diff --git a/repos/aimee-os/sec-policy/selinux-aimee-os/files/aimee-os.te b/repos/aimee-os/sec-policy/selinux-aimee-os/files/aimee-os.te index 5cce26a..9e132b1 100644 --- a/repos/aimee-os/sec-policy/selinux-aimee-os/files/aimee-os.te +++ b/repos/aimee-os/sec-policy/selinux-aimee-os/files/aimee-os.te @@ -71,76 +71,22 @@ seutil_domtrans_setfiles(aimee_storinit_t) kernel_manage_unlabeled_dirs(aimee_storinit_t) +files_manage_non_security_dirs(aimee_storinit_t) +files_relabel_non_security_dirs(aimee_storinit_t) +files_manage_non_security_files(aimee_storinit_t) +files_relabel_non_security_files(aimee_storinit_t) +logging_manage_audit_log(aimee_storinit_t) +gen_require(` + attribute non_security_file_type; +') +manage_lnk_files_pattern(aimee_storinit_t, non_security_file_type, non_security_file_type) +relabel_lnk_files_pattern(aimee_storinit_t, non_security_file_type, non_security_file_type) + auth_manage_shadow(aimee_storinit_t) auth_relabel_shadow(aimee_storinit_t) - -files_manage_var_dirs(aimee_storinit_t) -files_relabel_var_dirs(aimee_storinit_t) -files_manage_var_files(aimee_storinit_t) -files_manage_var_symlinks(aimee_storinit_t) - gen_require(` - type var_lib_t, var_lock_t, var_run_t; - type semanage_store_t; - type semanage_read_lock_t, semanage_trans_lock_t; - type system_dbusd_var_lib_t; - type init_var_lib_t; - type auditd_log_t; - type tmp_t; - type etc_t; type shadow_t; - attribute logfile; ') -manage_dirs_pattern(aimee_storinit_t, var_lib_t, var_lib_t) -relabel_dirs_pattern(aimee_storinit_t, var_lib_t, var_lib_t) -manage_files_pattern(aimee_storinit_t, var_lib_t, var_lib_t) -relabel_files_pattern(aimee_storinit_t, var_lib_t, var_lib_t) -manage_lnk_files_pattern(aimee_storinit_t, var_lib_t, var_lib_t) -relabel_lnk_files_pattern(aimee_storinit_t, var_lib_t, var_lib_t) -manage_lnk_files_pattern(aimee_storinit_t, var_lock_t, var_lock_t) -relabel_lnk_files_pattern(aimee_storinit_t, var_lock_t, var_lock_t) -manage_dirs_pattern(aimee_storinit_t, var_run_t, var_run_t) -relabel_dirs_pattern(aimee_storinit_t, var_run_t, var_run_t) -manage_files_pattern(aimee_storinit_t, var_run_t, var_run_t) -relabel_files_pattern(aimee_storinit_t, var_run_t, var_run_t) -manage_lnk_files_pattern(aimee_storinit_t, var_run_t, var_run_t) -relabel_lnk_files_pattern(aimee_storinit_t, var_run_t, var_run_t) -manage_dirs_pattern(aimee_storinit_t, semanage_store_t, semanage_store_t) -relabel_dirs_pattern(aimee_storinit_t, semanage_store_t, semanage_store_t) -manage_files_pattern(aimee_storinit_t, semanage_store_t, semanage_store_t) -relabel_files_pattern(aimee_storinit_t, semanage_store_t, semanage_store_t) -manage_dirs_pattern(aimee_storinit_t, semanage_read_lock_t, semanage_read_lock_t) -relabel_dirs_pattern(aimee_storinit_t, semanage_read_lock_t, semanage_read_lock_t) -manage_files_pattern(aimee_storinit_t, semanage_read_lock_t, semanage_read_lock_t) -relabel_files_pattern(aimee_storinit_t, semanage_read_lock_t, semanage_read_lock_t) -manage_dirs_pattern(aimee_storinit_t, semanage_trans_lock_t, semanage_trans_lock_t) -relabel_dirs_pattern(aimee_storinit_t, semanage_trans_lock_t, semanage_trans_lock_t) -manage_files_pattern(aimee_storinit_t, semanage_trans_lock_t, semanage_trans_lock_t) -relabel_files_pattern(aimee_storinit_t, semanage_trans_lock_t, semanage_trans_lock_t) -manage_dirs_pattern(aimee_storinit_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t) -relabel_dirs_pattern(aimee_storinit_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t) -manage_files_pattern(aimee_storinit_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t) -relabel_files_pattern(aimee_storinit_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t) -manage_lnk_files_pattern(aimee_storinit_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t) -relabel_lnk_files_pattern(aimee_storinit_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t) -manage_dirs_pattern(aimee_storinit_t, init_var_lib_t, init_var_lib_t) -relabel_dirs_pattern(aimee_storinit_t, init_var_lib_t, init_var_lib_t) -manage_files_pattern(aimee_storinit_t, init_var_lib_t, init_var_lib_t) -relabel_files_pattern(aimee_storinit_t, init_var_lib_t, init_var_lib_t) -manage_dirs_pattern(aimee_storinit_t, logfile, logfile) -relabel_dirs_pattern(aimee_storinit_t, logfile, logfile) -manage_files_pattern(aimee_storinit_t, logfile, logfile) -relabel_files_pattern(aimee_storinit_t, logfile, logfile) -manage_dirs_pattern(aimee_storinit_t, auditd_log_t, auditd_log_t) -relabel_dirs_pattern(aimee_storinit_t, auditd_log_t, auditd_log_t) -manage_files_pattern(aimee_storinit_t, auditd_log_t, auditd_log_t) -relabel_files_pattern(aimee_storinit_t, auditd_log_t, auditd_log_t) -manage_dirs_pattern(aimee_storinit_t, tmp_t, tmp_t) -relabel_dirs_pattern(aimee_storinit_t, tmp_t, tmp_t) -manage_files_pattern(aimee_storinit_t, tmp_t, tmp_t) -relabel_files_pattern(aimee_storinit_t, tmp_t, tmp_t) -manage_dirs_pattern(aimee_storinit_t, etc_t, etc_t) -relabel_dirs_pattern(aimee_storinit_t, etc_t, etc_t) allow aimee_storinit_t shadow_t:file mounton; ########################################