|
 |
e9119ee |
diff --git a/policy/modules/admin/prelink.te b/policy/modules/admin/prelink.te
|
|
|
e9119ee |
index ec838bd..5d940f8 100644
|
|
|
e9119ee |
--- a/policy/modules/admin/prelink.te
|
|
|
e9119ee |
+++ b/policy/modules/admin/prelink.te
|
|
|
e9119ee |
@@ -126,7 +126,7 @@ optional_policy(`
|
|
|
e9119ee |
')
|
|
|
f1bc73d |
|
|
|
3c81e30 |
optional_policy(`
|
|
|
e9119ee |
- nsplugin_manage_rw_files(prelink_t)
|
|
|
e9119ee |
+ mozilla_plugin_manage_rw_files(prelink_t)
|
|
|
f1bc73d |
')
|
|
|
f1bc73d |
|
|
|
f1bc73d |
optional_policy(`
|
|
|
e9119ee |
diff --git a/policy/modules/apps/mozilla.fc b/policy/modules/apps/mozilla.fc
|
|
|
e9119ee |
index 35b51ab..800b5c8 100644
|
|
|
e9119ee |
--- a/policy/modules/apps/mozilla.fc
|
|
|
e9119ee |
+++ b/policy/modules/apps/mozilla.fc
|
|
|
e9119ee |
@@ -4,6 +4,11 @@ HOME_DIR/\.mozilla(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
HOME_DIR/\.thunderbird(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
HOME_DIR/\.netscape(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
+HOME_DIR/\.adobe(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
+HOME_DIR/\.macromedia(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
+HOME_DIR/\.gnash(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
+HOME_DIR/\.gcjwebplugin(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
+HOME_DIR/\.icedteaplugin(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
3c81e30 |
|
|
|
e9119ee |
#
|
|
|
e9119ee |
# /bin
|
|
|
e9119ee |
@@ -15,6 +20,9 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
/usr/bin/epiphany -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
|
|
e9119ee |
/usr/bin/mozilla-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
|
|
e9119ee |
/usr/bin/mozilla-bin-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
|
|
e9119ee |
+/usr/bin/nspluginscan -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
|
|
e9119ee |
+/usr/bin/nspluginviewer -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
|
|
e9119ee |
+/usr/lib/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
|
|
3c81e30 |
|
|
|
e9119ee |
#
|
|
|
e9119ee |
# /lib
|
|
|
e9119ee |
@@ -27,4 +35,9 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
|
|
e9119ee |
/usr/lib/firefox[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
|
|
e9119ee |
/usr/lib/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
|
|
e9119ee |
/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
/usr/lib/xulrunner[^/]*/plugin-container -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+/usr/lib/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:mozilla_plugin_rw_t,s0)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0)
|
|
|
e9119ee |
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
|
|
|
e9119ee |
index b9b8ac2..aa15d05 100644
|
|
|
e9119ee |
--- a/policy/modules/apps/mozilla.if
|
|
|
e9119ee |
+++ b/policy/modules/apps/mozilla.if
|
|
|
e9119ee |
@@ -208,10 +208,12 @@ interface(`mozilla_domtrans',`
|
|
|
e9119ee |
interface(`mozilla_domtrans_plugin',`
|
|
|
e9119ee |
gen_require(`
|
|
|
e9119ee |
type mozilla_plugin_t, mozilla_plugin_exec_t;
|
|
|
e9119ee |
+ type mozilla_plugin_config_t, mozilla_plugin_config_exec_t;
|
|
|
e9119ee |
class dbus send_msg;
|
|
|
e9119ee |
')
|
|
|
3c81e30 |
|
|
|
e9119ee |
domtrans_pattern($1, mozilla_plugin_exec_t, mozilla_plugin_t)
|
|
|
e9119ee |
+ domtrans_pattern($1, mozilla_plugin_config_exec_t, mozilla_plugin_config_t)
|
|
|
e9119ee |
allow mozilla_plugin_t $1:process signull;
|
|
|
e9119ee |
allow $1 mozilla_plugin_t:unix_stream_socket { connectto rw_socket_perms };
|
|
|
e9119ee |
allow $1 mozilla_plugin_t:fd use;
|
|
|
e9119ee |
@@ -247,6 +249,7 @@ interface(`mozilla_run_plugin',`
|
|
|
3c81e30 |
|
|
|
e9119ee |
mozilla_domtrans_plugin($1)
|
|
|
e9119ee |
role $2 types mozilla_plugin_t;
|
|
|
e9119ee |
+ role $2 types mozilla_plugin_config_t;
|
|
|
3c81e30 |
')
|
|
|
3c81e30 |
|
|
|
e9119ee |
#######################################
|
|
|
e9119ee |
@@ -266,6 +269,7 @@ interface(`mozilla_role_plugin',`
|
|
|
e9119ee |
')
|
|
|
3c81e30 |
|
|
|
e9119ee |
role $1 types mozilla_plugin_t;
|
|
|
e9119ee |
+ role $1 types mozilla_plugin_config_t;
|
|
|
e9119ee |
')
|
|
|
3c81e30 |
|
|
|
e9119ee |
########################################
|
|
|
e9119ee |
@@ -360,3 +364,23 @@ interface(`mozilla_plugin_dontaudit_leaks',`
|
|
|
f1bc73d |
|
|
|
e9119ee |
dontaudit $1 mozilla_plugin_t:unix_stream_socket { read write };
|
|
|
f1bc73d |
')
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+########################################
|
|
|
e9119ee |
+## <summary>
|
|
|
e9119ee |
+## Create, read, write, and delete
|
|
|
e9119ee |
+## mozilla_plugin rw files.
|
|
|
e9119ee |
+## </summary>
|
|
|
e9119ee |
+## <param name="domain">
|
|
|
e9119ee |
+## <summary>
|
|
|
e9119ee |
+## Domain allowed access.
|
|
|
e9119ee |
+## </summary>
|
|
|
e9119ee |
+## </param>
|
|
|
e9119ee |
+#
|
|
|
e9119ee |
+interface(`mozilla_plugin_manage_rw_files',`
|
|
|
e9119ee |
+ gen_require(`
|
|
|
e9119ee |
+ type mozilla_plugin_rw_t;
|
|
|
e9119ee |
+ ')
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+ allow $1 mozilla_plugin_rw_t:file manage_file_perms;
|
|
|
e9119ee |
+ allow $1 mozilla_plugin_rw_t:dir rw_dir_perms;
|
|
|
e9119ee |
+')
|
|
|
e9119ee |
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
|
|
|
e9119ee |
index 75d0b62..344f2e4 100644
|
|
|
e9119ee |
--- a/policy/modules/apps/mozilla.te
|
|
|
e9119ee |
+++ b/policy/modules/apps/mozilla.te
|
|
|
e9119ee |
@@ -23,7 +23,7 @@ type mozilla_conf_t;
|
|
|
e9119ee |
files_config_file(mozilla_conf_t)
|
|
|
e9119ee |
|
|
|
e9119ee |
type mozilla_home_t;
|
|
|
e9119ee |
-typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
|
|
|
e9119ee |
+typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t nsplugin_home_t };
|
|
|
e9119ee |
typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
|
|
|
e9119ee |
files_poly_member(mozilla_home_t)
|
|
|
e9119ee |
userdom_user_home_content(mozilla_home_t)
|
|
|
e9119ee |
@@ -43,6 +43,13 @@ userdom_user_tmpfs_content(mozilla_plugin_tmpfs_t)
|
|
|
e9119ee |
files_tmpfs_file(mozilla_plugin_tmpfs_t)
|
|
|
e9119ee |
ubac_constrained(mozilla_plugin_tmpfs_t)
|
|
|
e9119ee |
|
|
|
e9119ee |
+type mozilla_plugin_rw_t alias nsplugin_rw_t;
|
|
|
e9119ee |
+files_type(mozilla_plugin_rw_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+type mozilla_plugin_config_t;
|
|
|
e9119ee |
+type mozilla_plugin_config_exec_t;
|
|
|
e9119ee |
+application_domain(mozilla_plugin_config_t, mozilla_plugin_config_exec_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
type mozilla_tmp_t;
|
|
|
e9119ee |
files_tmp_file(mozilla_tmp_t)
|
|
|
e9119ee |
ubac_constrained(mozilla_tmp_t)
|
|
|
e9119ee |
@@ -280,11 +287,6 @@ optional_policy(`
|
|
|
f1bc73d |
')
|
|
|
f1bc73d |
|
|
|
f1bc73d |
optional_policy(`
|
|
|
e9119ee |
- nsplugin_manage_rw(mozilla_t)
|
|
|
e9119ee |
- nsplugin_manage_home_files(mozilla_t)
|
|
|
3c81e30 |
-')
|
|
|
3c81e30 |
-
|
|
|
3c81e30 |
-optional_policy(`
|
|
|
e9119ee |
pulseaudio_exec(mozilla_t)
|
|
|
e9119ee |
pulseaudio_stream_connect(mozilla_t)
|
|
|
e9119ee |
pulseaudio_manage_home_files(mozilla_t)
|
|
|
e9119ee |
@@ -330,6 +332,10 @@ manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plug
|
|
|
e9119ee |
manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
|
|
|
e9119ee |
fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
|
|
|
e9119ee |
|
|
|
e9119ee |
+allow mozilla_plugin_t mozilla_plugin_rw_t:dir list_dir_perms;
|
|
|
e9119ee |
+read_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
|
|
|
e9119ee |
+read_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
can_exec(mozilla_plugin_t, mozilla_exec_t)
|
|
|
f1bc73d |
|
|
|
e9119ee |
kernel_read_kernel_sysctls(mozilla_plugin_t)
|
|
|
e9119ee |
@@ -452,17 +458,6 @@ optional_policy(`
|
|
|
f1bc73d |
')
|
|
|
f1bc73d |
|
|
|
e9119ee |
optional_policy(`
|
|
|
e9119ee |
- nsplugin_domtrans(mozilla_plugin_t)
|
|
|
e9119ee |
- nsplugin_rw_exec(mozilla_plugin_t)
|
|
|
e9119ee |
- nsplugin_manage_home_dirs(mozilla_plugin_t)
|
|
|
e9119ee |
- nsplugin_manage_home_files(mozilla_plugin_t)
|
|
|
e9119ee |
- nsplugin_user_home_dir_filetrans(mozilla_plugin_t, dir)
|
|
|
e9119ee |
- nsplugin_user_home_filetrans(mozilla_plugin_t, file)
|
|
|
e9119ee |
- nsplugin_read_rw_files(mozilla_plugin_t);
|
|
|
e9119ee |
- nsplugin_signal(mozilla_plugin_t)
|
|
|
3c81e30 |
-')
|
|
|
f1bc73d |
-
|
|
|
e9119ee |
-optional_policy(`
|
|
|
e9119ee |
pulseaudio_exec(mozilla_plugin_t)
|
|
|
e9119ee |
pulseaudio_stream_connect(mozilla_plugin_t)
|
|
|
e9119ee |
pulseaudio_setattr_home_dir(mozilla_plugin_t)
|
|
|
e9119ee |
@@ -491,3 +486,61 @@ optional_policy(`
|
|
|
e9119ee |
xserver_append_xdm_home_files(mozilla_plugin_t);
|
|
|
3c81e30 |
')
|
|
|
f1bc73d |
|
|
|
e9119ee |
+########################################
|
|
|
e9119ee |
+#
|
|
|
e9119ee |
+# mozilla_plugin_config local policy
|
|
|
e9119ee |
+#
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+allow mozilla_plugin_config_t self:capability { dac_override dac_read_search sys_nice setuid setgid };
|
|
|
e9119ee |
+allow mozilla_plugin_config_t self:process { setsched signal_perms getsched execmem };
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+allow mozilla_plugin_config_t self:fifo_file rw_file_perms;
|
|
|
e9119ee |
+allow mozilla_plugin_config_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+manage_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+dev_search_sysfs(mozilla_plugin_config_t)
|
|
|
e9119ee |
+dev_read_urand(mozilla_plugin_config_t)
|
|
|
e9119ee |
+dev_dontaudit_read_rand(mozilla_plugin_config_t)
|
|
|
e9119ee |
+dev_dontaudit_rw_dri(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+fs_search_auto_mountpoints(mozilla_plugin_config_t)
|
|
|
e9119ee |
+fs_list_inotifyfs(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+can_exec(mozilla_plugin_config_t, mozilla_plugin_rw_t)
|
|
|
e9119ee |
+manage_dirs_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
|
|
|
e9119ee |
+manage_files_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
|
|
|
e9119ee |
+manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+manage_dirs_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t)
|
|
|
e9119ee |
+manage_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t)
|
|
|
e9119ee |
+manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+corecmd_exec_bin(mozilla_plugin_config_t)
|
|
|
e9119ee |
+corecmd_exec_shell(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+kernel_read_system_state(mozilla_plugin_config_t)
|
|
|
e9119ee |
+kernel_request_load_module(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+domain_use_interactive_fds(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+files_read_etc_files(mozilla_plugin_config_t)
|
|
|
e9119ee |
+files_read_usr_files(mozilla_plugin_config_t)
|
|
|
e9119ee |
+files_dontaudit_search_home(mozilla_plugin_config_t)
|
|
|
e9119ee |
+files_list_tmp(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+auth_use_nsswitch(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+miscfiles_read_localization(mozilla_plugin_config_t)
|
|
|
e9119ee |
+miscfiles_read_fonts(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+userdom_search_user_home_content(mozilla_plugin_config_t)
|
|
|
e9119ee |
+userdom_read_user_home_content_symlinks(mozilla_plugin_config_t)
|
|
|
e9119ee |
+userdom_read_user_home_content_files(mozilla_plugin_config_t)
|
|
|
e9119ee |
+userdom_dontaudit_search_admin_dir(mozilla_plugin_config_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+domtrans_pattern(mozilla_plugin_config_t, mozilla_plugin_exec_t, mozilla_plugin_t)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+optional_policy(`
|
|
|
e9119ee |
+ xserver_use_user_fonts(mozilla_plugin_config_t)
|
|
|
e9119ee |
+')
|
|
|
e9119ee |
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
|
|
|
e9119ee |
index 39b1056..cc3f02e 100644
|
|
|
e9119ee |
--- a/policy/modules/kernel/devices.if
|
|
|
e9119ee |
+++ b/policy/modules/kernel/devices.if
|
|
|
e9119ee |
@@ -4176,6 +4176,30 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
|
|
|
f1bc73d |
|
|
|
e9119ee |
########################################
|
|
|
e9119ee |
## <summary>
|
|
|
e9119ee |
+## Read cpu online hardware state information.
|
|
|
e9119ee |
+## </summary>
|
|
|
e9119ee |
+## <desc>
|
|
|
e9119ee |
+##
|
|
|
e9119ee |
+## Allow the specified domain to read /sys/devices/system/cpu/online file.
|
|
|
e9119ee |
+##
|
|
|
e9119ee |
+## </desc>
|
|
|
e9119ee |
+## <param name="domain">
|
|
|
e9119ee |
+## <summary>
|
|
|
e9119ee |
+## Domain allowed access.
|
|
|
e9119ee |
+## </summary>
|
|
|
e9119ee |
+## </param>
|
|
|
e9119ee |
+#
|
|
|
e9119ee |
+interface(`dev_read_cpu_online',`
|
|
|
e9119ee |
+ gen_require(`
|
|
|
e9119ee |
+ type cpu_online_t;
|
|
|
e9119ee |
+ ')
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+ dev_search_sysfs($1)
|
|
|
e9119ee |
+ read_files_pattern($1, cpu_online_t, cpu_online_t)
|
|
|
e9119ee |
+')
|
|
|
e9119ee |
+
|
|
|
e9119ee |
+########################################
|
|
|
e9119ee |
+## <summary>
|
|
|
e9119ee |
## Read hardware state information.
|
|
|
e9119ee |
## </summary>
|
|
|
e9119ee |
## <desc>
|
|
|
e9119ee |
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
|
|
|
e9119ee |
index 1c2562c..112bebb 100644
|
|
|
e9119ee |
--- a/policy/modules/kernel/devices.te
|
|
|
e9119ee |
+++ b/policy/modules/kernel/devices.te
|
|
|
e9119ee |
@@ -225,6 +225,10 @@ files_mountpoint(sysfs_t)
|
|
|
e9119ee |
fs_type(sysfs_t)
|
|
|
e9119ee |
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
|
|
|
e9119ee |
|
|
|
e9119ee |
+type cpu_online_t;
|
|
|
e9119ee |
+allow cpu_online_t sysfs_t:filesystem associate;
|
|
|
e9119ee |
+genfscon sysfs /devices/system/cpu/online gen_context(system_u:object_r:cpu_online_t,s0)
|
|
|
e9119ee |
+
|
|
|
e9119ee |
#
|
|
|
e9119ee |
# Type for /dev/tpm
|
|
|
e9119ee |
#
|
|
|
e9119ee |
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
|
|
|
e9119ee |
index f9a1bcc..a478431 100644
|
|
|
e9119ee |
--- a/policy/modules/kernel/domain.te
|
|
|
e9119ee |
+++ b/policy/modules/kernel/domain.te
|
|
|
e9119ee |
@@ -115,6 +115,7 @@ kernel_dontaudit_search_debugfs(domain)
|
|
|
e9119ee |
allow domain self:process { fork getsched sigchld };
|
|
|
e9119ee |
|
|
|
e9119ee |
# Use trusted objects in /dev
|
|
|
e9119ee |
+dev_read_cpu_online(domain)
|
|
|
e9119ee |
dev_rw_null(domain)
|
|
|
e9119ee |
dev_rw_zero(domain)
|
|
|
e9119ee |
term_use_controlling_term(domain)
|
|
|
e9119ee |
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
|
|
|
e9119ee |
index 11ad8fb..35524d6 100644
|
|
|
e9119ee |
--- a/policy/modules/roles/unconfineduser.te
|
|
|
e9119ee |
+++ b/policy/modules/roles/unconfineduser.te
|
|
|
e9119ee |
@@ -8,13 +8,6 @@ attribute unconfined_login_domain;
|
|
|
f1bc73d |
|
|
|
e9119ee |
## <desc>
|
|
|
e9119ee |
##
|
|
|
e9119ee |
-## allow unconfined users to transition to the nsplugin domains when running nspluginviewer
|
|
|
e9119ee |
-##
|
|
|
e9119ee |
-## </desc>
|
|
|
e9119ee |
-gen_tunable(allow_unconfined_nsplugin_transition, false)
|
|
|
3c81e30 |
-
|
|
|
e9119ee |
-## <desc>
|
|
|
e9119ee |
-##
|
|
|
e9119ee |
## allow unconfined users to transition to the chrome sandbox domains when running chrome-sandbox
|
|
|
e9119ee |
##
|
|
|
e9119ee |
## </desc>
|
|
|
e9119ee |
@@ -128,14 +121,6 @@ optional_policy(`
|
|
|
e9119ee |
attribute unconfined_usertype;
|
|
|
e9119ee |
')
|
|
|
f1bc73d |
|
|
|
e9119ee |
- nsplugin_role_notrans(unconfined_r, unconfined_usertype)
|
|
|
e9119ee |
- optional_policy(`
|
|
|
e9119ee |
- tunable_policy(`allow_unconfined_nsplugin_transition',`
|
|
|
e9119ee |
- nsplugin_domtrans(unconfined_usertype)
|
|
|
e9119ee |
- nsplugin_domtrans_config(unconfined_usertype)
|
|
|
3c81e30 |
- ')
|
|
|
3c81e30 |
- ')
|
|
|
3c81e30 |
-
|
|
|
e9119ee |
optional_policy(`
|
|
|
e9119ee |
abrt_dbus_chat(unconfined_usertype)
|
|
|
e9119ee |
abrt_run_helper(unconfined_usertype, unconfined_r)
|
|
|
e9119ee |
diff --git a/policy/modules/roles/xguest.te b/policy/modules/roles/xguest.te
|
|
|
e9119ee |
index 6f176f9..0258e24 100644
|
|
|
e9119ee |
--- a/policy/modules/roles/xguest.te
|
|
|
e9119ee |
+++ b/policy/modules/roles/xguest.te
|
|
|
e9119ee |
@@ -117,10 +117,6 @@ optional_policy(`
|
|
|
3c81e30 |
')
|
|
|
3c81e30 |
|
|
|
e9119ee |
optional_policy(`
|
|
|
e9119ee |
- nsplugin_role(xguest_r, xguest_t)
|
|
|
3c81e30 |
-')
|
|
|
3c81e30 |
-
|
|
|
e9119ee |
-optional_policy(`
|
|
|
e9119ee |
pcscd_read_pub_files(xguest_usertype)
|
|
|
e9119ee |
pcscd_stream_connect(xguest_usertype)
|
|
|
e9119ee |
')
|
|
|
e9119ee |
diff --git a/policy/modules/services/abrt.te b/policy/modules/services/abrt.te
|
|
|
e9119ee |
index d5a9038..a1cbdb4 100644
|
|
|
e9119ee |
--- a/policy/modules/services/abrt.te
|
|
|
e9119ee |
+++ b/policy/modules/services/abrt.te
|
|
|
e9119ee |
@@ -208,11 +208,6 @@ optional_policy(`
|
|
|
f1bc73d |
')
|
|
|
f1bc73d |
|
|
|
f1bc73d |
optional_policy(`
|
|
|
e9119ee |
- nsplugin_read_rw_files(abrt_t)
|
|
|
e9119ee |
- nsplugin_read_home(abrt_t)
|
|
|
f1bc73d |
-')
|
|
|
f1bc73d |
-
|
|
|
e9119ee |
-optional_policy(`
|
|
|
e9119ee |
policykit_dbus_chat(abrt_t)
|
|
|
e9119ee |
policykit_domtrans_auth(abrt_t)
|
|
|
e9119ee |
policykit_read_lib(abrt_t)
|
|
|
3c81e30 |
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
|
|
e9119ee |
index 0b3811d..0281618 100644
|
|
|
3c81e30 |
--- a/policy/modules/system/userdomain.if
|
|
|
3c81e30 |
+++ b/policy/modules/system/userdomain.if
|
|
|
e9119ee |
@@ -787,10 +787,6 @@ template(`userdom_common_user_template',`
|
|
|
3c81e30 |
')
|
|
|
3c81e30 |
|
|
|
3c81e30 |
optional_policy(`
|
|
|
e9119ee |
- nsplugin_role($1_r, $1_usertype)
|
|
|
f1bc73d |
- ')
|
|
|
f1bc73d |
-
|
|
|
f1bc73d |
- optional_policy(`
|
|
|
e9119ee |
tunable_policy(`allow_user_mysql_connect',`
|
|
|
e9119ee |
mysql_stream_connect($1_t)
|
|
|
e9119ee |
')
|