Local policy from newrole denials

selinux_local.te (text/plain), 1.25 KB, created by jack_mort on 2016-09-03 15:14:29 UTC

module selinux_local 1.0;

require {
	type devlog_t;
	type staff_t;
	type sysadm_t;
	type syslogd_t;
	type proc_t;
	type chkpwd_t;
	type user_devpts_t;
	class chr_file { relabelfrom relabelto };
	class dir mounton;
	class unix_dgram_socket sendto;
	class netlink_audit_socket { create nlmsg_relay read write };
	class capability { audit_write setuid sys_admin };
	class sock_file write;
	class filesystem mount;
	class process { noatsecure rlimitinh setexec siginh transition };
}

#============= staff_t ==============
allow staff_t devlog_t:sock_file write;
allow staff_t self:capability { setuid audit_write };
allow staff_t self:netlink_audit_socket { create nlmsg_relay read write };
allow staff_t user_devpts_t:chr_file { relabelfrom relabelto };
allow staff_t self:netlink_audit_socket write;
allow staff_t syslogd_t:unix_dgram_socket sendto;
allow staff_t self:process setexec;
allow staff_t sysadm_t:process { noatsecure rlimitinh siginh transition };

#============= sysadm_t ==============
allow sysadm_t self:capability audit_write;
allow sysadm_t self:netlink_audit_socket { create nlmsg_relay read write };

#============= chkpwd_t ==============
allow chkpwd_t proc_t:dir mounton;
allow chkpwd_t proc_t:filesystem mount;
allow chkpwd_t self:capability sys_admin;