Gecko [ 122.154.134.11 ]

Name	Size	Permission
application.if	4.2 KB	-rw-r--r--
authlogin.if	33.85 KB	-rw-r--r--
clock.if	1.9 KB	-rw-r--r--
daemontools.if	4.21 KB	-rw-r--r--
fstools.if	2.95 KB	-rw-r--r--
getty.if	1.72 KB	-rw-r--r--
hostname.if	1.24 KB	-rw-r--r--
hotplug.if	3.29 KB	-rw-r--r--
init.if	41.11 KB	-rw-r--r--
ipsec.if	8 KB	-rw-r--r--
iptables.if	3.27 KB	-rw-r--r--
iscsi.if	1.51 KB	-rw-r--r--
kdump.if	2.18 KB	-rw-r--r--
libraries.if	10.88 KB	-rw-r--r--
locallogin.if	2.85 KB	-rw-r--r--
logging.if	23.83 KB	-rw-r--r--
lvm.if	3.91 KB	-rw-r--r--
miscfiles.if	15.45 KB	-rw-r--r--
modutils.if	6.94 KB	-rw-r--r--
mount.if	7.07 KB	-rw-r--r--
netlabel.if	1013 B	-rw-r--r--
pcmcia.if	3.01 KB	-rw-r--r--
raid.if	1.38 KB	-rw-r--r--
selinuxutil.if	35.72 KB	-rw-r--r--
setrans.if	977 B	-rw-r--r--
sosreport.if	2.41 KB	-rw-r--r--
sysnetwork.if	16.6 KB	-rw-r--r--
udev.if	5.99 KB	-rw-r--r--
unconfined.if	4.33 KB	-rw-r--r--
userdomain.if	103.05 KB	-rw-r--r--
xen.if	4.76 KB	-rw-r--r--

Code Editor : unconfined.if

## <summary>The unconfined domain.</summary>

########################################
## <summary>
##	Make the specified domain unconfined.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to make unconfined.
##	</summary>
## </param>
#
interface(`unconfined_domain_noaudit',`
	gen_require(`
		class dbus all_dbus_perms;
		class nscd all_nscd_perms;
		class passwd all_passwd_perms;
	')

# Use any Linux capability.
	allow $1 self:capability all_capabilities;
	allow $1 self:fifo_file { manage_fifo_file_perms relabelfrom relabelto };

# Transition to myself, to make get_ordered_context_list happy.
	allow $1 self:process transition;

# Write access is for setting attributes under /proc/self/attr.
	allow $1 self:file rw_file_perms;
	allow $1 self:dir rw_dir_perms;

# Userland object managers
	allow $1 self:nscd all_nscd_perms;
	allow $1 self:dbus all_dbus_perms;
	allow $1 self:passwd all_passwd_perms;
	allow $1 self:association all_association_perms;
	allow $1 self:socket_class_set create_socket_perms;

kernel_unconfined($1)
	corenet_unconfined($1)
	dev_unconfined($1)
	domain_unconfined($1)
	domain_dontaudit_read_all_domains_state($1)
	domain_dontaudit_ptrace_all_domains($1)
	files_unconfined($1)
	fs_unconfined($1)
	selinux_unconfined($1)

domain_mmap_low_type($1)

mcs_file_read_all($1)

ubac_process_exempt($1)

tunable_policy(`mmap_low_allowed',`
		domain_mmap_low($1)
	')

tunable_policy(`allow_execheap',`
		# Allow making the stack executable via mprotect.
		allow $1 self:process execheap;
	')

tunable_policy(`allow_execmem',`
		# Allow making anonymous memory executable, e.g. 
		# for runtime-code generation or executable stack.
		allow $1 self:process execmem;
	')

tunable_policy(`allow_execstack',`
		# Allow making the stack executable via mprotect;
		# execstack implies execmem; Bugzilla #211271
		allow $1 self:process { execmem execstack };
#		auditallow $1 self:process execstack;
	')

optional_policy(`
		auth_unconfined($1)
	')

optional_policy(`
		# Communicate via dbusd.
		dbus_system_bus_unconfined($1)
		dbus_unconfined($1)
	')

optional_policy(`
		ipsec_setcontext_default_spd($1)
		ipsec_match_default_spd($1)
	')

optional_policy(`
		nscd_unconfined($1)
	')

optional_policy(`
		postgresql_unconfined($1)
	')

optional_policy(`
		seutil_create_bin_policy($1)
		seutil_relabelto_bin_policy($1)
	')

optional_policy(`
		storage_unconfined($1)
	')

optional_policy(`
		xserver_unconfined($1)
	')
')

########################################
## <summary>
##	Make the specified domain unconfined and
##	audit executable heap usage.
## </summary>
## <desc>
##	
##	Make the specified domain unconfined and
##	audit executable heap usage. With exception
##	of memory protections, usage of this interface
##	will result in the level of access the domain has
##	is like SELinux	was not being used.
##	
##	
##	Only completely trusted domains should use this interface.
##	
## </desc>
## <param name="domain">
##	<summary>
##	Domain to make unconfined.
##	</summary>
## </param>
#
interface(`unconfined_domain',`
	gen_require(`
		attribute unconfined_services;
	')

unconfined_domain_noaudit($1)

tunable_policy(`allow_execheap',`
		auditallow $1 self:process execheap;
	')
')

########################################
## <summary>
##	Add an alias type to the unconfined domain. (Deprecated)
## </summary>
## <desc>
##	
##	Add an alias type to the unconfined domain. (Deprecated)
##	
##	
##	This is added to support targeted policy. Its
##	use should be limited. It has no effect
##	on the strict policy.
##	
## </desc>
## <param name="domain">
##	<summary>
##	New alias of the unconfined domain.
##	</summary>
## </param>
#
interface(`unconfined_alias_domain',`
	refpolicywarn(`$0($1) has been deprecated.')
')

########################################
## <summary>
##	Add an alias type to the unconfined execmem
##	program file type. (Deprecated)
## </summary>
## <desc>
##	
##	Add an alias type to the unconfined execmem
##	program file type. (Deprecated)
##	
##	
##	This is added to support targeted policy. Its
##	use should be limited. It has no effect
##	on the strict policy.
##	
## </desc>
## <param name="domain">
##	<summary>
##	New alias of the unconfined execmem program type.
##	</summary>
## </param>
#
interface(`unconfined_execmem_alias_program',`
	refpolicywarn(`$0($1) has been deprecated.')
')

${this.title}

Code Editor : unconfined.if