commit: 3b742fca07833a9b5f5f1d4f2566593f90f6b22f Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be> AuthorDate: Wed Aug 6 09:17:15 2014 +0000 Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> CommitDate: Wed Aug 6 18:08:37 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=3b742fca
Make SELinux configuration a security file type The SELinux configuration should be considered a security-sensitive configuration type and as such should not be made part of the system-wide accesses towards regular files (non_auth/non_security). --- policy/modules/system/selinuxutil.te | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index 48566a4..4d6f5d9 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -28,7 +28,7 @@ roleattribute system_r semanage_roles; # in the domain_type interface # (fix dup decl) type selinux_config_t; -files_type(selinux_config_t) +files_security_file(selinux_config_t) type checkpolicy_t, can_write_binary_policy; type checkpolicy_exec_t; @@ -40,14 +40,14 @@ role system_r types checkpolicy_t; # /etc/selinux/*/contexts/* # type default_context_t; -files_type(default_context_t) +files_security_file(default_context_t) # # file_context_t is the type applied to # /etc/selinux/*/contexts/files # type file_context_t; -files_type(file_context_t) +files_security_file(file_context_t) type load_policy_t; type load_policy_exec_t; @@ -67,7 +67,7 @@ role newrole_roles types newrole_t; # the security server policy configuration. # type policy_config_t; -files_type(policy_config_t) +files_security_file(policy_config_t) neverallow ~can_relabelto_binary_policy policy_config_t:file relabelto; #neverallow ~can_write_binary_policy policy_config_t:file { write append };