summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChris PeBenito <cpebenito@tresys.com>2009-08-31 10:21:01 -0400
committerChris PeBenito <cpebenito@tresys.com>2009-08-31 10:21:01 -0400
commitaac56b12b77153a5314c3cd3f39154d0af9f0876 (patch)
tree7251f777d2d996683cfe05830a34e509a36c0c0b
parenta3dd1499ef08f6f145561181937744d85976c2d0 (diff)
add ptchown policy from dan.
-rw-r--r--policy/modules/apps/ptchown.fc1
-rw-r--r--policy/modules/apps/ptchown.if20
-rw-r--r--policy/modules/apps/ptchown.te31
3 files changed, 52 insertions, 0 deletions
diff --git a/policy/modules/apps/ptchown.fc b/policy/modules/apps/ptchown.fc
new file mode 100644
index 00000000..9fc398e8
--- /dev/null
+++ b/policy/modules/apps/ptchown.fc
@@ -0,0 +1 @@
+/usr/libexec/pt_chown -- gen_context(system_u:object_r:ptchown_exec_t,s0)
diff --git a/policy/modules/apps/ptchown.if b/policy/modules/apps/ptchown.if
new file mode 100644
index 00000000..cc8a359c
--- /dev/null
+++ b/policy/modules/apps/ptchown.if
@@ -0,0 +1,20 @@
+## <summary>helper function for grantpt(3), changes ownship and permissions of pseudotty</summary>
+
+########################################
+## <summary>
+## Execute a domain transition to run ptchown.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ptchown_domtrans',`
+ gen_require(`
+ type ptchown_t, ptchown_exec_t;
+ ')
+
+ domtrans_pattern($1, ptchown_exec_t, ptchown_t)
+')
+
diff --git a/policy/modules/apps/ptchown.te b/policy/modules/apps/ptchown.te
new file mode 100644
index 00000000..6db843e9
--- /dev/null
+++ b/policy/modules/apps/ptchown.te
@@ -0,0 +1,31 @@
+
+policy_module(ptchown, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ptchown_t;
+type ptchown_exec_t;
+application_domain(ptchown_t, ptchown_exec_t)
+role system_r types ptchown_t;
+
+########################################
+#
+# ptchown local policy
+#
+
+allow ptchown_t self:capability { chown fowner fsetid setuid };
+allow ptchown_t self:process { getcap setcap };
+
+files_read_etc_files(ptchown_t)
+
+fs_rw_anon_inodefs_files(ptchown_t)
+
+term_setattr_generic_ptys(ptchown_t)
+term_setattr_all_user_ptys(ptchown_t)
+term_use_generic_ptys(ptchown_t)
+term_use_ptmx(ptchown_t)
+
+miscfiles_read_localization(ptchown_t)