Gecko [ 122.154.134.11 ]

Name	Size	Permission
auditadm.if	917 B	-rw-r--r--
dbadm.if	906 B	-rw-r--r--
guest.if	862 B	-rw-r--r--
logadm.if	897 B	-rw-r--r--
secadm.if	927 B	-rw-r--r--
staff.if	866 B	-rw-r--r--
sysadm.if	4.79 KB	-rw-r--r--
sysadm_secadm.if	36 B	-rw-r--r--
unconfineduser.if	14.21 KB	-rw-r--r--
unprivuser.if	885 B	-rw-r--r--
webadm.if	897 B	-rw-r--r--
xguest.if	866 B	-rw-r--r--

Code Editor : sysadm.if

## <summary>General system administration role</summary>

########################################
## <summary>
##	Change to the system administrator role.
## </summary>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`sysadm_role_change',`
	gen_require(`
		role sysadm_r;
	')

allow $1 sysadm_r;
')

########################################
## <summary>
##	Change from the system administrator role.
## </summary>
## <desc>
##	
##	Change from the system administrator role to
##	the specified role.
##	
##	
##	This is an interface to support third party modules
##	and its use is not allowed in upstream reference
##	policy.
##	
## </desc>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`sysadm_role_change_to',`
	gen_require(`
		role sysadm_r;
	')

allow sysadm_r $1;
')

########################################
## <summary>
##	Execute a shell in the sysadm domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`sysadm_shell_domtrans',`
	gen_require(`
		type sysadm_t;
	')

corecmd_shell_domtrans($1, sysadm_t)
	allow sysadm_t $1:fd use;
	allow sysadm_t $1:fifo_file rw_file_perms;
	allow sysadm_t $1:process sigchld;
')

########################################
## <summary>
##	Execute a generic bin program in the sysadm domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`sysadm_bin_spec_domtrans',`
	gen_require(`
		type sysadm_t;
	')

corecmd_bin_spec_domtrans($1, sysadm_t)
	allow sysadm_t $1:fd use;
	allow sysadm_t $1:fifo_file rw_file_perms;
	allow sysadm_t $1:process sigchld;
')

########################################
## <summary>
##	Execute all entrypoint files in the sysadm domain. This
##	is an explicit transition, requiring the
##	caller to use setexeccon().
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`sysadm_entry_spec_domtrans',`
	gen_require(`
		type sysadm_t;
	')

domain_entry_file_spec_domtrans($1, sysadm_t)
	allow sysadm_t $1:fd use;
	allow sysadm_t $1:fifo_file rw_file_perms;
	allow sysadm_t $1:process sigchld;
')

########################################
## <summary>
##	Allow sysadm to execute all entrypoint files in
##	a specified domain. This is an explicit transition,
##	requiring the caller to use setexeccon().
## </summary>
## <desc>
##	
##	Allow sysadm to execute all entrypoint files in
##	a specified domain. This is an explicit transition,
##	requiring the caller to use setexeccon().
##	
##	
##	This is a interface to support third party modules
##	and its use is not allowed in upstream reference
##	policy.
##	
## </desc>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`sysadm_entry_spec_domtrans_to',`
	gen_require(`
		type sysadm_t;
	')

domain_entry_file_spec_domtrans(sysadm_t, $1)
	allow $1 sysadm_t:fd use;
	allow $1 sysadm_t:fifo_file rw_file_perms;
	allow $1 sysadm_t:process sigchld;
')

########################################
## <summary>
##	Allow sysadm to execute a generic bin program in
##	a specified domain. This is an explicit transition,
##	requiring the caller to use setexeccon().
## </summary>
## <desc>
##	
##	Allow sysadm to execute a generic bin program in
##	a specified domain.
##	
##	
##	This is a interface to support third party modules
##	and its use is not allowed in upstream reference
##	policy.
##	
## </desc>
## <param name="domain">
##	<summary>
##	Domain to execute in.
##	</summary>
## </param>
#
interface(`sysadm_bin_spec_domtrans_to',`
	gen_require(`
		type sysadm_t;
	')

corecmd_bin_spec_domtrans(sysadm_t, $1)
	allow $1 sysadm_t:fd use;
	allow $1 sysadm_t:fifo_file rw_file_perms;
	allow $1 sysadm_t:process sigchld;
')

########################################
## <summary>
##	Send a SIGCHLD signal to sysadm users.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`sysadm_sigchld',`
	gen_require(`
		type sysadm_t;
	')

allow $1 sysadm_t:process sigchld;
')

########################################
## <summary>
##	Inherit and use sysadm file descriptors
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`sysadm_use_fds',`
	gen_require(`
		type sysadm_t;
	')

allow $1 sysadm_t:fd use;
')

########################################
## <summary>
##	Read and write sysadm user unnamed pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`sysadm_rw_pipes',`
	gen_require(`
		type sysadm_t;
	')

allow $1 sysadm_t:fifo_file rw_fifo_file_perms;
')

${this.title}

Code Editor : sysadm.if