commit: 712145986e7c34ed256362a0a81dfe2a4b50639e
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug 8 08:46:27 2014 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 8 08:46:27 2014 +0000
URL:
http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=71214598
Use files_relabel_all_non_security_file_types
Use the naming convention "_all_" + <attribute-name> + "s" (plural)
---
policy/modules/kernel/files.if | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 33076ed..fd1f8e9 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -6731,8 +6731,7 @@ interface(`files_read_etc_runtime',`
########################################
## <summary>
-## Relabel all non-security related
-## files.
+## Allow relabel from and to non-security types
## </summary>
## <param name="domain">
## <summary>
@@ -6741,17 +6740,19 @@ interface(`files_read_etc_runtime',`
## </param>
## <rolecap/>
#
-interface(`files_relabel_non_security_file_type',`
+interface(`files_relabel_all_non_security_file_types',`
gen_require(`
attribute non_security_file_type;
')
allow $1 non_security_file_type:dir list_dir_perms;
+
relabel_dirs_pattern($1, non_security_file_type, non_security_file_type)
relabel_files_pattern($1, non_security_file_type,
non_security_file_type)
relabel_lnk_files_pattern($1, non_security_file_type,
non_security_file_type)
relabel_fifo_files_pattern($1, non_security_file_type,
non_security_file_type)
relabel_sock_files_pattern($1, non_security_file_type,
non_security_file_type)
+
# this is only relabelfrom since there should be no
# device nodes with file types.
relabelfrom_blk_files_pattern($1, non_security_file_type,
non_security_file_type)
