336 lines
12 KiB
Text
336 lines
12 KiB
Text
|
|
#
|
|
# /
|
|
#
|
|
/.* gen_context(system_u:object_r:default_t,s0)
|
|
/ -d gen_context(system_u:object_r:root_t,s0)
|
|
/\.journal <<none>>
|
|
/afs -d gen_context(system_u:object_r:mnt_t,s0)
|
|
/initrd\.img.* -l gen_context(system_u:object_r:boot_t,s0)
|
|
/vmlinuz.* -l gen_context(system_u:object_r:boot_t,s0)
|
|
|
|
ifdef(`distro_redhat',`
|
|
/\.autofsck -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/\.autorelabel -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/\.suspended -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/efi(/.*)? gen_context(system_u:object_r:boot_t,s0)
|
|
/fastboot -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/forcefsck -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/fsckoptions -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/halt -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/poweroff -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
')
|
|
|
|
ifdef(`distro_suse',`
|
|
/success -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
')
|
|
|
|
#
|
|
# /boot
|
|
#
|
|
/boot gen_context(system_u:object_r:boot_t,s0)
|
|
/boot/.* gen_context(system_u:object_r:boot_t,s0)
|
|
/boot/\.journal <<none>>
|
|
/boot/efi(/.*)?/System\.map(-.*)? -- gen_context(system_u:object_r:system_map_t,s0)
|
|
/boot/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
/boot/lost\+found/.* <<none>>
|
|
/boot/System\.map(-.*)? -- gen_context(system_u:object_r:system_map_t,s0)
|
|
|
|
#
|
|
# /emul
|
|
#
|
|
/emul gen_context(system_u:object_r:usr_t,s0)
|
|
/emul/.* gen_context(system_u:object_r:usr_t,s0)
|
|
|
|
#
|
|
# /etc
|
|
#
|
|
/etc gen_context(system_u:object_r:etc_t,s0)
|
|
/etc/.* gen_context(system_u:object_r:etc_t,s0)
|
|
/etc/\.fstab\.hal\..+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/\.updated -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/blkid(/.*)? gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/cmtab -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/fstab\.REVOKE -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/ioctl\.save -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/mtab.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/securetty -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
|
|
/etc/sysctl\.conf(\.old)? -- gen_context(system_u:object_r:system_conf_t,s0)
|
|
/etc/sysconfig/ebtables.* -- gen_context(system_u:object_r:system_conf_t,s0)
|
|
/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:system_conf_t,s0)
|
|
/etc/sysconfig/ip6?tables\.save -- gen_context(system_u:object_r:system_conf_t,s0)
|
|
/etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0)
|
|
/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0)
|
|
/etc/yum\.repos\.d(/.*)? gen_context(system_u:object_r:system_conf_t,s0)
|
|
/etc/ostree/remotes.d(/.*)? gen_context(system_u:object_r:system_conf_t,s0)
|
|
|
|
/ostree/repo(/.*)? gen_context(system_u:object_r:system_conf_t,s0)
|
|
/ostree/deploy/rhel-atomic-host/deploy(/.*)? gen_context(system_u:object_r:system_conf_t,s0)
|
|
|
|
/etc/cups/client\.conf -- gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/etc/ipsec\.d/examples(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/etc/network/ifstate -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
|
|
/etc/ptal/ptal-printd-like -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
|
|
/etc/sysconfig/hwconf -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
|
|
/etc/xorg\.conf\.d/00-system-setup-keyboard\.conf -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/X11/xorg\.conf\.d/00-system-setup-keyboard\.conf -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
|
|
|
|
ifdef(`distro_gentoo', `
|
|
/etc/profile\.env -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/csh\.env -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/env\.d/.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
')
|
|
|
|
ifdef(`distro_suse',`
|
|
/etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
')
|
|
|
|
#
|
|
# HOME_ROOT
|
|
# expanded by genhomedircon
|
|
#
|
|
HOME_ROOT -d gen_context(system_u:object_r:home_root_t,s0-mls_systemhigh)
|
|
HOME_ROOT/home-inst -d gen_context(system_u:object_r:home_root_t,s0-mls_systemhigh)
|
|
HOME_ROOT/\-inst -d gen_context(system_u:object_r:home_root_t,s0-mls_systemhigh)
|
|
HOME_ROOT -l gen_context(system_u:object_r:home_root_t,s0)
|
|
HOME_ROOT/\.journal <<none>>
|
|
HOME_ROOT/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
HOME_ROOT/lost\+found/.* <<none>>
|
|
|
|
# HOME_ROOT is where user HOME dirs reside as per /etc/default/useradd, but
|
|
# there may be a compat symlink from /home to HOME_ROOT. We want to make sure
|
|
# that symlink itself is always labeled home_root_t so that e.g. systemd can
|
|
# getattr as it follows it.
|
|
/home -l gen_context(system_u:object_r:home_root_t,s0)
|
|
|
|
#
|
|
# /initrd
|
|
#
|
|
# initrd mount point, only used during boot
|
|
/initrd -d gen_context(system_u:object_r:root_t,s0)
|
|
|
|
#
|
|
# /lib
|
|
#
|
|
/lib/modules(/.*)? gen_context(system_u:object_r:modules_object_t,s0)
|
|
|
|
ifdef(`distro_debian',`
|
|
# on Debian /lib/init/rw is a tmpfs used like /var/run but
|
|
# before /var is mounted
|
|
/lib/init/rw(/.*)? gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
|
|
')
|
|
|
|
#
|
|
# /lost+found
|
|
#
|
|
/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
/lost\+found/.* <<none>>
|
|
|
|
#
|
|
# /media
|
|
#
|
|
# Mount points; do not relabel subdirectories, since
|
|
# we don't want to change any removable media by default.
|
|
/media(/[^/]*)? -l gen_context(system_u:object_r:mnt_t,s0)
|
|
/media(/[^/]*)? -d gen_context(system_u:object_r:mnt_t,s0)
|
|
/media/[^/]*/.* <<none>>
|
|
/media/\.hal-.* -- gen_context(system_u:object_r:mnt_t,s0)
|
|
/run/media(/[^/]*)? -d gen_context(system_u:object_r:mnt_t,s0)
|
|
/run/media/.* <<none>>
|
|
/var/\.updated -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
|
|
#
|
|
# /misc
|
|
#
|
|
/misc -d gen_context(system_u:object_r:mnt_t,s0)
|
|
|
|
#
|
|
# /mnt
|
|
#
|
|
/mnt(/[^/]*)? -l gen_context(system_u:object_r:mnt_t,s0)
|
|
/mnt(/[^/]*)? -d gen_context(system_u:object_r:mnt_t,s0)
|
|
/mnt/[^/]*/.* <<none>>
|
|
|
|
#
|
|
# /net
|
|
#
|
|
/net -d gen_context(system_u:object_r:mnt_t,s0)
|
|
|
|
#
|
|
# /opt
|
|
#
|
|
/opt gen_context(system_u:object_r:usr_t,s0)
|
|
/opt/.* gen_context(system_u:object_r:usr_t,s0)
|
|
|
|
/opt/(.*/)?etc -d gen_context(system_u:object_r:etc_t,s0)
|
|
/opt/(.*/)?etc/.* gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/opt/(.*/)?var -d gen_context(system_u:object_r:var_t,s0)
|
|
/opt/(.*/)?var/.* gen_context(system_u:object_r:var_t,s0)
|
|
|
|
/opt/(.*/)?var/lib(/.*)? gen_context(system_u:object_r:var_lib_t,s0)
|
|
|
|
#
|
|
# /proc
|
|
#
|
|
/proc/.* <<none>>
|
|
|
|
ifdef(`distro_redhat',`
|
|
/rhev -d gen_context(system_u:object_r:mnt_t,s0)
|
|
/rhev(/[^/]*)? -d gen_context(system_u:object_r:mnt_t,s0)
|
|
/rhev/[^/]*/.* gen_context(system_u:object_r:mnt_t,s0)
|
|
')
|
|
|
|
#
|
|
# /run
|
|
#
|
|
/run -d gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
|
|
/run -l gen_context(system_u:object_r:var_run_t,s0)
|
|
/run/.* gen_context(system_u:object_r:var_run_t,s0)
|
|
/run/.*\.*pid <<none>>
|
|
|
|
/run/lock -d gen_context(system_u:object_r:var_lock_t,s0)
|
|
/run/lock -l gen_context(system_u:object_r:var_lock_t,s0)
|
|
/run/lock/.* <<none>>
|
|
|
|
ifdef(`distro_debian',`
|
|
/run/motd -- gen_context(system_u:object_r:initrc_var_run_t,s0)
|
|
/run/motd\.dynamic -- gen_context(system_u:object_r:initrc_var_run_t,s0)
|
|
')
|
|
|
|
/sandbox(/.*)? gen_context(system_u:object_r:tmp_t,s0)
|
|
#
|
|
# /selinux
|
|
#
|
|
/selinux -d <<none>>
|
|
/selinux/.* <<none>>
|
|
|
|
#
|
|
# /srv
|
|
#
|
|
/srv gen_context(system_u:object_r:var_t,s0)
|
|
/srv/.* gen_context(system_u:object_r:var_t,s0)
|
|
|
|
#
|
|
# /tmp
|
|
#
|
|
/tmp gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
|
|
/tmp-inst gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
|
|
/tmp/.* <<none>>
|
|
/tmp-inst/.* <<none>>
|
|
/tmp/\.journal <<none>>
|
|
|
|
/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
/tmp/lost\+found/.* <<none>>
|
|
|
|
#
|
|
# /usr
|
|
#
|
|
/usr gen_context(system_u:object_r:usr_t,s0)
|
|
/usr/.* gen_context(system_u:object_r:usr_t,s0)
|
|
/usr/\.journal <<none>>
|
|
/export(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
|
/ostree(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
|
|
|
# Note the Fedora kernel moved to /usr/lib/modules. This also relates
|
|
# to(rpm-)ostree related stuff:
|
|
# https://github.com/ostreedev/ostree/pull/1079
|
|
# https://github.com/projectatomic/rpm-ostree/pull/959#issuecomment-325780234
|
|
/usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
|
/usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0)
|
|
/usr/lib/modules(/.*)/initramfs.img -- gen_context(system_u:object_r:usr_t,s0)
|
|
|
|
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
|
|
|
/usr/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/usr/inclu.e(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
|
|
|
/usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
/usr/lost\+found/.* <<none>>
|
|
/usr/lib/modules(/.*)? gen_context(system_u:object_r:modules_object_t,s0)
|
|
|
|
/usr/share/doc(/.*)?/README.* gen_context(system_u:object_r:usr_t,s0)
|
|
|
|
# http://lists.rpm.org/pipermail/rpm-maint/2017-October/006681.html
|
|
/usr/lib/sysimage(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
|
|
|
/usr/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
|
|
/usr/tmp/.* <<none>>
|
|
|
|
ifndef(`distro_redhat',`
|
|
/usr/src(/.*)? gen_context(system_u:object_r:src_t,s0)
|
|
/usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
|
')
|
|
|
|
# Deploy Dell EMC PowerFlex - SDC(scini) driver configuration
|
|
# https://cpsdocs.dellemc.com/bundle/VXF_DEPLOY/page/GUID-DC80A2E9-6B92-46F8-9276-1704B41E148E.html
|
|
/usr/bin/emc/scaleio/(.*)\.ko -- gen_context(system_u:object_r:modules_object_t,s0)
|
|
|
|
#
|
|
# /var
|
|
#
|
|
/var gen_context(system_u:object_r:var_t,s0)
|
|
/var/.* gen_context(system_u:object_r:var_t,s0)
|
|
/var/\.journal <<none>>
|
|
|
|
/var/db(/.*)? gen_context(system_u:object_r:system_db_t,s0)
|
|
|
|
/var/ftp/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/var/named/chroot/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/var/lib(/.*)? gen_context(system_u:object_r:var_lib_t,s0)
|
|
|
|
/var/lib/authselect/backups(/.*)? <<none>>
|
|
|
|
/var/lib/nfs/rpc_pipefs(/.*)? <<none>>
|
|
|
|
/var/lib/stickshift/.stickshift-proxy.d(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
/var/lib/stickshift/.limits.d(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/var/lib/openshift/.openshift-proxy.d(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
/var/lib/openshift/.stickshift-proxy.d(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
/var/lib/openshift/.limits.d(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/var/lib/servicelog/servicelog\.db -- gen_context(system_u:object_r:system_db_t,s0)
|
|
/var/lib/servicelog/servicelog\.db-journal -- gen_context(system_u:object_r:system_db_t,s0)
|
|
|
|
/var/log/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
/var/log/lost\+found/.* <<none>>
|
|
|
|
/var/log/audit/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
/var/log/audit/lost\+found/.* <<none>>
|
|
|
|
/var/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
/var/lost\+found/.* <<none>>
|
|
|
|
/var/spool(/.*)? gen_context(system_u:object_r:var_spool_t,s0)
|
|
/var/spool/postfix/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
|
|
|
|
/var/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
|
|
/var/tmp -l gen_context(system_u:object_r:tmp_t,s0)
|
|
/var/tmp-inst -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
|
|
/var/tmp/tmp-inst -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
|
|
/var/tmp/.* <<none>>
|
|
/var/tmp/tmp-inst/.* <<none>>
|
|
/var/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
|
|
/var/tmp/lost\+found/.* <<none>>
|
|
/var/tmp/vi\.recover -d gen_context(system_u:object_r:tmp_t,s0)
|
|
|
|
/nsr(/.*)? gen_context(system_u:object_r:var_t,s0)
|
|
/nsr/logs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
|
|
|
|
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)? gen_context(system_u:object_r:root_t,s0)
|