilla_t) - - ifndef(`enable_mls',` - fs_search_removable(mozilla_t) - fs_read_removable_files(mozilla_t) - fs_read_removable_symlinks(mozilla_t) - ') -',` - files_dontaudit_list_tmp(mozilla_t) - files_dontaudit_list_home(mozilla_t) - fs_dontaudit_list_removable(mozilla_t) - fs_dontaudit_read_removable_files(mozilla_t) - userdom_dontaudit_list_user_tmp(mozilla_t) - userdom_dontaudit_read_user_tmp_files(mozilla_t) - userdom_dontaudit_list_user_home_dirs(mozilla_t) - userdom_dontaudit_read_user_home_content_files(mozilla_t) -') - -optional_policy(` - apache_read_user_scripts(mozilla_t) - apache_read_user_content(mozilla_t) -') - -optional_policy(` - automount_dontaudit_getattr_tmp_dirs(mozilla_t) -') - -optional_policy(` - cups_read_rw_config(mozilla_t) - cups_dbus_chat(mozilla_t) -') - -optional_policy(` - dbus_system_bus_client(mozilla_t) - dbus_session_bus_client(mozilla_t) - - optional_policy(` - networkmanager_dbus_chat(mozilla_t) - ') -') - -optional_policy(` - gnome_stream_connect_gconf(mozilla_t) - gnome_manage_config(mozilla_t) - gnome_manage_gconf_home_files(mozilla_t) -') - -optional_policy(` - java_domtrans(mozilla_t) -') - -optional_policy(` - lpd_domtrans_lpr(mozilla_t) -') - -optional_policy(` - mplayer_domtrans(mozilla_t) - mplayer_read_user_home_files(mozilla_t) -') - -optional_policy(` - pulseaudio_exec(mozilla_t) - pulseaudio_stream_connect(mozilla_t) - pulseaudio_manage_home_files(mozilla_t) -') - -optional_policy(` - thunderbird_domtrans(mozilla_t) -') - -######################################## -# -# mozilla_plugin local policy -# - -dontaudit mozilla_plugin_t self:capability sys_nice; - -allow mozilla_plugin_t self:process { setsched signal_perms execmem }; -allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms; -allow mozilla_plugin_t self:tcp_socket create_stream_socket_perms; -allow mozilla_plugin_t self:udp_socket create_socket_perms; -allow mozilla_plugin_t self:netlink_kobject_uevent_socket create_socket_perms; - -allow mozilla_plugin_t self:sem create_sem_perms; -allow mozilla_plugin_t self:shm create_shm_perms; -allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms; -allow mozilla_plugin_t self:unix_dgram_socket sendto; -allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms }; - -can_exec(mozilla_plugin_t, mozilla_home_t) -manage_dirs_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) -manage_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) -manage_lnk_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) - -manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) -manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) -manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) -manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) -files_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file }) -userdom_user_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file }) -can_exec(mozilla_plugin_t, mozilla_plugin_tmp_t) - -manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t) -manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t) -manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t) -manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t) -fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file }) - -allow mozilla_plugin_t mozilla_plugin_rw_t:dir list_dir_perms; -read_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) -read_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) - -can_exec(mozilla_plugin_t, mozilla_exec_t) - -kernel_read_kernel_sysctls(mozilla_plugin_t) -kernel_read_system_state(mozilla_plugin_t) -kernel_read_network_state(mozilla_plugin_t) -kernel_request_load_module(mozilla_plugin_t) - -corecmd_exec_bin(mozilla_plugin_t) -corecmd_exec_shell(mozilla_plugin_t) - -corenet_tcp_connect_generic_port(mozilla_plugin_t) -corenet_tcp_connect_flash_port(mozilla_plugin_t) -corenet_tcp_connect_streaming_port(mozilla_plugin_t) -corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t) -corenet_tcp_connect_http_port(mozilla_plugin_t) -corenet_tcp_connect_http_cache_port(mozilla_plugin_t) -corenet_tcp_connect_squid_port(mozilla_plugin_t) -corenet_tcp_connect_ipp_port(mozilla_plugin_t) -corenet_tcp_connect_mmcc_port(mozilla_plugin_t) -corenet_tcp_connect_speech_port(mozilla_plugin_t) -corenet_tcp_connect_streaming_port(mozilla_plugin_t) -corenet_tcp_connect_ftp_port(mozilla_plugin_t) -corenet_tcp_connect_all_ephemeral_ports(mozilla_plugin_t) -corenet_tcp_bind_generic_node(mozilla_plugin_t) -corenet_udp_bind_generic_node(mozilla_plugin_t) - -dev_read_rand(mozilla_plugin_t) -dev_read_urand(mozilla_plugin_t) -dev_read_video_dev(mozilla_plugin_t) -dev_write_video_dev(mozilla_plugin_t) -dev_read_sysfs(mozilla_plugin_t) -dev_read_sound(mozilla_plugin_t) -dev_write_sound(mozilla_plugin_t) -# for nvidia driver -dev_rw_xserver_misc(mozilla_plugin_t) -dev_dontaudit_rw_dri(mozilla_plugin_t) - -domain_use_interactive_fds(mozilla_plugin_t) -domain_dontaudit_read_all_domains_state(mozilla_plugin_t) - -files_read_config_files(mozilla_plugin_t) -files_read_usr_files(mozilla_plugin_t) -files_list_mnt(mozilla_plugin_t) - -fs_getattr_all_fs(mozilla_plugin_t) -fs_list_dos(mozilla_plugin_t) -fs_read_dos_files(mozilla_plugin_t) - -application_dontaudit_signull(mozilla_plugin_t) - -auth_use_nsswitch(mozilla_plugin_t) - -logging_send_syslog_msg(mozilla_plugin_t) - -miscfiles_read_localization(mozilla_plugin_t) -miscfiles_read_fonts(mozilla_plugin_t) -miscfiles_read_generic_certs(mozilla_plugin_t) -miscfiles_dontaudit_setattr_fonts_dirs(mozilla_plugin_t) -miscfiles_dontaudit_setattr_fonts_cache_dirs(mozilla_plugin_t) - -sysnet_dns_name_resolve(mozilla_plugin_t) - -term_getattr_all_ttys(mozilla_plugin_t) -term_getattr_all_ptys(mozilla_plugin_t) - -userdom_rw_user_tmpfs_files(mozilla_plugin_t) -userdom_delete_user_tmpfs_files(mozilla_plugin_t) -userdom_dontaudit_use_user_terminals(mozilla_plugin_t) -userdom_manage_user_tmp_sockets(mozilla_plugin_t) -userdom_manage_user_tmp_dirs(mozilla_plugin_t) -userdom_read_user_tmp_files(mozilla_plugin_t) -userdom_read_user_tmp_symlinks(mozilla_plugin_t) -userdom_stream_connect(mozilla_plugin_t) -userdom_dontaudit_rw_user_tmp_pipes(mozilla_plugin_t) - -userdom_read_user_home_content_files(mozilla_plugin_t) -userdom_read_user_home_content_symlinks(mozilla_plugin_t) -userdom_read_home_certs(mozilla_plugin_t) -userdom_dontaudit_write_home_certs(mozilla_plugin_t) -userdom_read_home_audio_files(mozilla_plugin_t) - -tunable_policy(`deny_execmem',`', ` - allow mozilla_plugin_t self:process execmem; -') - -tunable_policy(`allow_execstack',` - allow mozilla_plugin_t self:process execstack; -') - -userdom_home_manager(mozilla_plugin_t) - -optional_policy(` - alsa_read_rw_config(mozilla_plugin_t) - alsa_read_home_files(mozilla_plugin_t) -') - -optional_policy(` - dbus_system_bus_client(mozilla_plugin_t) - dbus_session_bus_client(mozilla_plugin_t) - dbus_read_lib_files(mozilla_plugin_t) -') - -optional_policy(` - git_dontaudit_read_session_content_files(mozilla_plugin_t) -') - - -optional_policy(` - gnome_manage_config(mozilla_plugin_t) - gnome_read_usr_config(mozilla_plugin_t) -') - -optional_policy(` - java_exec(mozilla_plugin_t) -') - -optional_policy(` - mplayer_exec(mozilla_plugin_t) - mplayer_read_user_home_files(mozilla_plugin_t) -') - -optional_policy(` - pulseaudio_exec(mozilla_plugin_t) - pulseaudio_stream_connect(mozilla_plugin_t) - pulseaudio_setattr_home_dir(mozilla_plugin_t) - pulseaudio_manage_home_files(mozilla_plugin_t) - pulseaudio_manage_home_symlinks(mozilla_plugin_t) -') - -optional_policy(` - pcscd_stream_connect(mozilla_plugin_t) -') - -optional_policy(` - rtkit_scheduled(mozilla_plugin_t) -') - -optional_policy(` - udev_read_db(mozilla_plugin_t) -') - -optional_policy(` - xserver_read_xdm_pid(mozilla_plugin_t) - xserver_stream_connect(mozilla_plugin_t) - xserver_use_user_fonts(mozilla_plugin_t) - xserver_read_user_iceauth(mozilla_plugin_t) - xserver_read_user_xauth(mozilla_plugin_t) - xserver_append_xdm_home_files(mozilla_plugin_t); -') - -######################################## -# -# mozilla_plugin_config local policy -# - -allow mozilla_plugin_config_t self:capability { dac_override dac_read_search sys_nice setuid setgid }; -allow mozilla_plugin_config_t self:process { setsched signal_perms getsched execmem }; - -allow mozilla_plugin_config_t self:fifo_file rw_file_perms; -allow mozilla_plugin_config_t self:unix_stream_socket create_stream_socket_perms; - -dev_search_sysfs(mozilla_plugin_config_t) -dev_read_urand(mozilla_plugin_config_t) -dev_dontaudit_read_rand(mozilla_plugin_config_t) -dev_dontaudit_rw_dri(mozilla_plugin_config_t) - -fs_search_auto_mountpoints(mozilla_plugin_config_t) -fs_list_inotifyfs(mozilla_plugin_config_t) - -can_exec(mozilla_plugin_config_t, mozilla_plugin_rw_t) -manage_dirs_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) -manage_files_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) -manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) - -manage_dirs_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) -manage_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) -manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) - -corecmd_exec_bin(mozilla_plugin_config_t) -corecmd_exec_shell(mozilla_plugin_config_t) - -kernel_read_system_state(mozilla_plugin_config_t) -kernel_request_load_module(mozilla_plugin_config_t) - -domain_use_interactive_fds(mozilla_plugin_config_t) - -files_read_etc_files(mozilla_plugin_config_t) -files_read_usr_files(mozilla_plugin_config_t) -files_dontaudit_search_home(mozilla_plugin_config_t) -files_list_tmp(mozilla_plugin_config_t) - -auth_use_nsswitch(mozilla_plugin_config_t) - -miscfiles_read_localization(mozilla_plugin_config_t) -miscfiles_read_fonts(mozilla_plugin_config_t) - -userdom_search_user_home_content(mozilla_plugin_config_t) -userdom_read_user_home_content_symlinks(mozilla_plugin_config_t) -userdom_read_user_home_content_files(mozilla_plugin_config_t) -userdom_dontaudit_search_admin_dir(mozilla_plugin_config_t) -userdom_use_inherited_user_ptys(mozilla_plugin_config_t) - -domtrans_pattern(mozilla_plugin_config_t, mozilla_plugin_exec_t, mozilla_plugin_t) - -optional_policy(` - xserver_use_user_fonts(mozilla_plugin_config_t) -') diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te index 34114971..48673c79 100644 --- a/policy/modules/apps/pulseaudio.te +++ b/policy/modules/apps/pulseaudio.te @@ -159,11 +159,6 @@ optional_policy(` rtkit_scheduled(pulseaudio_t) ') -optional_policy(` - mozilla_plugin_delete_tmpfs_files(pulseaudio_t) - mozilla_plugin_read_tmpfs_files(pulseaudio_t) -') - optional_policy(` mpd_read_tmpfs_files(pulseaudio_t) ') diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te index ed77fcc5..d8fac49d 100644 --- a/policy/modules/apps/sandbox.te +++ b/policy/modules/apps/sandbox.te @@ -482,10 +482,3 @@ corenet_tcp_connect_all_ports(sandbox_net_client_t) corenet_sendrecv_all_client_packets(sandbox_net_client_t) auth_use_nsswitch(sandbox_net_client_t) - -optional_policy(` - mozilla_dontaudit_rw_user_home_files(sandbox_x_t) - mozilla_dontaudit_rw_user_home_files(sandbox_xserver_t) - mozilla_dontaudit_rw_user_home_files(sandbox_x_domain) - mozilla_plugin_dontaudit_leaks(sandbox_x_domain) -') diff --git a/policy/modules/apps/seunshare.te b/policy/modules/apps/seunshare.te index ecc67930..a0c23375 100644 --- a/policy/modules/apps/seunshare.te +++ b/policy/modules/apps/seunshare.te @@ -44,11 +44,6 @@ userdom_list_user_home_content(seunshare_domain) ifdef(`hide_broken_symptoms', ` fs_dontaudit_rw_anon_inodefs_files(seunshare_domain) fs_dontaudit_list_inotifyfs(seunshare_domain) - - optional_policy(` - mozilla_dontaudit_manage_user_home_files(seunshare_domain) - mozilla_plugin_dontaudit_leaks(seunshare_domain) - ') ') tunable_policy(`use_nfs_home_dirs',` diff --git a/policy/modules/apps/thunderbird.te b/policy/modules/apps/thunderbird.te index 9ba6da84..4edea38b 100644 --- a/policy/modules/apps/thunderbird.te +++ b/policy/modules/apps/thunderbird.te @@ -192,9 +192,3 @@ optional_policy(` optional_policy(` lpd_domtrans_lpr(thunderbird_t) ') - -optional_policy(` - mozilla_read_user_home_files(thunderbird_t) - mozilla_domtrans(thunderbird_t) - mozilla_dbus_chat(thunderbird_t) -') diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc index 81fb8f1d..66d88a40 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -253,9 +253,6 @@ ifdef(`distro_gentoo',` /usr/lib/xulrunner[^/]*/xulrunner[^/]* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/xulrunner[^/]*/updater -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/xulrunner[^/]*/crashreporter -- gen_context(system_u:object_r:bin_t,s0) -/usr/lib/[^/]*/run-mozilla\.sh -- gen_context(system_u:object_r:bin_t,s0) -/usr/lib/[^/]*/mozilla-xremote-client -- gen_context(system_u:object_r:bin_t,s0) -/usr/lib/thunderbird.*/mozilla-xremote-client -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/xen/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te index b3fbad52..facd6a8f 100644 --- a/policy/modules/kernel/domain.te +++ b/policy/modules/kernel/domain.te @@ -258,10 +258,6 @@ optional_policy(` modules_filetrans_named_content(unconfined_domain_type) ') -optional_policy(` - mozilla_filetrans_home_content(unconfined_domain_type) -') - optional_policy(` networkmanager_filetrans_named_content(unconfined_domain_type) ') diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te index 8ea33852..fa149734 100644 --- a/policy/modules/roles/staff.te +++ b/policy/modules/roles/staff.te @@ -118,10 +118,6 @@ optional_policy(` logadm_role_change(staff_r) ') -optional_policy(` - mozilla_run_plugin(staff_t, staff_r) -') - optional_policy(` modutils_read_module_config(staff_t) modutils_read_module_deps(staff_t) @@ -281,10 +277,6 @@ ifndef(`distro_redhat',` lpd_role(staff_r, staff_t) ') - optional_policy(` - mozilla_role(staff_r, staff_t) - ') - optional_policy(` mplayer_role(staff_r, staff_t) ') diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 37bdf8dd..4924cf47 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -535,10 +535,6 @@ ifndef(`distro_redhat',` mock_admin(sysadm_t) ') - optional_policy(` - mozilla_role(sysadm_r, sysadm_t) - ') - optional_policy(` mplayer_role(sysadm_r, sysadm_t) ') diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te index 692ef0d7..4dfd17cf 100644 --- a/policy/modules/roles/unconfineduser.te +++ b/policy/modules/roles/unconfineduser.te @@ -13,13 +13,6 @@ attribute unconfined_login_domain; ## gen_tunable(unconfined_chrome_sandbox_transition, false) -## -##

-## Allow unconfined users to transition to the Mozilla plugin domain when running xulrunner plugin-container. -##

-## -gen_tunable(unconfined_mozilla_plugin_transition, false) - ## ##

## Allow vidio playing tools to tun unconfined @@ -304,14 +297,6 @@ optional_policy(` modutils_run_update_mods(unconfined_t, unconfined_r) ') -optional_policy(` - mozilla_role_plugin(unconfined_r) - - tunable_policy(`unconfined_mozilla_plugin_transition', ` - mozilla_domtrans_plugin(unconfined_t) - ') -') - optional_policy(` ncftool_run(unconfined_t, unconfined_r) ') diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te index 77967bd3..15550410 100644 --- a/policy/modules/roles/unprivuser.te +++ b/policy/modules/roles/unprivuser.te @@ -55,10 +55,6 @@ optional_policy(` oident_relabel_user_content(user_t) ') -optional_policy(` - mozilla_run_plugin(user_t, user_r) -') - optional_policy(` mta_role(user_r, user_t) ') diff --git a/policy/modules/roles/xguest.te b/policy/modules/roles/xguest.te index 9b6536a7..c37169a3 100644 --- a/policy/modules/roles/xguest.te +++ b/policy/modules/roles/xguest.te @@ -112,10 +112,6 @@ optional_policy(` gnomeclock_dontaudit_dbus_chat(xguest_t) ') -optional_policy(` - mozilla_run_plugin(xguest_t, xguest_r) -') - optional_policy(` pcscd_read_pub_files(xguest_t) pcscd_stream_connect(xguest_t) @@ -170,13 +166,4 @@ optional_policy(` #') ') -optional_policy(` - gen_require(` - type mozilla_t; - ') - - allow xguest_t mozilla_t:process transition; - role xguest_r types mozilla_t; -') - gen_user(xguest_u, user, xguest_r, s0, s0) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index a3e787d3..c497adef 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -299,10 +299,6 @@ ifdef(`hide_broken_symptoms',` userdom_dontaudit_read_user_home_content_files(iceauth_t) userdom_dontaudit_write_user_home_content_files(iceauth_t) userdom_dontaudit_write_user_tmp_files(iceauth_t) - - optional_policy(` - mozilla_dontaudit_rw_user_home_files(iceauth_t) - ') ') ######################################## diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc index 5bb501eb..3083e47d 100644 --- a/policy/modules/system/libraries.fc +++ b/policy/modules/system/libraries.fc @@ -81,8 +81,6 @@ ifdef(`distro_gentoo',` /opt/RealPlayer/codecs(/.*)? gen_context(system_u:object_r:lib_t,s0) /opt/RealPlayer/common(/.*)? gen_context(system_u:object_r:lib_t,s0) /opt/RealPlayer/lib(/.*)? gen_context(system_u:object_r:lib_t,s0) -/opt/RealPlayer/mozilla(/.*)? gen_context(system_u:object_r:lib_t,s0) -/opt/RealPlayer/plugins(/.*)? gen_context(system_u:object_r:lib_t,s0) ') ifdef(`distro_redhat',` @@ -197,8 +195,6 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_t /usr/lib/firefox-[^/]*/plugins/nppdf.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/libFLAC\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/libfglrx_gamma\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -/usr/lib/mozilla/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) -/usr/lib/mozilla/plugins/libvlcplugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/nx/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/nx/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/VBoxVMM\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -257,7 +253,6 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_t /usr/local/lib/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) HOME_DIR/.*/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) -HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/.*/nprhapengine\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/local/(.*/)?nprhapengine\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -394,7 +389,6 @@ HOME_DIR/\.gstreamer-.*/plugins/.*\.so.* -- gen_context(system_u:object_r:textre /usr/lib/libmp3lame\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/libmpeg2\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -HOME_DIR/\.mozilla(/.*)?/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/.*/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/local/(.*/)?libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)