84 lines
1.5 KiB
Text
84 lines
1.5 KiB
Text
|
policy_module(secadm, 2.4.0)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
role secadm_r;
|
||
|
|
|
||
|
|
userdom_confined_admin_template(secadm)
|
||
|
|
userdom_security_admin(secadm_t, secadm_r)
|
||
|
|
userdom_inherit_append_admin_home_files(secadm_t)
|
||
|
|
userdom_read_admin_home_files(secadm_t)
|
||
|
|
userdom_manage_tmp_role(secadm_r, secadm_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow secadm_t self:capability { dac_read_search };
|
||
|
|
|
||
|
|
kernel_read_system_state(secadm_t)
|
||
|
|
|
||
|
|
corecmd_exec_shell(secadm_t)
|
||
|
|
|
||
|
|
dev_relabel_all_dev_nodes(secadm_t)
|
||
|
|
dev_read_urand(secadm_t)
|
||
|
|
|
||
|
|
domain_obj_id_change_exemption(secadm_t)
|
||
|
|
|
||
|
|
mls_process_read_up(secadm_t)
|
||
|
|
mls_file_read_all_levels(secadm_t)
|
||
|
|
mls_file_write_all_levels(secadm_t)
|
||
|
|
mls_file_upgrade(secadm_t)
|
||
|
|
mls_file_downgrade(secadm_t)
|
||
|
|
|
||
|
|
auth_role(secadm_r, secadm_t)
|
||
|
|
files_relabel_all_files(secadm_t)
|
||
|
|
|
||
|
|
init_exec(secadm_t)
|
||
|
|
|
||
|
|
logging_read_audit_log(secadm_t)
|
||
|
|
logging_read_generic_logs(secadm_t)
|
||
|
|
logging_read_audit_config(secadm_t)
|
||
|
|
logging_map_audit_config(secadm_t)
|
||
|
|
logging_map_audit_log(secadm_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
aide_run(secadm_t, secadm_r)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
auditadm_role_change(secadm_r)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
dmesg_exec(secadm_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
netlabel_run_mgmt(secadm_t, secadm_r)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
screen_role_template(secadm, secadm_r, secadm_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
su_role_template(secadm, secadm_r, secadm_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
sudo_role_template(secadm, secadm_r, secadm_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
sysadm_role_change(secadm_r)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
vlock_run(secadm_t, secadm_r)
|
||
|
|
')
|