blob: c4d899851572dce74fc35d7a98b26b564b41f06b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
policy_module(firstboot, 1.12.0)
gen_require(`
class passwd rootok;
')
########################################
#
# Declarations
#
type firstboot_t;
type firstboot_exec_t;
init_system_domain(firstboot_t, firstboot_exec_t)
domain_obj_id_change_exemption(firstboot_t)
domain_subj_id_change_exemption(firstboot_t)
role system_r types firstboot_t;
type firstboot_etc_t;
files_config_file(firstboot_etc_t)
########################################
#
# Local policy
#
allow firstboot_t self:capability { dac_override setgid };
allow firstboot_t self:process setfscreate;
allow firstboot_t self:fifo_file rw_fifo_file_perms;
allow firstboot_t self:tcp_socket create_stream_socket_perms;
allow firstboot_t self:unix_stream_socket { connect create };
allow firstboot_t self:passwd rootok;
allow firstboot_t firstboot_etc_t:file read_file_perms;
kernel_read_system_state(firstboot_t)
kernel_read_kernel_sysctls(firstboot_t)
corenet_all_recvfrom_unlabeled(firstboot_t)
corenet_all_recvfrom_netlabel(firstboot_t)
corenet_tcp_sendrecv_generic_if(firstboot_t)
corenet_tcp_sendrecv_generic_node(firstboot_t)
corenet_tcp_sendrecv_all_ports(firstboot_t)
dev_read_urand(firstboot_t)
selinux_get_fs_mount(firstboot_t)
selinux_validate_context(firstboot_t)
selinux_compute_access_vector(firstboot_t)
selinux_compute_create_context(firstboot_t)
selinux_compute_relabel_context(firstboot_t)
selinux_compute_user_contexts(firstboot_t)
auth_dontaudit_getattr_shadow(firstboot_t)
corecmd_exec_all_executables(firstboot_t)
files_exec_etc_files(firstboot_t)
files_manage_etc_files(firstboot_t)
files_manage_etc_runtime_files(firstboot_t)
files_read_usr_files(firstboot_t)
files_manage_var_dirs(firstboot_t)
files_manage_var_files(firstboot_t)
files_manage_var_symlinks(firstboot_t)
init_domtrans_script(firstboot_t)
init_rw_utmp(firstboot_t)
libs_exec_ld_so(firstboot_t)
libs_exec_lib_files(firstboot_t)
locallogin_use_fds(firstboot_t)
logging_send_syslog_msg(firstboot_t)
miscfiles_read_localization(firstboot_t)
modutils_domtrans_insmod(firstboot_t)
modutils_domtrans_depmod(firstboot_t)
modutils_read_module_config(firstboot_t)
modutils_read_module_deps(firstboot_t)
userdom_use_user_terminals(firstboot_t)
# Add/remove user home directories
userdom_manage_user_home_content_dirs(firstboot_t)
userdom_manage_user_home_content_files(firstboot_t)
userdom_manage_user_home_content_symlinks(firstboot_t)
userdom_manage_user_home_content_pipes(firstboot_t)
userdom_manage_user_home_content_sockets(firstboot_t)
userdom_home_filetrans_user_home_dir(firstboot_t)
userdom_user_home_dir_filetrans_user_home_content(firstboot_t, { dir file lnk_file fifo_file sock_file })
optional_policy(`
consoletype_domtrans(firstboot_t)
')
optional_policy(`
dbus_system_bus_client(firstboot_t)
optional_policy(`
hal_dbus_chat(firstboot_t)
')
')
optional_policy(`
nis_use_ypbind(firstboot_t)
')
optional_policy(`
samba_rw_config(firstboot_t)
')
optional_policy(`
unconfined_domtrans(firstboot_t)
# The big hammer
unconfined_domain(firstboot_t)
')
optional_policy(`
usermanage_domtrans_chfn(firstboot_t)
usermanage_domtrans_groupadd(firstboot_t)
usermanage_domtrans_passwd(firstboot_t)
usermanage_domtrans_useradd(firstboot_t)
usermanage_domtrans_admin_passwd(firstboot_t)
')
optional_policy(`
gnome_manage_config(firstboot_t)
')
optional_policy(`
xserver_domtrans(firstboot_t)
xserver_rw_shm(firstboot_t)
xserver_unconfined(firstboot_t)
')
|
GitWeb