policy/modules/roles/staff.te

   1 policy_module(staff, 2.2.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 role staff_r;
   9
  10 userdom_unpriv_user_template(staff)
  11 fs_exec_noxattr(staff_t)
  12
  13 # needed for sandbox
  14 allow staff_t self:process setexec;
  15
  16 ########################################
  17 #
  18 # Local policy
  19 #
  20
  21 kernel_read_ring_buffer(staff_t)
  22 kernel_getattr_core_if(staff_t)
  23 kernel_getattr_message_if(staff_t)
  24 kernel_read_software_raid_state(staff_t)
  25 kernel_read_fs_sysctls(staff_t)
  26
  27 fs_read_hugetlbfs_files(staff_t)
  28
  29 dev_read_cpuid(staff_t)
  30
  31 domain_read_all_domains_state(staff_t)
  32 domain_getattr_all_domains(staff_t)
  33 domain_obj_id_change_exemption(staff_t)
  34
  35 files_read_kernel_modules(staff_t)
  36
  37 seutil_read_module_store(staff_t)
  38 seutil_run_newrole(staff_t, staff_r)
  39
  40 storage_read_scsi_generic(staff_t)
  41 storage_write_scsi_generic(staff_t)
  42
  43 term_use_unallocated_ttys(staff_t)
  44
  45 auth_domtrans_pam_console(staff_t)
  46
  47 init_dbus_chat(staff_t)
  48 init_dbus_chat_script(staff_t)
  49
  50 miscfiles_read_hwdata(staff_t)
  51
  52 ifndef(`enable_mls',`
  53         selinux_read_policy(staff_t)
  54 ')
  55
  56 optional_policy(`
  57         abrt_read_cache(staff_t)
  58 ')
  59
  60 optional_policy(`
  61         apache_role(staff_r, staff_t)
  62 ')
  63
  64 optional_policy(`
  65         auditadm_role_change(staff_r)
  66 ')
  67
  68 optional_policy(`
  69         blueman_dbus_chat(staff_t)
  70 ')
  71
  72 optional_policy(`
  73         dbadm_role_change(staff_r)
  74 ')
  75
  76 optional_policy(`
  77         accountsd_dbus_chat(staff_t)
  78         accountsd_read_lib_files(staff_t)
  79 ')
  80
  81 optional_policy(`
  82         colord_dbus_chat(staff_t)
  83 ')
  84
  85 optional_policy(`
  86         gnomeclock_dbus_chat(staff_t)
  87 ')
  88
  89 optional_policy(`
  90         firewallgui_dbus_chat(staff_t)
  91 ')
  92
  93 optional_policy(`
  94         gnome_role(staff_r, staff_t)
  95 ')
  96
  97 optional_policy(`
  98         irc_role(staff_r, staff_t)
  99 ')
 100
 101 optional_policy(`
 102         lpd_list_spool(staff_t)
 103 ')
 104
 105 optional_policy(`
 106         mock_role(staff_r, staff_t)
 107 ')
 108
 109 optional_policy(`
 110         kerneloops_dbus_chat(staff_t)
 111 ')
 112
 113 optional_policy(`
 114         logadm_role_change(staff_r)
 115 ')
 116
 117 optional_policy(`
 118         modutils_read_module_config(staff_t)
 119         modutils_read_module_deps(staff_t)
 120 ')
 121
 122 optional_policy(`
 123         netutils_run_ping(staff_t, staff_r)
 124         netutils_run_traceroute(staff_t, staff_r)
 125         netutils_signal_ping(staff_t)
 126         netutils_kill_ping(staff_t)
 127 ')
 128
 129 optional_policy(`
 130         oident_manage_user_content(staff_t)
 131         oident_relabel_user_content(staff_t)
 132 ')
 133
 134 optional_policy(`
 135         mta_role(staff_r, staff_t)
 136 ')
 137
 138 optional_policy(`
 139         mysql_exec(staff_t)
 140 ')
 141
 142 optional_policy(`
 143         polipo_role(staff_r, staff_t)
 144         polipo_named_filetrans_cache_home_dirs(staff_t)
 145         polipo_named_filetrans_config_home_files(staff_t)
 146 ')
 147
 148 optional_policy(`
 149         postgresql_role(staff_r, staff_t)
 150 ')
 151
 152 optional_policy(`
 153         rtkit_scheduled(staff_t)
 154 ')
 155
 156 optional_policy(`
 157         rpm_dbus_chat(staff_t)
 158 ')
 159
 160 optional_policy(`
 161         secadm_role_change(staff_r)
 162 ')
 163
 164 optional_policy(`
 165         sandbox_transition(staff_t, staff_r)
 166 ')
 167
 168 optional_policy(`
 169         screen_role_template(staff, staff_r, staff_t)
 170 ')
 171
 172 optional_policy(`
 173         sysadm_role_change(staff_r)
 174         userdom_dontaudit_use_user_terminals(staff_t)
 175 ')
 176
 177 optional_policy(`
 178         setroubleshoot_stream_connect(staff_t)
 179         setroubleshoot_dbus_chat(staff_t)
 180         setroubleshoot_dbus_chat_fixit(staff_t)
 181 ')
 182
 183 optional_policy(`
 184         ssh_role_template(staff, staff_r, staff_t)
 185 ')
 186
 187 optional_policy(`
 188         sudo_role_template(staff, staff_r, staff_t)
 189 ')
 190
 191 #optional_policy(`
 192 #       telepathy_dbus_session_role(staff_r, staff_t)
 193 #')
 194
 195 optional_policy(`
 196         userhelper_console_role_template(staff, staff_r, staff_t)
 197 ')
 198
 199 optional_policy(`
 200         unconfined_role_change(staff_r)
 201 ')
 202
 203 optional_policy(`
 204         usbmuxd_stream_connect(staff_t)
 205 ')
 206
 207 optional_policy(`
 208         virt_stream_connect(staff_t)
 209 ')
 210
 211 optional_policy(`
 212         vlock_run(staff_t, staff_r)
 213 ')
 214
 215 optional_policy(`
 216         vnstatd_read_lib_files(staff_t)
 217 ')
 218
 219 optional_policy(`
 220         webadm_role_change(staff_r)
 221 ')
 222
 223 optional_policy(`
 224         xserver_role(staff_r, staff_t)
 225 ')
 226
 227 ifndef(`distro_redhat',`
 228         optional_policy(`
 229                 auth_role(staff_r, staff_t)
 230         ')
 231
 232         optional_policy(`
 233                 bluetooth_role(staff_r, staff_t)
 234         ')
 235
 236         optional_policy(`
 237                 cdrecord_role(staff_r, staff_t)
 238         ')
 239
 240         optional_policy(`
 241                 cron_role(staff_r, staff_t)
 242         ')
 243
 244         optional_policy(`
 245                 dbus_role_template(staff, staff_r, staff_t)
 246         ')
 247
 248         optional_policy(`
 249                 games_role(staff_r, staff_t)
 250         ')
 251
 252         optional_policy(`
 253                 gift_role(staff_r, staff_t)
 254         ')
 255
 256         optional_policy(`
 257                 gpg_role(staff_r, staff_t)
 258         ')
 259
 260         optional_policy(`
 261                 java_role(staff_r, staff_t)
 262         ')
 263
 264         optional_policy(`
 265                 lockdev_role(staff_r, staff_t)
 266         ')
 267
 268         optional_policy(`
 269                 lpd_role(staff_r, staff_t)
 270         ')
 271
 272         optional_policy(`
 273                 mplayer_role(staff_r, staff_t)
 274         ')
 275
 276         optional_policy(`
 277                 pyzor_role(staff_r, staff_t)
 278         ')
 279
 280         optional_policy(`
 281                 razor_role(staff_r, staff_t)
 282         ')
 283
 284         optional_policy(`
 285                 rssh_role(staff_r, staff_t)
 286         ')
 287
 288         optional_policy(`
 289                 spamassassin_role(staff_r, staff_t)
 290         ')
 291
 292         optional_policy(`
 293                 su_role_template(staff, staff_r, staff_t)
 294         ')
 295
 296         optional_policy(`
 297                 thunderbird_role(staff_r, staff_t)
 298         ')
 299
 300         optional_policy(`
 301                 tvtime_role(staff_r, staff_t)
 302         ')
 303
 304         optional_policy(`
 305                 uml_role(staff_r, staff_t)
 306         ')
 307
 308         optional_policy(`
 309                 userhelper_role_template(staff, staff_r, staff_t)
 310         ')
 311
 312         optional_policy(`
 313                 vmware_role(staff_r, staff_t)
 314         ')
 315
 316         optional_policy(`
 317                 wireshark_role(staff_r, staff_t)
 318         ')
 319 ')
 320
 321 tunable_policy(`allow_execmod',`
 322         userdom_execmod_user_home_files(staff_t)
 323 ')