1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
## <summary>GNU terminal multiplexer.</summary>
#######################################
## <summary>
## The role template for the screen module.
## </summary>
## <param name="role_prefix">
## <summary>
## The prefix of the user role (e.g., user
## is the prefix for user_r).
## </summary>
## </param>
## <param name="user_role">
## <summary>
## The role associated with the user domain.
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## The type of the user domain.
## </summary>
## </param>
#
template(`screen_role_template',`
gen_require(`
attribute screen_domain;
attribute_role screen_roles;
type screen_exec_t, screen_tmp_t;
type screen_home_t, screen_runtime_t;
')
########################################
#
# Declarations
#
type $1_screen_t, screen_domain;
userdom_user_application_domain($1_screen_t, screen_exec_t)
domain_interactive_fd($1_screen_t)
role screen_roles types $1_screen_t;
roleattribute $2 screen_roles;
########################################
#
# Local policy
#
dontaudit $1_screen_t self:capability sys_tty_config;
domtrans_pattern($3, screen_exec_t, $1_screen_t)
ps_process_pattern($3, $1_screen_t)
allow $3 $1_screen_t:process { ptrace signal_perms };
dontaudit $3 $1_screen_t:unix_stream_socket { read write };
allow $1_screen_t $3:process signal;
allow $3 screen_tmp_t:dir { manage_dir_perms relabel_dir_perms };
allow $3 screen_tmp_t:file { manage_file_perms relabel_file_perms };
allow $3 screen_tmp_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
allow $3 screen_home_t:dir { manage_dir_perms relabel_dir_perms };
allow $3 screen_home_t:file { manage_file_perms relabel_file_perms };
allow $3 screen_home_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
allow $3 screen_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
userdom_user_home_dir_filetrans($3, screen_home_t, dir, ".screen")
userdom_user_home_dir_filetrans($3, screen_home_t, file, ".screenrc")
userdom_user_home_dir_filetrans($3, screen_home_t, file, ".tmux.conf")
manage_dirs_pattern($3, screen_runtime_t, screen_runtime_t)
manage_files_pattern($3, screen_runtime_t, screen_runtime_t)
manage_lnk_files_pattern($3, screen_runtime_t, screen_runtime_t)
manage_fifo_files_pattern($3, screen_runtime_t, screen_runtime_t)
corecmd_bin_domtrans($1_screen_t, $3)
corecmd_shell_domtrans($1_screen_t, $3)
auth_domtrans_chk_passwd($1_screen_t)
auth_use_nsswitch($1_screen_t)
userdom_user_home_domtrans($1_screen_t, $3)
tunable_policy(`use_samba_home_dirs',`
fs_cifs_domtrans($1_screen_t, $3)
')
tunable_policy(`use_nfs_home_dirs',`
fs_nfs_domtrans($1_screen_t, $3)
')
')
|
