# file should be used.
#
+## <desc>
+## <p>
+## Allow sysadm to debug or ptrace all processes.
+## </p>
+## </desc>
+gen_tunable(deny_ptrace, false)
+
## <desc>
## <p>
## Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
type kdump_initrc_exec_t;
')
- allow $1 kdump_t:process { ptrace signal_perms };
+ allow $1 kdump_t:process signal_perms;
ps_process_pattern($1, kdump_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 kdump_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, kdump_initrc_exec_t)
domain_system_change_exemption($1)
')
ps_process_pattern($1, kismet_t)
- allow $1 kismet_t:process { ptrace signal_perms };
+ allow $1 kismet_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 kismet_t:process ptrace;
+ ')
kismet_manage_pid_files($1)
kismet_manage_lib($1)
# Local policy
#
-allow kudzu_t self:capability { dac_override sys_admin sys_ptrace sys_rawio net_admin sys_tty_config mknod };
+allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod };
dontaudit kudzu_t self:capability sys_tty_config;
allow kudzu_t self:process { signal_perms execmem };
allow kudzu_t self:fifo_file rw_fifo_file_perms;
# Change ownership on log files.
allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner setuid setgid sys_resource sys_nice };
-# for mailx
-dontaudit logrotate_t self:capability { sys_ptrace };
allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
# ncftool local policy
#
-allow ncftool_t self:capability { net_admin sys_ptrace };
-
+allow ncftool_t self:capability net_admin;
allow ncftool_t self:process signal;
allow ncftool_t self:fifo_file manage_fifo_file_perms;
# rpm-script Local policy
#
-allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_admin sys_chroot sys_ptrace sys_rawio sys_nice mknod kill net_admin };
+allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_admin sys_chroot sys_rawio sys_nice mknod kill net_admin };
+
allow rpm_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execheap };
allow rpm_script_t self:fd use;
allow rpm_script_t self:fifo_file rw_fifo_file_perms;
# sectool local policy
#
-allow sectoolm_t self:capability { dac_override net_admin sys_nice sys_ptrace };
+allow sectoolm_t self:capability { dac_override net_admin sys_nice };
allow sectoolm_t self:process { getcap getsched signull setsched };
dontaudit sectoolm_t self:process { execstack execmem };
allow sectoolm_t self:fifo_file rw_fifo_file_perms;
type shorewall_tmp_t, shorewall_etc_t;
')
- allow $1 shorewall_t:process { ptrace signal_perms };
+ allow $1 shorewall_t:process signal_perms;
ps_process_pattern($1, shorewall_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 shorewall_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, shorewall_initrc_exec_t)
domain_system_change_exemption($1)
# shorewall local policy
#
-allow shorewall_t self:capability { dac_override net_admin net_raw setuid setgid sys_nice sys_ptrace };
+allow shorewall_t self:capability { dac_override net_admin net_raw setuid setgid sys_nice };
dontaudit shorewall_t self:capability sys_tty_config;
allow shorewall_t self:fifo_file rw_fifo_file_perms;
# sosreport local policy
#
-allow sosreport_t self:capability { kill net_admin net_raw setuid sys_admin sys_nice sys_ptrace dac_override };
+allow sosreport_t self:capability { kill net_admin net_raw setuid sys_admin sys_nice dac_override };
allow sosreport_t self:process { setsched signull };
allow sosreport_t self:fifo_file rw_fifo_file_perms;
allow sosreport_t self:tcp_socket create_stream_socket_perms;
# Useradd local policy
#
-allow useradd_t self:capability { dac_override chown kill fowner fsetid setuid sys_resource sys_ptrace };
+allow useradd_t self:capability { dac_override chown kill fowner fsetid setuid sys_resource };
+
dontaudit useradd_t self:capability sys_tty_config;
allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow useradd_t self:process setfscreate;
#
# chrome_sandbox local policy
#
-allow chrome_sandbox_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_chroot sys_ptrace };
+allow chrome_sandbox_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_chroot };
allow chrome_sandbox_t self:process { signal_perms setrlimit execmem execstack };
allow chrome_sandbox_t self:process setsched;
allow chrome_sandbox_t self:fifo_file manage_file_perms;
# cpufreq-selector local policy
#
-allow cpufreqselector_t self:capability { sys_nice sys_ptrace };
+allow cpufreqselector_t self:capability sys_nice;
allow cpufreqselector_t self:process getsched;
allow cpufreqselector_t self:fifo_file rw_fifo_file_perms;
allow cpufreqselector_t self:process getsched;
auth_use_nsswitch($1_gkeyringd_t)
ps_process_pattern($3, $1_gkeyringd_t)
- allow $3 $1_gkeyringd_t:process { ptrace signal_perms };
-
+ allow $3 $1_gkeyringd_t:process signal_perms;
dontaudit $3 gkeyringd_exec_t:file entrypoint;
stream_connect_pattern($3, gkeyringd_tmp_t, gkeyringd_tmp_t, $1_gkeyringd_t)
# gconf-defaults-mechanisms local policy
#
-allow gconfdefaultsm_t self:capability { dac_override sys_nice sys_ptrace };
+allow gconfdefaultsm_t self:capability { dac_override sys_nice };
allow gconfdefaultsm_t self:process getsched;
allow gconfdefaultsm_t self:fifo_file rw_fifo_file_perms;
# gnome-system-monitor-mechanisms local policy
#
-allow gnomesystemmm_t self:capability { sys_nice sys_ptrace };
+allow gnomesystemmm_t self:capability sys_nice;
allow gnomesystemmm_t self:fifo_file rw_fifo_file_perms;
kernel_read_system_state(gnomesystemmm_t)
domtrans_pattern($2, irssi_exec_t, irssi_t)
- allow $2 irssi_t:process { ptrace signal_perms };
+ allow $2 irssi_t:process signal_perms;
ps_process_pattern($2, irssi_t)
manage_dirs_pattern($2, irssi_home_t, irssi_home_t)
#
# backlighthelper local policy
#
-
-dontaudit kdebacklighthelper_t self:capability sys_ptrace;
-
allow kdebacklighthelper_t self:fifo_file rw_fifo_file_perms;
kernel_read_system_state(kdebacklighthelper_t)
dontaudit livecd_t self:capability2 mac_admin;
-domain_ptrace_all_domains(livecd_t)
+tunable_policy(`deny_ptrace',`',`
+ domain_ptrace_all_domains(livecd_t)
+')
+
domain_interactive_fd(livecd_t)
manage_dirs_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t)
domain_interactive_fd($1_mono_t)
application_type($1_mono_t)
- allow $1_mono_t self:process { ptrace signal getsched execheap execmem execstack };
- allow $3 $1_mono_t:process { getattr ptrace noatsecure signal_perms };
+ allow $1_mono_t self:process { signal getsched execheap execmem execstack };
+ allow $3 $1_mono_t:process { getattr noatsecure signal_perms };
domtrans_pattern($3, mono_exec_t, $1_mono_t)
# Local policy
#
-allow mono_t self:process { ptrace signal getsched execheap execmem execstack };
+allow mono_t self:process { signal getsched execheap execmem execstack };
init_dbus_chat_script(mono_t)
allow mozilla_plugin_t $1:sem create_sem_perms;
ps_process_pattern($1, mozilla_plugin_t)
- allow $1 mozilla_plugin_t:process { ptrace signal_perms };
+ allow $1 mozilla_plugin_t:process signal_perms;
')
########################################
# mozilla_plugin local policy
#
-dontaudit mozilla_plugin_t self:capability { sys_ptrace sys_nice };
+dontaudit mozilla_plugin_t self:capability sys_nice;
allow mozilla_plugin_t self:process { setsched signal_perms execmem };
allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
dontaudit nsplugin_t $2:shm destroy;
allow $2 nsplugin_t:sem rw_sem_perms;
- allow $2 nsplugin_t:process { getattr ptrace signal_perms };
+ allow $2 nsplugin_t:process { getattr signal_perms };
allow $2 nsplugin_t:unix_stream_socket connectto;
# Connect to pulseaudit server
#
dontaudit nsplugin_t self:capability { sys_nice sys_tty_config };
allow nsplugin_t self:fifo_file rw_file_perms;
-allow nsplugin_t self:process { ptrace setpgid getsched setsched signal_perms };
+allow nsplugin_t self:process { setpgid getsched setsched signal_perms };
allow nsplugin_t self:sem create_sem_perms;
allow nsplugin_t self:shm create_shm_perms;
allow $1_openoffice_t self:process { getsched sigkill execmem execstack };
- allow $3 $1_openoffice_t:process { getattr ptrace signal_perms noatsecure siginh rlimitinh };
+ allow $3 $1_openoffice_t:process { getattr signal_perms noatsecure siginh rlimitinh };
allow $1_openoffice_t $3:tcp_socket { read write };
domtrans_pattern($3, openoffice_exec_t, $1_openoffice_t)
# podsleuth local policy
#
allow podsleuth_t self:capability { kill dac_override sys_admin sys_rawio };
-allow podsleuth_t self:process { ptrace signal signull getsched execheap execmem execstack };
+allow podsleuth_t self:process { signal signull getsched execheap execmem execstack };
+
allow podsleuth_t self:fifo_file rw_file_perms;
allow podsleuth_t self:unix_stream_socket create_stream_socket_perms;
allow podsleuth_t self:sem create_sem_perms;
allow $2 uml_t:unix_dgram_socket sendto;
allow uml_t $2:unix_dgram_socket sendto;
- # allow ps, ptrace, signal
+ # allow ps, signal
ps_process_pattern($2, uml_t)
- allow $2 uml_t:process { ptrace signal_perms };
+ allow $2 uml_t:process signal_perms;
allow $2 uml_ro_t:dir list_dir_perms;
read_files_pattern($2, uml_ro_t, uml_ro_t)
#
allow uml_t self:fifo_file rw_fifo_file_perms;
-allow uml_t self:process { signal_perms ptrace };
+allow uml_t self:process signal_perms;
allow uml_t self:unix_stream_socket create_stream_socket_perms;
allow uml_t self:unix_dgram_socket create_socket_perms;
# Use the network.
# VMWare host local policy
#
-allow vmware_host_t self:capability { setgid setuid net_raw sys_nice sys_time sys_ptrace kill dac_override };
+allow vmware_host_t self:capability { setgid setuid net_raw sys_nice sys_time kill dac_override };
dontaudit vmware_host_t self:capability sys_tty_config;
allow vmware_host_t self:process { execstack execmem signal_perms };
allow vmware_host_t self:fifo_file rw_fifo_file_perms;
role $2 types $1_wine_t;
allow $1_wine_t self:process { execmem execstack };
- allow $3 $1_wine_t:process { getattr ptrace noatsecure signal_perms };
+ allow $3 $1_wine_t:process { getattr noatsecure signal_perms };
domtrans_pattern($3, wine_exec_t, $1_wine_t)
corecmd_bin_domtrans($1_wine_t, $1_t)
allow unconfined_domain_type unconfined_domain_type:dbus send_msg;
# Act upon any other process.
-allow unconfined_domain_type domain:process ~{ transition dyntransition execmem execstack execheap };
+allow unconfined_domain_type domain:process ~{ ptrace transition dyntransition execmem execstack execheap };
+tunable_policy(`deny_ptrace',`',`
+ allow unconfined_domain_type domain:process ptrace;
+')
# Create/access any System V IPC objects.
allow unconfined_domain_type domain:{ sem msgq shm } *;
')
dontaudit domain domain:process { noatsecure siginh rlimitinh } ;
+dontaudit domain self:capability sys_ptrace;
# kernel local policy
#
-allow kernel_t self:capability *;
+allow kernel_t self:capability ~{ sys_ptrace };
+tunable_policy(`deny_ptrace',`',`
+ allow kernel_t self:capability sys_ptrace;
+')
+
allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow kernel_t self:shm create_shm_perms;
allow kernel_t self:sem create_sem_perms;
allow kern_unconfined unlabeled_t:filesystem *;
allow kern_unconfined unlabeled_t:association *;
allow kern_unconfined unlabeled_t:packet *;
-allow kern_unconfined unlabeled_t:process ~{ transition dyntransition execmem execstack execheap };
+allow kern_unconfined unlabeled_t:process ~{ ptrace transition dyntransition execmem execstack execheap };
gen_require(`
bool secure_mode_insmod;
# database admin local policy
#
-allow dbadm_t self:capability { dac_override dac_read_search sys_ptrace };
+allow dbadm_t self:capability { dac_override dac_read_search };
files_dontaudit_search_all_dirs(dbadm_t)
files_delete_generic_locks(dbadm_t)
# logadmin local policy
#
-allow logadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice };
-
+allow logadm_t self:capability { dac_override dac_read_search kill sys_nice };
logging_admin(logadm_t, logadm_r)
# Declarations
#
-## <desc>
-## <p>
-## Allow sysadm to debug or ptrace all processes.
-## </p>
-## </desc>
-gen_tunable(allow_ptrace, false)
-
role sysadm_r;
userdom_admin_user_template(sysadm)
logging_stream_connect_syslog(sysadm_t)
')
-tunable_policy(`allow_ptrace',`
+tunable_policy(`deny_ptrace',`',`
domain_ptrace_all_domains(sysadm_t)
')
# webadmin local policy
#
-allow webadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice };
+allow webadm_t self:capability { dac_override dac_read_search kill sys_nice };
files_dontaudit_search_all_dirs(webadm_t)
files_manage_generic_locks(webadm_t)
type abrt_initrc_exec_t;
')
- allow $1 abrt_t:process { ptrace signal_perms };
+ allow $1 abrt_t:process { signal_perms };
ps_process_pattern($1, abrt_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 abrt_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, abrt_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 abrt_initrc_exec_t system_r;
type accountsd_t;
')
- allow $1 accountsd_t:process { ptrace signal_perms };
+ allow $1 accountsd_t:process signal_perms;
ps_process_pattern($1, accountsd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 acountsd_t:process ptrace;
+ ')
+
accountsd_manage_lib_files($1)
')
# accountsd local policy
#
-allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace };
+allow accountsd_t self:capability { dac_override setuid setgid };
allow accountsd_t self:process signal;
allow accountsd_t self:fifo_file rw_fifo_file_perms;
type afs_t, afs_initrc_exec_t;
')
- allow $1 afs_t:process { ptrace signal_perms };
+ allow $1 afs_t:process signal_perms;
ps_process_pattern($1, afs_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 afs_t:process ptrace;
+ ')
+
# Allow afs_admin to restart the afs service
afs_initrc_domtrans($1)
domain_system_change_exemption($1)
type aiccu_var_run_t;
')
- allow $1 aiccu_t:process { ptrace signal_perms };
+ allow $1 aiccu_t:process signal_perms;
ps_process_pattern($1, aiccu_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 aiccu_t:process ptrace;
+ ')
+
aiccu_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 aiccu_initrc_exec_t system_r;
type aide_t, aide_db_t, aide_log_t;
')
- allow $1 aide_t:process { ptrace signal_perms };
+ allow $1 aide_t:process signal_perms;
ps_process_pattern($1, aide_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 aide_t:process ptrace;
+ ')
+
files_list_etc($1)
admin_pattern($1, aide_db_t)
type aisexec_initrc_exec_t;
')
- allow $1 aisexec_t:process { ptrace signal_perms };
+ allow $1 aisexec_t:process signal_perms;
ps_process_pattern($1, aisexec_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 aisexec_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, aisexec_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 aisexec_initrc_exec_t system_r;
type ajaxterm_t, ajaxterm_initrc_exec_t;
')
- allow $1 ajaxterm_t:process { ptrace signal_perms };
+ allow $1 ajaxterm_t:process signal_perms;
ps_process_pattern($1, ajaxterm_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ajaxterm_t:process ptrace;
+ ')
+
ajaxterm_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 ajaxterm_initrc_exec_t system_r;
type amavis_initrc_exec_t;
')
- allow $1 amavis_t:process { ptrace signal_perms };
+ allow $1 amavis_t:process signal_perms;
ps_process_pattern($1, amavis_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 amavis_t:process ptrace;
+ ')
+
amavis_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 amavis_initrc_exec_t system_r;
type httpd_unit_file_t;
')
- allow $1 httpd_t:process { ptrace signal_perms };
+ allow $1 httpd_t:process signal_perms;
ps_process_pattern($1, httpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 httpd_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, httpd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 httpd_initrc_exec_t system_r;
type apcupsd_initrc_exec_t;
')
- allow $1 apcupsd_t:process { ptrace signal_perms };
+ allow $1 apcupsd_t:process signal_perms;
ps_process_pattern($1, apcupsd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 apcupsd_t:process ptrace;
+ ')
+
apcupsd_initrc_domtrans($1, apcupsd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 apcupsd_initrc_exec_t system_r;
# mknod: controlling an orderly resume of PCMCIA requires creating device
# nodes 254,{0,1,2} for some reason.
allow apmd_t self:capability { sys_admin sys_nice sys_time kill mknod };
-dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_ptrace sys_tty_config };
+dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_tty_config };
allow apmd_t self:process { signal_perms getsession };
allow apmd_t self:fifo_file rw_fifo_file_perms;
allow apmd_t self:netlink_socket create_socket_perms;
type arpwatch_initrc_exec_t;
')
- allow $1 arpwatch_t:process { ptrace signal_perms };
+ allow $1 arpwatch_t:process signal_perms;
ps_process_pattern($1, arpwatch_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 arpwatch_t:process ptrace;
+ ')
+
arpwatch_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 arpwatch_initrc_exec_t system_r;
type asterisk_initrc_exec_t;
')
- allow $1 asterisk_t:process { ptrace signal_perms };
+ allow $1 asterisk_t:process signal_perms;
ps_process_pattern($1, asterisk_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 asterisk_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, asterisk_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 asterisk_initrc_exec_t system_r;
type automount_var_run_t, automount_initrc_exec_t;
')
- allow $1 automount_t:process { ptrace signal_perms };
+ allow $1 automount_t:process signal_perms;
ps_process_pattern($1, automount_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 automount_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, automount_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 automount_initrc_exec_t system_r;
type avahi_t, avahi_var_run_t, avahi_initrc_exec_t;
')
- allow $1 avahi_t:process { ptrace signal_perms };
+ allow $1 avahi_t:process signal_perms;
ps_process_pattern($1, avahi_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 avahi_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, avahi_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 avahi_initrc_exec_t system_r;
type dnssec_t, ndc_t, named_keytab_t;
')
- allow $1 named_t:process { ptrace signal_perms };
+ allow $1 named_t:process signal_perms;
ps_process_pattern($1, named_t)
- allow $1 ndc_t:process { ptrace signal_perms };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 named_t:process ptrace;
+ ')
+
+ allow $1 ndc_t:process signal_perms;
ps_process_pattern($1, ndc_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ndc_t:process ptrace;
+ ')
+
bind_run_ndc($1, $2)
init_labeled_script_domtrans($1, named_initrc_exec_t)
type bitlbee_initrc_exec_t;
')
- allow $1 bitlbee_t:process { ptrace signal_perms };
+ allow $1 bitlbee_t:process signal_perms;
ps_process_pattern($1, bitlbee_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 bitlbee_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, bitlbee_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 bitlbee_initrc_exec_t system_r;
# allow ps to show cdrecord and allow the user to kill it
ps_process_pattern($2, bluetooth_helper_t)
- allow $2 bluetooth_helper_t:process { ptrace signal_perms };
+ allow $2 bluetooth_helper_t:process signal_perms;
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 bluetooth_helper_t:process ptrace;
+ ')
manage_dirs_pattern($2, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
manage_files_pattern($2, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
type bluetooth_conf_t, bluetooth_conf_rw_t;
')
- allow $1 bluetooth_t:process { ptrace signal_perms };
+ allow $1 bluetooth_t:process signal_perms;
ps_process_pattern($1, bluetooth_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 bluetooth_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, bluetooth_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 bluetooth_initrc_exec_t system_r;
type boinc_t, boinc_initrc_exec_t, boinc_var_lib_t;
')
- allow $1 boinc_t:process { ptrace signal_perms };
+ allow $1 boinc_t:process signal_perms;
ps_process_pattern($1, boinc_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 boic_t:process ptrace;
+ ')
+
boinc_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 boinc_initrc_exec_t system_r;
domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
allow boinc_t boinc_project_t:process sigkill;
-allow boinc_project_t self:process { ptrace setpgid setsched signal signull sigkill sigstop };
+allow boinc_project_t self:process { setpgid setsched signal signull sigkill sigstop };
allow boinc_project_t self:process { execmem execstack };
+tunable_policy(`deny_ptrace',`',`
+ allow boinc_project_t self:process ptrace;
+')
+
allow boinc_project_t self:fifo_file rw_fifo_file_perms;
allow boinc_project_t self:sem create_sem_perms;
type httpd_bugzilla_htaccess_t, httpd_bugzilla_tmp_t;
')
- allow $1 httpd_bugzilla_script_t:process { ptrace signal_perms };
+ allow $1 httpd_bugzilla_script_t:process signal_perms;
ps_process_pattern($1, httpd_bugzilla_script_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 httpd_bugzilla_script_t:process ptrace;
+ ')
+
files_list_tmp($1)
admin_pattern($1, httpd_bugzilla_tmp_t)
type callweaver_spool_t;
')
- allow $1 callweaver_t:process { ptrace signal_perms };
+ allow $1 callweaver_t:process signal_perms;
ps_process_pattern($1, callweaver_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 callweaver_t:process ptrace;
+ ')
+
callweaver_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 callweaver_initrc_exec_t system_r;
type canna_var_run_t, canna_initrc_exec_t;
')
- allow $1 canna_t:process { ptrace signal_perms };
+ allow $1 canna_t:process signal_perms;
ps_process_pattern($1, canna_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 canna_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, canna_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 canna_initrc_exec_t system_r;
type certmaster_etc_rw_t, certmaster_var_log_t, certmaster_initrc_exec_t;
')
- allow $1 certmaster_t:process { ptrace signal_perms };
+ allow $1 certmaster_t:process signal_perms;
ps_process_pattern($1, certmaster_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 certmaster_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, certmaster_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 certmaster_initrc_exec_t system_r;
')
ps_process_pattern($1, certmonger_t)
- allow $1 certmonger_t:process { ptrace signal_perms };
+ allow $1 certmonger_t:process signal_perms;
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 certmonger_t:process ptrace;
+ ')
# Allow certmonger_t to restart the apache service
certmonger_initrc_domtrans($1)
type cgrules_etc_t, cgclear_t;
')
- allow $1 cgclear_t:process { ptrace signal_perms };
+ allow $1 cgclear_t:process signal_perms;
ps_process_pattern($1, cgclear_t)
- allow $1 cgconfig_t:process { ptrace signal_perms };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cglear_t:process ptrace;
+ ')
+
+ allow $1 cgconfig_t:process signal_perms;
ps_process_pattern($1, cgconfig_t)
- allow $1 cgred_t:process { ptrace signal_perms };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cgconfig_t:process ptrace;
+ ')
+
+ allow $1 cgred_t:process signal_perms;
ps_process_pattern($1, cgred_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cgred_t:process ptrace;
+ ')
+
admin_pattern($1, cgconfig_etc_t)
admin_pattern($1, cgrules_etc_t)
files_list_etc($1)
# cgred personal policy.
#
-allow cgred_t self:capability { chown fsetid net_admin sys_admin sys_ptrace dac_override };
+allow cgred_t self:capability { chown fsetid net_admin sys_admin dac_override };
+
allow cgred_t self:netlink_socket { write bind create read };
allow cgred_t self:unix_dgram_socket { write create connect };
type chronyd_keys_t;
')
- allow $1 chronyd_t:process { ptrace signal_perms };
+ allow $1 chronyd_t:process signal_perms;
ps_process_pattern($1, chronyd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 chronyd_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, chronyd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 chronyd_initrc_exec_t system_r;
type freshclam_t, freshclam_var_log_t;
')
- allow $1 clamd_t:process { ptrace signal_perms };
+ allow $1 clamd_t:process signal_perms;
ps_process_pattern($1, clamd_t)
- allow $1 clamscan_t:process { ptrace signal_perms };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 clamd_t:process ptrace;
+ allow $1 clamscan_t:process ptrace;
+ allow $1 freshclam_t:process ptrace;
+ ')
+
+ allow $1 clamscan_t:process signal_perms;
ps_process_pattern($1, clamscan_t)
- allow $1 freshclam_t:process { ptrace signal_perms };
+ allow $1 freshclam_t:process signal_perms;
ps_process_pattern($1, freshclam_t)
init_labeled_script_domtrans($1, clamd_initrc_exec_t)
type cmirrord_t, cmirrord_initrc_exec_t, cmirrord_var_run_t;
')
- allow $1 cmirrord_t:process { ptrace signal_perms };
+ allow $1 cmirrord_t:process signal_perms;
ps_process_pattern($1, cmirrord_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cmorrord_t:process ptrace;
+ ')
+
cmirrord_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 cmirrord_initrc_exec_t system_r;
type httpd_cobbler_content_ra_t, httpd_cobbler_content_rw_t;
')
- allow $1 cobblerd_t:process { ptrace signal_perms };
+ allow $1 cobblerd_t:process signal_perms;
ps_process_pattern($1, cobblerd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cobblerd_t:process ptrace;
+ ')
+
files_list_etc($1)
admin_pattern($1, cobbler_etc_t)
#
allow cobblerd_t self:capability { chown dac_override fowner fsetid sys_nice };
-dontaudit cobblerd_t self:capability { sys_ptrace sys_tty_config };
+dontaudit cobblerd_t self:capability sys_tty_config;
allow cobblerd_t self:process { getsched setsched signal };
allow cobblerd_t self:fifo_file rw_fifo_file_perms;
type collectd_var_lib_t;
')
- allow $1 collectd_t:process { ptrace signal_perms };
+ allow $1 collectd_t:process signal_perms;
ps_process_pattern($1, collectd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 collectd_t:process ptrace;
+ ')
+
collectd_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 collectd_initrc_exec_t system_r;
# consolekit local policy
#
-allow consolekit_t self:capability { chown setuid setgid sys_tty_config dac_override sys_nice sys_ptrace };
+allow consolekit_t self:capability { chown setuid setgid sys_tty_config dac_override sys_nice };
+
allow consolekit_t self:process { getsched signal };
allow consolekit_t self:fifo_file rw_fifo_file_perms;
allow consolekit_t self:unix_stream_socket create_stream_socket_perms;
optional_policy(`
#reading .Xauthity
- unconfined_ptrace(consolekit_t)
+ tunable_policy(`deny_ptrace',`',`
+ unconfined_ptrace(consolekit_t)
+ ')
unconfined_stream_connect(consolekit_t)
')
type corosync_initrc_exec_t;
')
- allow $1 corosync_t:process { ptrace signal_perms };
+ allow $1 corosync_t:process signal_perms;
ps_process_pattern($1, corosync_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 corosync_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, corosync_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 corosync_initrc_exec_t system_r;
# corosync local policy
#
-allow corosync_t self:capability { dac_override setuid sys_nice sys_ptrace sys_resource ipc_lock };
+allow corosync_t self:capability { dac_override setuid sys_nice sys_resource ipc_lock };
allow corosync_t self:process { setpgid setrlimit setsched signal signull };
allow corosync_t self:fifo_file rw_fifo_file_perms;
# crontab shows up in user ps
ps_process_pattern($2, crontab_t)
- allow $2 crontab_t:process { ptrace signal_perms };
+ allow $2 crontab_t:process signal_perms;
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 crontab_t:process ptrace;
+ ')
# Run helper programs as the user domain
#corecmd_bin_domtrans(crontab_t, $2)
# cronjob shows up in user ps
ps_process_pattern($2, unconfined_cronjob_t)
- allow $2 unconfined_cronjob_t:process { ptrace signal_perms };
+ allow $2 unconfined_cronjob_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 unconfined_cronjob_t:process ptrace;
+ ')
optional_policy(`
gen_require(`
# crontab shows up in user ps
ps_process_pattern($2, admin_crontab_t)
- allow $2 admin_crontab_t:process { ptrace signal_perms };
+ allow $2 admin_crontab_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 admin_crontab_t:process ptrace;
+ ')
# Run helper programs as the user domain
#corecmd_bin_domtrans(admin_crontab_t, $2)
#
allow system_cronjob_t self:capability { dac_override dac_read_search chown setgid setuid fowner net_bind_service fsetid sys_nice };
-dontaudit system_cronjob_t self:capability sys_ptrace;
allow system_cronjob_t self:process { signal_perms getsched setsched };
allow system_cronjob_t self:fifo_file rw_fifo_file_perms;
type ctdbd_log_t, ctdbd_var_lib_t, ctdbd_var_run_t;
')
- allow $1 ctdbd_t:process { ptrace signal_perms };
+ allow $1 ctdbd_t:process signal_perms;
ps_process_pattern($1, ctdbd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ctdbd_t:process ptrace;
+ ')
ctdbd_initrc_domtrans($1)
domain_system_change_exemption($1)
# ctdbd local policy
#
-allow ctdbd_t self:capability { chown ipc_lock net_admin net_raw sys_nice sys_ptrace };
+allow ctdbd_t self:capability { chown ipc_lock net_admin net_raw sys_nice };
allow ctdbd_t self:process { setpgid signal_perms setsched };
allow ctdbd_t self:fifo_file rw_fifo_file_perms;
type ptal_var_run_t;
')
- allow $1 cupsd_t:process { ptrace signal_perms };
+ allow $1 cupsd_t:process signal_perms;
ps_process_pattern($1, cupsd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cupsd_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, cupsd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 cupsd_initrc_exec_t system_r;
type cvs_data_t, cvs_var_run_t;
')
- allow $1 cvs_t:process { ptrace signal_perms };
+ allow $1 cvs_t:process signal_perms;
ps_process_pattern($1, cvs_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cvs_t:process ptrace;
+ ')
+
# Allow cvs_t to restart the apache service
init_labeled_script_domtrans($1, cvs_initrc_exec_t)
domain_system_change_exemption($1)
type cyrus_var_run_t, cyrus_initrc_exec_t;
')
- allow $1 cyrus_t:process { ptrace signal_perms };
+ allow $1 cyrus_t:process signal_perms;
ps_process_pattern($1, cyrus_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cyrus_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, cyrus_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 cyrus_initrc_exec_t system_r;
domtrans_pattern($3, dbusd_exec_t, $1_dbusd_t)
ps_process_pattern($3, $1_dbusd_t)
- allow $3 $1_dbusd_t:process { ptrace signal_perms };
+ allow $3 $1_dbusd_t:process signal_perms;
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $3 $1_dbusd_t:process ptrace;
+ ')
# cjp: this seems very broken
corecmd_bin_domtrans($1_dbusd_t, $1_t)
type ddclient_var_run_t;
')
- allow $1 ddclient_t:process { ptrace signal_perms };
+ allow $1 ddclient_t:process signal_perms;
ps_process_pattern($1, ddclient_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ddclient_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, ddclient_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 ddclient_initrc_exec_t system_r;
type denyhosts_var_log_t, denyhosts_initrc_exec_t;
')
- allow $1 denyhosts_t:process { ptrace signal_perms };
+ allow $1 denyhosts_t:process signal_perms;
ps_process_pattern($1, denyhosts_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 denyhosts_t:process ptrace;
+ ')
+
denyhosts_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 denyhosts_initrc_exec_t system_r;
type devicekit_var_lib_t, devicekit_var_run_t, devicekit_tmp_t;
')
- allow $1 devicekit_t:process { ptrace signal_perms };
+ allow $1 devicekit_t:process signal_perms;
ps_process_pattern($1, devicekit_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 devicekit_t:process ptrace;
+ allow $1 devicekit_disk_t:process ptrace;
+ allow $1 devicekit_power_t:process ptrace;
+ ')
- allow $1 devicekit_disk_t:process { ptrace signal_perms };
+ allow $1 devicekit_disk_t:process signal_perms;
ps_process_pattern($1, devicekit_disk_t)
- allow $1 devicekit_power_t:process { ptrace signal_perms };
+ allow $1 devicekit_power_t:process signal_perms;
ps_process_pattern($1, devicekit_power_t)
admin_pattern($1, devicekit_tmp_t)
# DeviceKit disk local policy
#
-allow devicekit_disk_t self:capability { chown setuid setgid dac_override fowner fsetid net_admin sys_admin sys_nice sys_ptrace sys_rawio };
+allow devicekit_disk_t self:capability { chown setuid setgid dac_override fowner fsetid net_admin sys_admin sys_nice sys_rawio };
+
allow devicekit_disk_t self:process { getsched signal_perms };
allow devicekit_disk_t self:fifo_file rw_fifo_file_perms;
allow devicekit_disk_t self:netlink_kobject_uevent_socket create_socket_perms;
# DeviceKit-Power local policy
#
-allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace };
+allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice };
allow devicekit_power_t self:process { getsched signal_perms };
allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
type dhcpd_var_run_t, dhcpd_initrc_exec_t;
')
- allow $1 dhcpd_t:process { ptrace signal_perms };
+ allow $1 dhcpd_t:process signal_perms;
ps_process_pattern($1, dhcpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 dhcpd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, dhcpd_initrc_exec_t)
domain_system_change_exemption($1)
type dictd_var_run_t, dictd_initrc_exec_t;
')
- allow $1 dictd_t:process { ptrace signal_perms };
+ allow $1 dictd_t:process signal_perms;
ps_process_pattern($1, dictd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 dictd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, dictd_initrc_exec_t)
domain_system_change_exemption($1)
type dnsmasq_initrc_exec_t;
')
- allow $1 dnsmasq_t:process { ptrace signal_perms };
+ allow $1 dnsmasq_t:process signal_perms;
ps_process_pattern($1, dnsmasq_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 dnsmasq_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, dnsmasq_initrc_exec_t)
domain_system_change_exemption($1)
type dovecot_cert_t, dovecot_passwd_t, dovecot_initrc_exec_t;
')
- allow $1 dovecot_t:process { ptrace signal_perms };
+ allow $1 dovecot_t:process signal_perms;
ps_process_pattern($1, dovecot_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 dovecot_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, dovecot_initrc_exec_t)
domain_system_change_exemption($1)
type drbd_var_lib_t;
')
- allow $1 drbd_t:process { ptrace signal_perms };
+ allow $1 drbd_t:process signal_perms;
ps_process_pattern($1, drbd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 drbd_t:process ptrace;
+ ')
files_search_var_lib($1)
admin_pattern($1, drbd_var_lib_t)
type dspam_var_run_t;
')
- allow $1 dspam_t:process { ptrace signal_perms };
+ allow $1 dspam_t:process signal_perms;
ps_process_pattern($1, dspam_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 dspam_t:process ptrace;
+ ')
dspam_initrc_domtrans($1)
domain_system_change_exemption($1)
type exim_tmp_t, exim_spool_t, exim_var_run_t;
')
- allow $1 exim_t:process { ptrace signal_perms };
+ allow $1 exim_t:process signal_perms;
ps_process_pattern($1, exim_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 exim_t:process ptrace;
+ ')
exim_initrc_domtrans($1)
domain_system_change_exemption($1)
type fail2ban_client_t;
')
- allow $1 { fail2ban_t fail2ban_client_t }:process { ptrace signal_perms };
+ allow $1 { fail2ban_t fail2ban_client_t }:process signal_perms;
ps_process_pattern($1, { fail2ban_t fail2ban_client_t })
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 { fail2ban_t fail2ban_client_t }:process ptrace;
+ ')
init_labeled_script_domtrans($1, fail2ban_initrc_exec_t)
domain_system_change_exemption($1)
type fcoemon_var_run_t;
')
- allow $1 fcoemon_t:process { ptrace signal_perms };
+ allow $1 fcoemon_t:process signal_perms;
ps_process_pattern($1, fcoemon_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 fcoemon_t:process ptrace;
+ ')
files_search_pids($1)
admin_pattern($1, fcoemon_var_run_t)
type fetchmail_var_run_t;
')
- allow $1 fetchmail_t:process { ptrace signal_perms };
+ allow $1 fetchmail_t:process signal_perms;
ps_process_pattern($1, fetchmail_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 fetchmail_t:process ptrace;
+ ')
files_list_etc($1)
admin_pattern($1, fetchmail_etc_t)
type firewalld_initrc_exec_t;
')
- allow $1 firewalld_t:process { ptrace signal_perms };
+ allow $1 firewalld_t:process signal_perms;
ps_process_pattern($1, firewalld_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 firewalld_t:process ptrace;
+ ')
firewalld_initrc_domtrans($1)
domain_system_change_exemption($1)
# Local policy
#
-allow fprintd_t self:capability { sys_nice sys_ptrace };
+allow fprintd_t self:capability sys_nice;
+
allow fprintd_t self:fifo_file rw_fifo_file_perms;
allow fprintd_t self:process { getsched setsched signal };
type ftpd_initrc_exec_t;
')
- allow $1 ftpd_t:process { ptrace signal_perms };
+ allow $1 ftpd_t:process signal_perms;
ps_process_pattern($1, ftpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ftpd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, ftpd_initrc_exec_t)
domain_system_change_exemption($1)
domtrans_pattern($2, gitd_exec_t, git_session_t)
- allow $2 git_session_t:process { ptrace signal_perms };
+ allow $2 git_session_t:process signal_perms;
ps_process_pattern($2, git_session_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 git_session_t:process ptrace;
+ ')
')
########################################
type glance_api_initrc_exec_t;
')
- allow $1 glance_registry_t:process { ptrace signal_perms };
+ allow $1 glance_registry_t:process signal_perms;
ps_process_pattern($1, glance_registry_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 glance_registry_t:process ptrace;
+ allow $1 glance_api_t:process ptrace;
+ ')
- allow $1 glance_api_t:process { ptrace signal_perms };
+ allow $1 glance_api_t:process signal_perms;
ps_process_pattern($1, glance_api_t)
init_labeled_script_domtrans($1, glance_registry_initrc_exec_t)
# gnomeclock local policy
#
-allow gnomeclock_t self:capability { sys_nice sys_time sys_ptrace };
+allow gnomeclock_t self:capability { sys_nice sys_time };
allow gnomeclock_t self:process { getattr getsched signal };
allow gnomeclock_t self:fifo_file rw_fifo_file_perms;
allow gnomeclock_t self:unix_stream_socket create_stream_socket_perms;
#
allow gpsd_t self:capability { fowner fsetid setuid setgid sys_nice sys_time sys_tty_config };
-dontaudit gpsd_t self:capability { dac_read_search dac_override sys_ptrace };
+dontaudit gpsd_t self:capability { dac_read_search dac_override };
allow gpsd_t self:process { setsched signal_perms };
allow gpsd_t self:shm create_shm_perms;
allow gpsd_t self:unix_dgram_socket { create_socket_perms sendto };
hadoop_domtrans($2)
role $1 types hadoop_t;
- allow $2 hadoop_t:process { ptrace signal_perms };
+ allow $2 hadoop_t:process signal_perms;
ps_process_pattern($2, hadoop_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 hadoop_t:process ptrace;
+ ')
hadoop_domtrans_zookeeper_client($2)
role $1 types zookeeper_t;
- allow $2 zookeeper_t:process { ptrace signal_perms };
+ allow $2 zookeeper_t:process signal_perms;
ps_process_pattern($2, zookeeper_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 zookeeper_t:process ptrace;
+ ')
+
')
########################################
type hald_t;
')
- allow $1 hald_t:process ptrace;
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 hald_t:process ptrace;
+ ')
')
########################################
# execute openvt which needs setuid
allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config };
-dontaudit hald_t self:capability {sys_ptrace sys_tty_config };
+dontaudit hald_t self:capability sys_tty_config;
allow hald_t self:process { getsched getattr signal_perms };
allow hald_t self:fifo_file rw_fifo_file_perms;
allow hald_t self:unix_stream_socket { create_stream_socket_perms connectto };
type hddtemp_t, hddtemp_etc_t, hddtemp_initrc_exec_t;
')
- allow $1 hddtemp_t:process { ptrace signal_perms };
+ allow $1 hddtemp_t:process signal_perms;
ps_process_pattern($1, hddtemp_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 hddtemp_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, hddtemp_initrc_exec_t)
domain_system_change_exemption($1)
type icecast_t, icecast_initrc_exec_t;
')
- allow $1 icecast_t:process { ptrace signal_perms };
+ allow $1 icecast_t:process signal_perms;
ps_process_pattern($1, icecast_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 icecast_t:process ptrace;
+ ')
# Allow icecast_t to restart the apache service
icecast_initrc_domtrans($1)
type ifplugd_initrc_exec_t;
')
- allow $1 ifplugd_t:process { ptrace signal_perms };
+ allow $1 ifplugd_t:process signal_perms;
ps_process_pattern($1, ifplugd_t)
init_labeled_script_domtrans($1, ifplugd_initrc_exec_t)
#
allow ifplugd_t self:capability { net_admin sys_nice net_bind_service };
-dontaudit ifplugd_t self:capability { sys_tty_config sys_ptrace };
+dontaudit ifplugd_t self:capability sys_tty_config;
allow ifplugd_t self:process { signal signull };
allow ifplugd_t self:fifo_file rw_fifo_file_perms;
allow ifplugd_t self:tcp_socket create_stream_socket_perms;
type innd_initrc_exec_t;
')
- allow $1 innd_t:process { ptrace signal_perms };
+ allow $1 innd_t:process signal_perms;
ps_process_pattern($1, innd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 innd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, innd_initrc_exec_t)
domain_system_change_exemption($1)
type jabberd_initrc_exec_t, jabberd_router_t;
')
- allow $1 jabberd_t:process { ptrace signal_perms };
+ allow $1 jabberd_t:process signal_perms;
ps_process_pattern($1, jabberd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 jabberd_t:process ptrace;
+ allow $1 jabberd_router_t:process ptrace;
+ ')
- allow $1 jabberd_router_t:process { ptrace signal_perms };
+ allow $1 jabberd_router_t:process signal_perms;
ps_process_pattern($1, jabberd_router_t)
init_labeled_script_domtrans($1, jabberd_initrc_exec_t)
type krb5kdc_var_run_t, krb5_host_rcache_t;
')
- allow $1 kadmind_t:process { ptrace signal_perms };
+ allow $1 kadmind_t:process signal_perms;
ps_process_pattern($1, kadmind_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 kadmind_t:process ptrace;
+ allow $1 krb5kdc_t:process ptrace;
+ allow $1 kpropd_t:process ptrace;
+ ')
- allow $1 krb5kdc_t:process { ptrace signal_perms };
+ allow $1 krb5kdc_t:process signal_perms;
ps_process_pattern($1, krb5kdc_t)
- allow $1 kpropd_t:process { ptrace signal_perms };
+ allow $1 kpropd_t:process signal_perms;
ps_process_pattern($1, kpropd_t)
init_labeled_script_domtrans($1, kerberos_initrc_exec_t)
type kerneloops_t, kerneloops_initrc_exec_t, kerneloops_tmp_t;
')
- allow $1 kerneloops_t:process { ptrace signal_perms };
+ allow $1 kerneloops_t:process signal_perms;
ps_process_pattern($1, kerneloops_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 kerneloops_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, kerneloops_initrc_exec_t)
domain_system_change_exemption($1)
type ksmtuned_t, ksmtuned_var_run_t, ksmtuned_initrc_exec_t;
')
- allow $1 ksmtuned_t:process { ptrace signal_perms };
+ allow $1 ksmtuned_t:process signal_perms;
ps_process_pattern($1, ksmtuned_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ksmtuned_t:process ptrace;
+ ')
files_list_pids($1)
admin_pattern($1, ksmtuned_var_run_t)
# ksmtuned local policy
#
-allow ksmtuned_t self:capability { sys_ptrace sys_tty_config };
+allow ksmtuned_t self:capability sys_tty_config;
allow ksmtuned_t self:fifo_file rw_file_perms;
manage_dirs_pattern(ksmtuned_t, ksmtuned_log_t, ksmtuned_log_t)
type l2tpd_var_run_t;
')
- allow $1 l2tpd_t:process { ptrace signal_perms };
+ allow $1 l2tpd_t:process signal_perms;
ps_process_pattern($1, l2tpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 l2tpd_t:process ptrace;
+ ')
l2tpd_initrc_domtrans($1)
domain_system_change_exemption($1)
type slapd_initrc_exec_t;
')
- allow $1 slapd_t:process { ptrace signal_perms };
+ allow $1 slapd_t:process signal_perms;
ps_process_pattern($1, slapd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 slapd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, slapd_initrc_exec_t)
domain_system_change_exemption($1)
type lircd_initrc_exec_t, lircd_etc_t;
')
- allow $1 lircd_t:process { ptrace signal_perms };
+ allow $1 lircd_t:process signal_perms;
ps_process_pattern($1, lircd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 lircd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, lircd_initrc_exec_t)
domain_system_change_exemption($1)
type lldpad_var_run_t;
')
- allow $1 lldpad_t:process { ptrace signal_perms };
+ allow $1 lldpad_t:process signal_perms;
ps_process_pattern($1, lldpad_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 lldpad_t:process ptrace;
+ ')
lldpad_initrc_domtrans($1)
domain_system_change_exemption($1)
dontaudit lpr_t $2:unix_stream_socket { read write };
ps_process_pattern($2, lpr_t)
- allow $2 lpr_t:process { ptrace signal_perms };
+ allow $2 lpr_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 lpr_t:process ptrace;
+ ')
optional_policy(`
cups_read_config($2)
role_transition $2 mscan_initrc_exec_t system_r;
allow $2 system_r;
- allow $1 mscan_t:process { ptrace signal_perms };
+ allow $1 mscan_t:process signal_perms;
ps_process_pattern($1, mscan_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 mscan_t:process ptrace;
+ ')
admin_pattern($1, mscan_etc_t)
files_list_etc($1)
#
# matahari_hostd local policy
#
-
-allow matahari_hostd_t self:capability sys_ptrace;
-
kernel_read_network_state(matahari_hostd_t)
dev_read_sysfs(matahari_hostd_t)
type memcached_t, memcached_initrc_exec_t, memcached_var_run_t;
')
- allow $1 memcached_t:process { ptrace signal_perms };
+ allow $1 memcached_t:process signal_perms;
ps_process_pattern($1, memcached_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 memcached_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, memcached_initrc_exec_t)
domain_system_change_exemption($1)
mock_run($2, $1)
ps_process_pattern($2, mock_t)
- allow $2 mock_t:process { ptrace signal_perms };
+ allow $2 mock_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 mock_t:process ptrace;
+ ')
')
#######################################
type mock_build_t, mock_etc_t, mock_tmp_t;
')
- allow $1 mock_t:process { ptrace signal_perms };
+ allow $1 mock_t:process signal_perms;
ps_process_pattern($1, mock_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 mock_t:process ptrace;
+ allow $1 mock_build_t:process ptrace;
+ ')
- allow $1 mock_build_t:process { ptrace signal_perms };
+ allow $1 mock_build_t:process signal_perms;
ps_process_pattern($1, mock_build_t)
files_list_var_lib($1)
# mock local policy
#
-allow mock_t self:capability { sys_admin setfcap setuid sys_ptrace sys_chroot chown audit_write dac_override sys_nice mknod fsetid setgid fowner };
+allow mock_t self:capability { sys_admin setfcap setuid sys_chroot chown audit_write dac_override sys_nice mknod fsetid setgid fowner };
allow mock_t self:process { siginh noatsecure signal_perms transition rlimitinh setsched setpgid };
# Needed because mock can run java and mono withing build environment
allow mock_t self:process { execmem execstack };
#
# mock_build local policy
#
-allow mock_build_t self:capability { sys_admin setfcap setuid sys_ptrace sys_chroot chown dac_override sys_nice mknod fsetid setgid fowner };
+allow mock_build_t self:capability { sys_admin setfcap setuid sys_chroot chown dac_override sys_nice mknod fsetid setgid fowner };
dontaudit mock_build_t self:capability audit_write;
allow mock_build_t self:process { fork setsched setpgid signal_perms };
allow mock_build_t self:netlink_audit_socket { create_socket_perms nlmsg_relay };
type httpd_mojomojo_script_exec_t;
')
- allow $1 httpd_mojomojo_script_t:process { ptrace signal_perms };
+ allow $1 httpd_mojomojo_script_t:process signal_perms;
ps_process_pattern($1, httpd_mojomojo_script_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 httpd_mojomo_script_t:process ptrace;
+ ')
files_list_tmp($1)
admin_pattern($1, httpd_mojomojo_tmp_t)
type mpd_tmpfs_t;
')
- allow $1 mpd_t:process { ptrace signal_perms };
+ allow $1 mpd_t:process signal_perms;
ps_process_pattern($1, mpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 mpd_t:process ptrace;
+ ')
mpd_initrc_domtrans($1)
domain_system_change_exemption($1)
type httpd_munin_content_t, munin_initrc_exec_t;
')
- allow $1 munin_t:process { ptrace signal_perms };
+ allow $1 munin_t:process signal_perms;
ps_process_pattern($1, munin_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 munin_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, munin_initrc_exec_t)
domain_system_change_exemption($1)
type mysqld_etc_t;
')
- allow $1 mysqld_t:process { ptrace signal_perms };
+ allow $1 mysqld_t:process signal_perms;
ps_process_pattern($1, mysqld_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 mysqld_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, mysqld_initrc_exec_t)
domain_system_change_exemption($1)
#
allow mysqld_safe_t self:capability { chown dac_override fowner kill };
-dontaudit mysqld_safe_t self:capability sys_ptrace;
allow mysqld_safe_t self:process { setsched getsched setrlimit };
allow mysqld_safe_t self:fifo_file rw_fifo_file_perms;
type nagios_etc_t, nrpe_etc_t, nagios_spool_t;
')
- allow $1 nagios_t:process { ptrace signal_perms };
+ allow $1 nagios_t:process signal_perms;
ps_process_pattern($1, nagios_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 nagios_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, nagios_initrc_exec_t)
domain_system_change_exemption($1)
# networkmanager will ptrace itself if gdb is installed
# and it receives a unexpected signal (rh bug #204161)
-allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_admin sys_nice sys_ptrace dac_override net_admin net_raw net_bind_service ipc_lock };
-dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace };
+allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_admin sys_nice dac_override net_admin net_raw net_bind_service ipc_lock };
+dontaudit NetworkManager_t self:capability sys_tty_config;
ifdef(`hide_broken_symptoms',`
# caused by some bogus kernel code
dontaudit NetworkManager_t self:capability sys_module;
')
-allow NetworkManager_t self:process { ptrace getcap setcap setpgid getsched setsched signal_perms };
+allow NetworkManager_t self:process { getcap setcap setpgid getsched setsched signal_perms };
+tunable_policy(`deny_ptrace',`',`
+ allow NetworkManager_t self:process ptrace;
+')
+
allow NetworkManager_t self:fifo_file rw_fifo_file_perms;
allow NetworkManager_t self:unix_dgram_socket { sendto create_socket_perms };
allow NetworkManager_t self:unix_stream_socket create_stream_socket_perms;
type ypbind_initrc_exec_t, nis_initrc_exec_t, ypxfr_t;
')
- allow $1 ypbind_t:process { ptrace signal_perms };
+ allow $1 ypbind_t:process signal_perms;
ps_process_pattern($1, ypbind_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ypbind_t:process ptrace;
+ allow $1 yppasswdd_t:process ptrace;
+ allow $1 ypserv_t:process ptrace;
+ allow $1 ypxfr_t:process ptrace;
+ ')
- allow $1 yppasswdd_t:process { ptrace signal_perms };
+ allow $1 yppasswdd_t:process signal_perms;
ps_process_pattern($1, yppasswdd_t)
- allow $1 ypserv_t:process { ptrace signal_perms };
+ allow $1 ypserv_t:process signal_perms;
ps_process_pattern($1, ypserv_t)
- allow $1 ypxfr_t:process { ptrace signal_perms };
+ allow $1 ypxfr_t:process signal_perms;
ps_process_pattern($1, ypxfr_t)
nis_initrc_domtrans($1)
type nscd_initrc_exec_t;
')
- allow $1 nscd_t:process { ptrace signal_perms };
+ allow $1 nscd_t:process signal_perms;
ps_process_pattern($1, nscd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 nscd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, nscd_initrc_exec_t)
domain_system_change_exemption($1)
# Local policy
#
-allow nscd_t self:capability { kill setgid setuid sys_ptrace };
+allow nscd_t self:capability { kill setgid setuid };
dontaudit nscd_t self:capability sys_tty_config;
allow nscd_t self:process { getattr getcap setcap setsched signal_perms };
allow nscd_t self:fifo_file read_fifo_file_perms;
')
ps_process_pattern($1, nslcd_t)
- allow $1 nslcd_t:process { ptrace signal_perms };
+ allow $1 nslcd_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 nslcd_t:process ptrace;
+ ')
# Allow nslcd_t to restart the apache service
nslcd_initrc_domtrans($1)
type ntpd_key_t, ntpd_var_run_t, ntpd_initrc_exec_t;
')
- allow $1 ntpd_t:process { ptrace signal_perms };
+ allow $1 ntpd_t:process signal_perms;
ps_process_pattern($1, ntpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ntpd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, ntpd_initrc_exec_t)
domain_system_change_exemption($1)
type oidentd_t, oidentd_initrc_exec_t, oidentd_config_t;
')
- allow $1 oidentd_t:process { ptrace signal_perms };
+ allow $1 oidentd_t:process signal_perms;
ps_process_pattern($1, oidentd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 oidentd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, oidentd_initrc_exec_t)
domain_system_change_exemption($1)
type openvpn_var_run_t, openvpn_initrc_exec_t;
')
- allow $1 openvpn_t:process { ptrace signal_perms };
+ allow $1 openvpn_t:process signal_perms;
ps_process_pattern($1, openvpn_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 openvpn_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, openvpn_initrc_exec_t)
domain_system_change_exemption($1)
type pads_var_run_t;
')
- allow $1 pads_t:process { ptrace signal_perms };
+ allow $1 pads_t:process signal_perms;
ps_process_pattern($1, pads_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 pads_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, pads_initrc_exec_t)
domain_system_change_exemption($1)
type pingd_initrc_exec_t;
')
- allow $1 pingd_t:process { ptrace signal_perms };
+ allow $1 pingd_t:process signal_perms;
ps_process_pattern($1, pingd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 pingd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, pingd_initrc_exec_t)
domain_system_change_exemption($1)
#
allow piranha_web_t self:capability { setuid sys_nice kill setgid };
-allow piranha_web_t self:process { getsched setsched signal signull ptrace };
+allow piranha_web_t self:process { getsched setsched signal signull };
+tunable_policy(`deny_ptrace',`',`
+ allow piranha_web_t self:process ptrace;
+')
+
allow piranha_web_t self:rawip_socket create_socket_perms;
allow piranha_web_t self:netlink_route_socket r_netlink_socket_perms;
allow piranha_web_t self:sem create_sem_perms;
type plymouthd_var_run_t;
')
- allow $1 plymouthd_t:process { ptrace signal_perms };
+ allow $1 plymouthd_t:process signal_perms;
ps_process_pattern($1, plymouthd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 plymouthd_t:process ptrace;
+ ')
files_list_var_lib($1)
admin_pattern($1, plymouthd_spool_t)
# policykit local policy
#
-allow policykit_t self:capability { dac_override dac_read_search setgid setuid sys_ptrace };
+allow policykit_t self:capability { dac_override dac_read_search setgid setuid };
allow policykit_t self:process { getsched getattr signal };
allow policykit_t self:fifo_file rw_fifo_file_perms;
allow policykit_t self:unix_dgram_socket create_socket_perms;
# polkit_resolve local policy
#
-allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace };
+allow policykit_resolve_t self:capability { setuid sys_nice };
allow policykit_resolve_t self:process getattr;
allow policykit_resolve_t self:fifo_file rw_fifo_file_perms;
# Policy
#
- allow $2 polipo_session_t:process { ptrace signal_perms };
+ allow $2 polipo_session_t:process signal_perms;
ps_process_pattern($2, polipo_session_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 polipo_session_t:process ptrace;
+ ')
tunable_policy(`polipo_session_users',`
domtrans_pattern($2, polipo_exec_t, polipo_session_t)
type polipo_etc_t, polipo_log_t, polipo_initrc_exec_t;
')
- allow $1 polipo_t:process { ptrace signal_perms };
+ allow $1 polipo_t:process signal_perms;
ps_process_pattern($1, polipo_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 polipo_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, polipo_initrc_exec_t)
domain_system_change_exemption($1)
type portreserve_initrc_exec_t;
')
- allow $1 portreserve_t:process { ptrace signal_perms };
+ allow $1 portreserve_t:process signal_perms;
ps_process_pattern($1, portreserve_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 portreserve_t:process ptrace;
+ ')
portreserve_initrc_domtrans($1)
domain_system_change_exemption($1)
type postfix_smtpd_t, postfix_var_run_t;
')
- allow $1 postfix_bounce_t:process { ptrace signal_perms };
+ allow $1 postfix_bounce_t:process signal_perms;
ps_process_pattern($1, postfix_bounce_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 postfix_bounce_t:process ptrace;
+ ')
- allow $1 postfix_cleanup_t:process { ptrace signal_perms };
+ allow $1 postfix_cleanup_t:process signal_perms;
ps_process_pattern($1, postfix_cleanup_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 postfix_cleanup_t:process ptrace;
+ allow $1 postfix_local_t:process ptrace;
+ allow $1 postfix_master_t:process ptrace;
+ allow $1 postfix_pickup_t:process ptrace;
+ allow $1 postfix_qmgr_t:process ptrace;
+ allow $1 postfix_smtpd_t:process ptrace;
+ ')
- allow $1 postfix_local_t:process { ptrace signal_perms };
+ allow $1 postfix_local_t:process signal_perms;
ps_process_pattern($1, postfix_local_t)
- allow $1 postfix_master_t:process { ptrace signal_perms };
+ allow $1 postfix_master_t:process signal_perms;
ps_process_pattern($1, postfix_master_t)
- allow $1 postfix_pickup_t:process { ptrace signal_perms };
+ allow $1 postfix_pickup_t:process signal_perms;
ps_process_pattern($1, postfix_pickup_t)
- allow $1 postfix_qmgr_t:process { ptrace signal_perms };
+ allow $1 postfix_qmgr_t:process signal_perms;
ps_process_pattern($1, postfix_qmgr_t)
- allow $1 postfix_smtpd_t:process { ptrace signal_perms };
+ allow $1 postfix_smtpd_t:process signal_perms;
ps_process_pattern($1, postfix_smtpd_t)
postfix_run_map($1, $2)
type postfix_policyd_var_run_t, postfix_policyd_initrc_exec_t;
')
- allow $1 postfix_policyd_t:process { ptrace signal_perms };
+ allow $1 postfix_policyd_t:process signal_perms;
ps_process_pattern($1, postfix_policyd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 postfix_policyd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, postfix_policyd_initrc_exec_t)
domain_system_change_exemption($1)
typeattribute $1 sepgsql_admin_type;
- allow $1 postgresql_t:process { ptrace signal_perms };
+ allow $1 postgresql_t:process signal_perms;
ps_process_pattern($1, postgresql_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 postgresql_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, postgresql_initrc_exec_t)
domain_system_change_exemption($1)
type postgrey_var_lib_t, postgrey_var_run_t;
')
- allow $1 postgrey_t:process { ptrace signal_perms };
+ allow $1 postgrey_t:process signal_perms;
ps_process_pattern($1, postgrey_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 postgrey_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, postgrey_initrc_exec_t)
domain_system_change_exemption($1)
type pppd_initrc_exec_t, pppd_etc_rw_t;
')
- allow $1 pppd_t:process { ptrace signal_perms };
+ allow $1 pppd_t:process signal_perms;
ps_process_pattern($1, pppd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 pppd_t:process ptrace;
+ allow $1 pptp_t:process ptrace;
+ ')
- allow $1 pptp_t:process { ptrace signal_perms };
+ allow $1 pptp_t:process signal_perms;
ps_process_pattern($1, pptp_t)
ppp_initrc_domtrans($1)
type prelude_lml_t;
')
- allow $1 prelude_t:process { ptrace signal_perms };
+ allow $1 prelude_t:process signal_perms;
ps_process_pattern($1, prelude_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 prelude_t:process ptrace;
+ allow $1 prelude_audisp_t:process ptrace;
+ allow $1 prelude_lml_t:process ptrace;
+ ')
- allow $1 prelude_audisp_t:process { ptrace signal_perms };
+ allow $1 prelude_audisp_t:process signal_perms;
ps_process_pattern($1, prelude_audisp_t)
- allow $1 prelude_lml_t:process { ptrace signal_perms };
+ allow $1 prelude_lml_t:process signal_perms;
ps_process_pattern($1, prelude_lml_t)
init_labeled_script_domtrans($1, prelude_initrc_exec_t)
type privoxy_etc_rw_t, privoxy_var_run_t;
')
- allow $1 privoxy_t:process { ptrace signal_perms };
+ allow $1 privoxy_t:process signal_perms;
ps_process_pattern($1, privoxy_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 privoxy_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, privoxy_initrc_exec_t)
domain_system_change_exemption($1)
type psad_tmp_t;
')
- allow $1 psad_t:process { ptrace signal_perms };
+ allow $1 psad_t:process signal_perms;
ps_process_pattern($1, psad_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 psad_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, psad_initrc_exec_t)
domain_system_change_exemption($1)
# Puppet personal policy
#
-allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_ptrace sys_tty_config };
+allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_tty_config };
allow puppet_t self:process { signal signull getsched setsched };
allow puppet_t self:fifo_file rw_fifo_file_perms;
allow puppet_t self:netlink_route_socket create_netlink_socket_perms;
# allow ps to show pyzor and allow the user to kill it
ps_process_pattern($2, pyzor_t)
- allow $2 pyzor_t:process { ptrace signal_perms };
+ allow $2 pyzor_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 pyzor_t:process ptrace;
+ ')
')
########################################
type pyzor_etc_t, pyzor_var_lib_t, pyzord_initrc_exec_t;
')
- allow $1 pyzord_t:process { ptrace signal_perms };
+ allow $1 pyzord_t:process signal_perms;
ps_process_pattern($1, pyzord_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 pyzord_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, pyzord_initrc_exec_t)
domain_system_change_exemption($1)
type qpidd_t, qpidd_initrc_exec_t;
')
- allow $1 qpidd_t:process { ptrace signal_perms };
+ allow $1 qpidd_t:process signal_perms;
ps_process_pattern($1, qpidd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 qpidd_t:process ptrace;
+ ')
# Allow qpidd_t to restart the apache service
qpidd_initrc_domtrans($1)
type radiusd_initrc_exec_t;
')
- allow $1 radiusd_t:process { ptrace signal_perms };
+ allow $1 radiusd_t:process signal_perms;
ps_process_pattern($1, radiusd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 radiusd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, radiusd_initrc_exec_t)
domain_system_change_exemption($1)
type radvd_var_run_t;
')
- allow $1 radvd_t:process { ptrace signal_perms };
+ allow $1 radvd_t:process signal_perms;
ps_process_pattern($1, radvd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 radvd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, radvd_initrc_exec_t)
domain_system_change_exemption($1)
# allow ps to show razor and allow the user to kill it
ps_process_pattern($2, razor_t)
- allow $2 razor_t:process { ptrace signal_perms };
+ allow $2 razor_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 razor_t:process ptrace;
+ ')
manage_dirs_pattern($2, razor_home_t, razor_home_t)
manage_files_pattern($2, razor_home_t, razor_home_t)
type rgmanager_tmpfs_t, rgmanager_var_log_t, rgmanager_var_run_t;
')
- allow $1 rgmanager_t:process { ptrace signal_perms };
+ allow $1 rgmanager_t:process signal_perms;
ps_process_pattern($1, rgmanager_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 rgmanager_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, rgmanager_initrc_exec_t)
domain_system_change_exemption($1)
#
allow rgmanager_t self:capability { dac_override net_raw sys_resource sys_admin sys_nice ipc_lock };
-dontaudit rgmanager_t self:capability { sys_ptrace };
allow rgmanager_t self:process { setsched signal };
dontaudit rgmanager_t self:process ptrace;
type rhsmcertd_var_run_t;
')
- allow $1 rhsmcertd_t:process { ptrace signal_perms };
+ allow $1 rhsmcertd_t:process signal_perms;
ps_process_pattern($1, rhsmcertd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 rhsmcertd_t:process ptrace;
+ ')
rhsmcertd_initrc_domtrans($1)
domain_system_change_exemption($1)
type ricci_var_lib_t, ricci_var_log_t, ricci_var_run_t;
')
- allow $1 ricci_t:process { ptrace signal_perms };
+ allow $1 ricci_t:process signal_perms;
ps_process_pattern($1, ricci_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ricci_t:process ptrace;
+ ')
ricci_initrc_domtrans($1)
domain_system_change_exemption($1)
type roundup_initrc_exec_t;
')
- allow $1 roundup_t:process { ptrace signal_perms };
+ allow $1 roundup_t:process signal_perms;
ps_process_pattern($1, roundup_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 roundup_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, roundup_initrc_exec_t)
domain_system_change_exemption($1)
type rpcbind_initrc_exec_t;
')
- allow $1 rpcbind_t:process { ptrace signal_perms };
+ allow $1 rpcbind_t:process signal_perms;
ps_process_pattern($1, rpcbind_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 rpcbind_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, rpcbind_initrc_exec_t)
domain_system_change_exemption($1)
# rtkit_daemon local policy
#
-allow rtkit_daemon_t self:capability { dac_read_search setuid sys_chroot setgid sys_nice sys_ptrace };
+allow rtkit_daemon_t self:capability { dac_read_search setuid sys_chroot setgid sys_nice };
allow rtkit_daemon_t self:process { setsched getcap setcap setrlimit };
kernel_read_system_state(rtkit_daemon_t)
type rwho_initrc_exec_t;
')
- allow $1 rwho_t:process { ptrace signal_perms };
+ allow $1 rwho_t:process signal_perms;
ps_process_pattern($1, rwho_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 rwho_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, rwho_initrc_exec_t)
domain_system_change_exemption($1)
type winbind_var_run_t, winbind_tmp_t, samba_unconfined_script_t;
')
- allow $1 smbd_t:process { ptrace signal_perms };
+ allow $1 smbd_t:process signal_perms;
ps_process_pattern($1, smbd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 smbd_t:process ptrace;
+ allow $1 nmbd_t:process ptrace;
+ allow $1 samba_unconfined_script_t:process ptrace;
+ ')
- allow $1 nmbd_t:process { ptrace signal_perms };
+ allow $1 nmbd_t:process signal_perms;
ps_process_pattern($1, nmbd_t)
- allow $1 samba_unconfined_script_t:process { ptrace signal_perms };
+ allow $1 samba_unconfined_script_t:process signal_perms;
ps_process_pattern($1, samba_unconfined_script_t)
samba_run_smbcontrol($1, $2, $3)
type samhain_initrc_exec_t, samhain_log_t, samhain_var_run_t;
')
- allow $1 samhain_t:process { ptrace signal_perms };
+ allow $1 samhain_t:process signal_perms;
ps_process_pattern($1, samhain_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 samhain_t:process ptrace;
+ allow $1 samhaind_t:process ptrace;
+ ')
- allow $1 samhaind_t:process { ptrace signal_perms };
+ allow $1 samhaind_t:process signal_perms;
ps_process_pattern($1, samhaind_t)
files_list_var_lib($1)
type sanlock_initrc_exec_t;
')
- allow $1 sanlock_t:process { ptrace signal_perms };
+ allow $1 sanlock_t:process signal_perms;
ps_process_pattern($1, sanlock_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 sanlock_t:process ptrace;
+ ')
sanlock_initrc_domtrans($1)
domain_system_change_exemption($1)
type saslauthd_initrc_exec_t;
')
- allow $1 saslauthd_t:process { ptrace signal_perms };
+ allow $1 saslauthd_t:process signal_perms;
ps_process_pattern($1, saslauthd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 saslauthd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, saslauthd_initrc_exec_t)
domain_system_change_exemption($1)
type sblim_var_run_t;
')
- allow $1 sblim_gatherd_t:process { ptrace signal_perms };
+ allow $1 sblim_gatherd_t:process signal_perms;
ps_process_pattern($1, sblim_gatherd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 sblim_gatherd_t:process ptrace;
+ allow $1 sblim_reposd_t:process ptrace;
+ ')
- allow $1 sblim_reposd_t:process { ptrace signal_perms };
- ps_process_pattern($1, sblim_reposd_t)
+ allow $1 sblim_reposd_t:process signal_perms;
+ ps_process_pattern($1, sblim_reposd_t)
files_search_pids($1)
admin_pattern($1, sblim_var_run_t)
#
#needed by ps
-allow sblim_gatherd_t self:capability { sys_ptrace kill dac_override };
+allow sblim_gatherd_t self:capability { kill dac_override };
allow sblim_gatherd_t self:process signal;
allow sblim_gatherd_t self:fifo_file rw_fifo_file_perms;
type mail_spool_t;
')
- allow $1 sendmail_t:process { ptrace signal_perms };
+ allow $1 sendmail_t:process signal_perms;
ps_process_pattern($1, sendmail_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 sendmail_t:process ptrace;
+ allow $1 unconfined_sendmail_t:process ptrace;
+ ')
- allow $1 unconfined_sendmail_t:process { ptrace signal_perms };
+ allow $1 unconfined_sendmail_t:process signal_perms;
ps_process_pattern($1, unconfined_sendmail_t)
sendmail_initrc_domtrans($1)
type setroubleshoot_var_lib_t;
')
- allow $1 setroubleshootd_t:process { ptrace signal_perms };
+ allow $1 setroubleshootd_t:process signal_perms;
ps_process_pattern($1, setroubleshootd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 setroubleshootd_t:process ptrace;
+ ')
logging_list_logs($1)
admin_pattern($1, setroubleshoot_var_log_t)
type fsdaemon_initrc_exec_t;
')
- allow $1 fsdaemon_t:process { ptrace signal_perms };
+ allow $1 fsdaemon_t:process signal_perms;
ps_process_pattern($1, fsdaemon_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 smartmon_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, fsdaemon_initrc_exec_t)
domain_system_change_exemption($1)
type smokeping_t, smokeping_initrc_exec_t;
')
- allow $1 smokeping_t:process { ptrace signal_perms };
+ allow $1 smokeping_t:process signal_perms;
ps_process_pattern($1, smokeping_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 smokeping_t:process ptrace;
+ ')
smokeping_initrc_domtrans($1)
domain_system_change_exemption($1)
type snmpd_var_lib_t, snmpd_var_run_t;
')
- allow $1 snmpd_t:process { ptrace signal_perms };
+ allow $1 snmpd_t:process signal_perms;
ps_process_pattern($1, snmpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 snmpd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, snmpd_initrc_exec_t)
domain_system_change_exemption($1)
# Local policy
#
-allow snmpd_t self:capability { chown dac_override kill ipc_lock setgid setuid sys_ptrace net_admin sys_nice sys_tty_config };
+allow snmpd_t self:capability { chown dac_override kill ipc_lock setgid setuid net_admin sys_nice sys_tty_config };
+
dontaudit snmpd_t self:capability { sys_module sys_tty_config };
allow snmpd_t self:process { signal_perms getsched setsched };
allow snmpd_t self:fifo_file rw_fifo_file_perms;
type snort_etc_t, snort_initrc_exec_t;
')
- allow $1 snort_t:process { ptrace signal_perms };
+ allow $1 snort_t:process signal_perms;
ps_process_pattern($1, snort_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 snort_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, snort_initrc_exec_t)
domain_system_change_exemption($1)
type soundd_tmp_t, soundd_var_run_t;
')
- allow $1 soundd_t:process { ptrace signal_perms };
+ allow $1 soundd_t:process signal_perms;
ps_process_pattern($1, soundd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 soundd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, soundd_initrc_exec_t)
domain_system_change_exemption($1)
domtrans_pattern($2, spamassassin_exec_t, spamassassin_t)
- allow $2 spamassassin_t:process { ptrace signal_perms };
+ allow $2 spamassassin_t:process signal_perms;
ps_process_pattern($2, spamassassin_t)
domtrans_pattern($2, spamc_exec_t, spamc_t)
- allow $2 spamc_t:process { ptrace signal_perms };
+ allow $2 spamc_t:process signal_perms;
ps_process_pattern($2, spamc_t)
manage_dirs_pattern($2, spamassassin_home_t, spamassassin_home_t)
type spamd_initrc_exec_t;
')
- allow $1 spamd_t:process { ptrace signal_perms };
+ allow $1 spamd_t:process signal_perms;
ps_process_pattern($1, spamd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 spamd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, spamd_initrc_exec_t)
domain_system_change_exemption($1)
type squid_log_t, squid_var_run_t, squid_initrc_exec_t;
')
- allow $1 squid_t:process { ptrace signal_perms };
+ allow $1 squid_t:process signal_perms;
ps_process_pattern($1, squid_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 squid_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, squid_initrc_exec_t)
domain_system_change_exemption($1)
# allow ps to show ssh
ps_process_pattern($3, ssh_t)
- allow $3 ssh_t:process { ptrace signal_perms };
+ allow $3 ssh_t:process signal_perms;
# for rsync
allow ssh_t $3:unix_stream_socket rw_socket_perms;
stream_connect_pattern($3, ssh_agent_tmp_t, ssh_agent_tmp_t, $1_ssh_agent_t)
# Allow the user shell to signal the ssh program.
- allow $3 $1_ssh_agent_t:process { ptrace signal_perms };
+ allow $3 $1_ssh_agent_t:process signal_perms;
# allow ps to show ssh
ps_process_pattern($3, $1_ssh_agent_t)
type sssd_t, sssd_public_t, sssd_initrc_exec_t;
')
- allow $1 sssd_t:process { ptrace signal_perms };
+ allow $1 sssd_t:process signal_perms;
ps_process_pattern($1, sssd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 sssd_t:process ptrace;
+ ')
# Allow sssd_t to restart the apache service
sssd_initrc_domtrans($1)
type tcsd_var_lib_t;
')
- allow $1 tcsd_t:process { ptrace signal_perms };
+ allow $1 tcsd_t:process signal_perms;
ps_process_pattern($1, tcsd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 tcsd_t:process ptrace;
+ ')
tcsd_initrc_domtrans($1)
domain_system_change_exemption($1)
type tftpd_t, tftpdir_t, tftpdir_rw_t, tftpd_var_run_t;
')
- allow $1 tftpd_t:process { ptrace signal_perms };
+ allow $1 tftpd_t:process signal_perms;
ps_process_pattern($1, tftpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 tftp_t:process ptrace;
+ ')
files_list_var_lib($1)
admin_pattern($1, tftpdir_rw_t)
type tor_initrc_exec_t;
')
- allow $1 tor_t:process { ptrace signal_perms };
+ allow $1 tor_t:process signal_perms;
ps_process_pattern($1, tor_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 tor_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, tor_initrc_exec_t)
domain_system_change_exemption($1)
type tuned_t, tuned_var_run_t, tuned_initrc_exec_t;
')
- allow $1 tuned_t:process { ptrace signal_perms };
+ allow $1 tuned_t:process signal_perms;
ps_process_pattern($1, tuned_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 tuned_t:process ptrace;
+ ')
tuned_initrc_domtrans($1)
domain_system_change_exemption($1)
type ulogd_var_log_t, ulogd_initrc_exec_t;
')
- allow $1 ulogd_t:process { ptrace signal_perms };
+ allow $1 ulogd_t:process signal_perms;
ps_process_pattern($1, ulogd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ulogd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, ulogd_initrc_exec_t)
domain_system_change_exemption($1)
type uucpd_var_run_t;
')
- allow $1 uucpd_t:process { ptrace signal_perms };
+ allow $1 uucpd_t:process signal_perms;
ps_process_pattern($1, uucpd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 uucpd_t:process ptrace;
+ ')
logging_list_logs($1)
admin_pattern($1, uucpd_log_t)
type uuidd_var_run_t;
')
- allow $1 uuidd_t:process { ptrace signal_perms };
+ allow $1 uuidd_t:process signal_perms;
ps_process_pattern($1, uuidd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 uuidd_t:process ptrace;
+ ')
uuidd_initrc_domtrans($1)
domain_system_change_exemption($1)
type varnishlog_var_run_t;
')
- allow $1 varnishlog_t:process { ptrace signal_perms };
+ allow $1 varnishlog_t:process signal_perms;
ps_process_pattern($1, varnishlog_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 varnishd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, varnishlog_initrc_exec_t)
domain_system_change_exemption($1)
type varnishd_initrc_exec_t;
')
- allow $1 varnishd_t:process { ptrace signal_perms };
+ allow $1 varnishd_t:process signal_perms;
ps_process_pattern($1, varnishd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 varnishd_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, varnishd_initrc_exec_t)
domain_system_change_exemption($1)
type vdagent_var_run_t;
')
- allow $1 vdagent_t:process { ptrace signal_perms };
+ allow $1 vdagent_t:process signal_perms;
ps_process_pattern($1, vdagent_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 vdagent_t:process ptrace;
+ ')
files_search_pids($1)
admin_pattern($1, vdagent_var_run_t)
type vhostmd_t, vhostmd_initrc_exec_t;
')
- allow $1 vhostmd_t:process { ptrace signal_perms };
+ allow $1 vhostmd_t:process signal_perms;
ps_process_pattern($1, vhostmd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 vhostmd_t:process ptrace;
+ ')
vhostmd_initrc_domtrans($1)
domain_system_change_exemption($1)
type virt_lxc_t;
')
- allow $1 virtd_t:process { ptrace signal_perms };
+ allow $1 virtd_t:process signal_perms;
ps_process_pattern($1, virtd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 virtd_t:process ptrace;
+ allow $1 virt_lxc_t:process ptrace;
+ ')
- allow $1 virt_lxc_t:process { ptrace signal_perms };
+ allow $1 virt_lxc_t:process signal_perms;
ps_process_pattern($1, virt_lxc_t)
init_labeled_script_domtrans($1, virtd_initrc_exec_t)
virt_manage_images($1)
- allow $1 virt_domain:process { ptrace signal_perms };
+ allow $1 virt_domain:process signal_perms;
')
########################################
# virtd local policy
#
-allow virtd_t self:capability { chown dac_override fowner ipc_lock kill mknod net_admin net_raw setpcap setuid setgid sys_admin sys_nice sys_ptrace };
+allow virtd_t self:capability { chown dac_override fowner ipc_lock kill mknod net_admin net_raw setpcap setuid setgid sys_admin sys_nice };
allow virtd_t self:process { getcap getsched setcap sigkill signal signull execmem setexec setfscreate setsockcreate setsched };
ifdef(`hide_broken_symptoms',`
# caused by some bogus kernel code
# virt_lxc_domain local policy
#
allow svirt_lxc_domain self:capability { kill setuid setgid dac_override };
-dontaudit svirt_lxc_domain self:capability sys_ptrace;
allow virtd_t svirt_lxc_domain:process { signal_perms };
allow virtd_lxc_t svirt_lxc_domain:process { getattr getsched setsched transition signal signull sigkill };
type vnstatd_t, vnstatd_var_lib_t;
')
- allow $1 vnstatd_t:process { ptrace signal_perms };
+ allow $1 vnstatd_t:process signal_perms;
ps_process_pattern($1, vnstatd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 vnstatd_t:process ptrace;
+ ')
files_list_var_lib($1)
admin_pattern($1, vnstatd_var_lib_t)
type wdmd_initrc_exec_t;
')
- allow $1 wdmd_t:process { ptrace signal_perms };
+ allow $1 wdmd_t:process signal_perms;
ps_process_pattern($1, wdmd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 wdmd_t:process ptrace;
+ ')
wdmd_initrc_domtrans($1)
domain_system_change_exemption($1)
# XDM Local policy
#
-allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service sys_ptrace };
-allow xdm_t self:process { setexec setpgid getattr getcap setcap getsched getsession setsched setrlimit signal_perms setkeycreate ptrace };
+allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service };
+
+allow xdm_t self:process { setexec setpgid getattr getcap setcap getsched getsession setsched setrlimit signal_perms setkeycreate };
+tunable_policy(`deny_ptrace',`',`
+ allow xdm_t self:process ptrace;
+')
+
allow xdm_t self:fifo_file rw_fifo_file_perms;
allow xdm_t self:shm create_shm_perms;
allow xdm_t self:sem create_sem_perms;
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
-allow xserver_t self:capability { dac_override fowner fsetid setgid setuid ipc_owner sys_ptrace sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service };
+allow xserver_t self:capability { dac_override fowner fsetid setgid setuid ipc_owner sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service };
+
dontaudit xserver_t self:capability chown;
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:fd use;
type zabbix_initrc_exec_t;
')
- allow $1 zabbix_t:process { ptrace signal_perms };
+ allow $1 zabbix_t:process signal_perms;
ps_process_pattern($1, zabbix_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 zabbix_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, zabbix_initrc_exec_t)
domain_system_change_exemption($1)
type zebra_conf_t, zebra_var_run_t, zebra_initrc_exec_t;
')
- allow $1 zebra_t:process { ptrace signal_perms };
+ allow $1 zebra_t:process signal_perms;
ps_process_pattern($1, zebra_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 zebra_t:process ptrace;
+ ')
init_labeled_script_domtrans($1, zebra_initrc_exec_t)
domain_system_change_exemption($1)
#
allow hotplug_t self:capability { net_admin sys_tty_config mknod sys_rawio };
-dontaudit hotplug_t self:capability { sys_module sys_admin sys_ptrace sys_tty_config };
+dontaudit hotplug_t self:capability { sys_module sys_admin sys_tty_config };
# for access("/etc/bashrc", X_OK) on Red Hat
dontaudit hotplug_t self:capability { dac_override dac_read_search };
allow hotplug_t self:process { setpgid getsession getattr signal_perms };
type init_t;
')
- allow $1 init_t:process ptrace;
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 init_t:process ptrace;
+ ')
')
########################################
#
# Use capabilities. old rule:
-allow init_t self:capability ~{ audit_control audit_write sys_module };
+allow init_t self:capability ~{ sys_ptrace audit_control audit_write sys_module };
# is ~sys_module really needed? observed:
# sys_boot
# sys_tty_config
#
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
-allow initrc_t self:capability ~{ audit_control audit_write sys_admin sys_module };
+allow initrc_t self:capability ~{ sys_ptrace audit_control audit_write sys_admin sys_module };
+
dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
allow initrc_t self:passwd rootok;
allow initrc_t self:key manage_key_perms;
#
allow ipsec_t self:capability { net_admin dac_override dac_read_search setpcap sys_nice };
-dontaudit ipsec_t self:capability { sys_ptrace sys_tty_config };
+dontaudit ipsec_t self:capability sys_tty_config;
allow ipsec_t self:process { getcap setcap getsched signal setsched };
allow ipsec_t self:tcp_socket create_stream_socket_perms;
allow ipsec_t self:udp_socket create_socket_perms;
#
allow ipsec_mgmt_t self:capability { dac_override dac_read_search net_admin setpcap sys_nice };
-dontaudit ipsec_mgmt_t self:capability { sys_ptrace sys_tty_config };
-allow ipsec_mgmt_t self:process { getsched ptrace setrlimit setsched signal };
+dontaudit ipsec_mgmt_t self:capability sys_tty_config;
+allow ipsec_mgmt_t self:process { getsched setrlimit setsched signal };
allow ipsec_mgmt_t self:unix_stream_socket create_stream_socket_perms;
allow ipsec_mgmt_t self:tcp_socket create_stream_socket_perms;
allow ipsec_mgmt_t self:udp_socket create_socket_perms;
kernel_getattr_core_if(ipsec_mgmt_t)
kernel_getattr_message_if(ipsec_mgmt_t)
-# don't audit using of lsof
-dontaudit ipsec_mgmt_t self:capability sys_ptrace;
-
domain_dontaudit_getattr_all_sockets(ipsec_mgmt_t)
domain_dontaudit_getattr_all_pipes(ipsec_mgmt_t)
#
allow iscsid_t self:capability { dac_override ipc_lock net_admin net_raw sys_admin sys_nice sys_resource };
-dontaudit iscsid_t self:capability sys_ptrace;
allow iscsid_t self:process { setrlimit setsched signal };
allow iscsid_t self:fifo_file rw_fifo_file_perms;
allow iscsid_t self:unix_stream_socket { create_stream_socket_perms connectto };
# Local login local policy
#
-allow local_login_t self:capability { dac_override chown fowner fsetid kill setgid setuid sys_admin sys_nice sys_ptrace sys_resource sys_tty_config };
+allow local_login_t self:capability { dac_override chown fowner fsetid kill setgid setuid sys_admin sys_nice sys_resource sys_tty_config };
allow local_login_t self:process ~{ ptrace setcurrent setfscreate execmem execstack execheap };
allow local_login_t self:fd use;
allow local_login_t self:fifo_file rw_fifo_file_perms;
type auditd_initrc_exec_t;
')
- allow $1 auditd_t:process { ptrace signal_perms };
+ allow $1 auditd_t:process signal_perms;
ps_process_pattern($1, auditd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 auditd_t:process ptrace;
+ ')
+
manage_dirs_pattern($1, auditd_etc_t, auditd_etc_t)
manage_files_pattern($1, auditd_etc_t, auditd_etc_t)
')
allow $1 self:capability2 syslog;
- allow $1 syslogd_t:process { ptrace signal_perms };
- allow $1 klogd_t:process { ptrace signal_perms };
+ allow $1 syslogd_t:process signal_perms;
+ allow $1 klogd_t:process signal_perms;
ps_process_pattern($1, syslogd_t)
ps_process_pattern($1, klogd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 syslogd_t:process ptrace;
+ allow $1 klogd_t:process ptrace;
+ ')
manage_dirs_pattern($1, klogd_var_run_t, klogd_var_run_t)
manage_files_pattern($1, klogd_var_run_t, klogd_var_run_t)
# setuid/setgid needed to mount cifs
allow mount_t self:capability { fsetid fowner ipc_lock setpcap sys_rawio sys_resource sys_admin dac_override dac_read_search chown sys_tty_config setuid setgid };
-allow mount_t self:process { getcap getsched ptrace setcap setrlimit signal };
+allow mount_t self:process { getcap getsched setcap setrlimit signal };
+tunable_policy(`deny_ptrace',`',`
+ allow mount_t self:process ptrace;
+')
+
allow mount_t self:fifo_file rw_fifo_file_perms;
allow mount_t self:unix_stream_socket create_stream_socket_perms;
allow mount_t self:unix_dgram_socket create_socket_perms;
# DHCP client local policy
#
allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service setpcap sys_nice sys_resource sys_tty_config };
-dontaudit dhcpc_t self:capability { sys_tty_config sys_ptrace };
+dontaudit dhcpc_t self:capability sys_tty_config;
# for access("/etc/bashrc", X_OK) on Red Hat
dontaudit dhcpc_t self:capability { dac_read_search sys_module };
-allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms };
+allow dhcpc_t self:process { getsched getcap setcap setfscreate signal_perms };
+tunable_policy(`deny_ptrace',`',`
+ allow dhcpc_t self:process ptrace;
+')
allow dhcpc_t self:fifo_file rw_fifo_file_perms;
allow dhcpc_t self:tcp_socket create_stream_socket_perms;
# Local policy
#
-allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin sys_nice sys_rawio sys_resource setuid setgid sys_nice sys_ptrace };
+allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin sys_nice sys_rawio sys_resource setuid setgid sys_nice };
dontaudit udev_t self:capability sys_tty_config;
ifdef(`hide_broken_symptoms',`
dontaudit udev_t self:capability sys_module;
')
-allow udev_t self:process ~{ setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+allow udev_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+tunable_policy(`deny_ptrace',`',`
+ allow udev_t self:process ptrace;
+')
+
allow udev_t self:process { execmem setfscreate };
allow udev_t self:fd use;
allow udev_t self:fifo_file rw_fifo_file_perms;
')
# Use any Linux capability.
- allow $1 self:capability ~sys_module;
+
+ allow $1 self:capability ~{ sys_module sys_ptrace };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 self:capability sys_ptrace;
+ ')
+
allow $1 self:capability2 syslog;
allow $1 self:fifo_file { manage_fifo_file_perms relabelfrom relabelto };
term_user_tty($1_t, user_tty_device_t)
term_dontaudit_getattr_generic_ptys($1_t)
- allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
+ allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1_usertype $1_usertype:process ptrace;
+ ')
allow $1_usertype $1_usertype:fd use;
allow $1_usertype $1_t:key { create view read write search link setattr };
allow $1_t self:capability { setgid chown fowner };
dontaudit $1_t self:capability { sys_nice fsetid };
- allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
+ allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
dontaudit $1_t self:process setrlimit;
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
# $1_t local policy
#
- allow $1_t self:capability ~{ sys_module audit_control audit_write };
+ allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1_t self:capability sys_ptrace;
+ ')
allow $1_t self:capability2 syslog;
allow $1_t self:process { setexec setfscreate };
allow $1_t self:netlink_audit_socket nlmsg_readpriv;
attribute userdomain;
')
- allow $1 userdomain:process ptrace;
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 userdomain:process ptrace;
+ ')
')
########################################
#
allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_admin sys_nice sys_tty_config net_raw };
-dontaudit xend_t self:capability { sys_ptrace };
allow xend_t self:process { signal sigkill };
dontaudit xend_t self:process ptrace;
# internal communication is often done using fifo and unix sockets.
projects / people / stevee / selinux-policy.git / commitdiff
