diff options
| author |   Sven Vermeulen <sven.vermeulen@siphos.be> | 2014-08-06 11:03:57 +0200 |
|---|---|---|
| committer | Sven Vermeulen <sven.vermeulen@siphos.be> | 2014-08-06 20:08:37 +0200 |
| commit | c59fbdcd0347acb36cb72b2da4e60f553121113b (patch) | |
| tree | ff0be95d23f05580ad9d9f53db4c7d074d5cb171 | |
| parent | Comment out seutil_relabelto_bin_policy (diff) | |
| download | hardened-refpolicy-c59fbdcd0347acb36cb72b2da4e60f553121113b.tar.gz hardened-refpolicy-c59fbdcd0347acb36cb72b2da4e60f553121113b.tar.bz2 hardened-refpolicy-c59fbdcd0347acb36cb72b2da4e60f553121113b.zip | |
Introduce files_manage_non_security_file_type interface
This interface, similar to files_manage_non_auth_files, allows the
domain to manage and work on non-security related file types. No type
attributes are set so this can be used in a tunable_policy statement if
necessary.
Naming based on the attribute used (non_security_file_type).
| -rw-r--r-- | policy/modules/kernel/files.if | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index ca278d5f..5d53aa47 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -6728,3 +6728,27 @@ interface(`files_read_etc_runtime',` read_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t) read_lnk_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t) ') + +######################################## +## <summary> +## Manage non-security related resources. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`files_manage_non_security_file_type',` + gen_require(` + attribute non_security_file_type; + ') + + manage_dirs_pattern($1, non_security_file_type, non_security_file_type) + manage_files_pattern($1, non_security_file_type, non_security_file_type) + manage_lnk_files_pattern($1, non_security_file_type, non_security_file_type) + manage_fifo_files_pattern($1, non_security_file_type, non_security_file_type) + manage_sock_files_pattern($1, non_security_file_type, non_security_file_type) +') + |