Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
- Loading branch information
1 parent
96bf505
commit dc10723
Showing
6 changed files
with
70 additions
and
70 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
# Label inodes via getxattr. | ||
fs_use_xattr yaffs2 u:object_r:labeledfs:s0; | ||
fs_use_xattr jffs2 u:object_r:labeledfs:s0; | ||
fs_use_xattr ext2 u:object_r:labeledfs:s0; | ||
fs_use_xattr ext3 u:object_r:labeledfs:s0; | ||
fs_use_xattr ext4 u:object_r:labeledfs:s0; | ||
fs_use_xattr xfs u:object_r:labeledfs:s0; | ||
fs_use_xattr btrfs u:object_r:labeledfs:s0; | ||
|
||
# Label inodes from task label. | ||
fs_use_task pipefs u:object_r:pipefs:s0; | ||
fs_use_task sockfs u:object_r:sockfs:s0; | ||
|
||
# Label inodes from combination of task label and fs label. | ||
# Define type_transition rules if you want per-domain types. | ||
fs_use_trans devpts u:object_r:devpts:s0; | ||
fs_use_trans tmpfs u:object_r:tmpfs:s0; | ||
fs_use_trans devtmpfs u:object_r:device:s0; | ||
fs_use_trans shm u:object_r:shm:s0; | ||
fs_use_trans mqueue u:object_r:mqueue:s0; | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
# Label inodes with the fs label. | ||
genfscon rootfs / u:object_r:rootfs:s0 | ||
# proc labeling can be further refined (longest matching prefix). | ||
genfscon proc / u:object_r:proc:s0 | ||
genfscon proc /net/xt_qtaguid/ctrl u:object_r:qtaguid:s0 | ||
# selinuxfs booleans can be individually labeled. | ||
genfscon selinuxfs / u:object_r:selinuxfs:s0 | ||
genfscon cgroup / u:object_r:cgroup:s0 | ||
# sysfs labels can be set by userspace. | ||
genfscon sysfs / u:object_r:sysfs:s0 | ||
genfscon inotifyfs / u:object_r:inotify:s0 | ||
genfscon vfat / u:object_r:sdcard:s0 | ||
genfscon debugfs / u:object_r:debugfs:s0 | ||
genfscon fuse / u:object_r:sdcard:s0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
sid kernel u:r:kernel:s0 | ||
sid security u:object_r:kernel:s0 | ||
sid unlabeled u:object_r:unlabeled:s0 | ||
sid fs u:object_r:labeledfs:s0 | ||
sid file u:object_r:unlabeled:s0 | ||
sid file_labels u:object_r:unlabeled:s0 | ||
sid init u:object_r:unlabeled:s0 | ||
sid any_socket u:object_r:unlabeled:s0 | ||
sid port u:object_r:port:s0 | ||
sid netif u:object_r:netif:s0 | ||
sid netmsg u:object_r:unlabeled:s0 | ||
sid node u:object_r:node:s0 | ||
sid igmp_packet u:object_r:unlabeled:s0 | ||
sid icmp_socket u:object_r:unlabeled:s0 | ||
sid tcp_socket u:object_r:unlabeled:s0 | ||
sid sysctl_modprobe u:object_r:unlabeled:s0 | ||
sid sysctl u:object_r:proc:s0 | ||
sid sysctl_fs u:object_r:unlabeled:s0 | ||
sid sysctl_kernel u:object_r:unlabeled:s0 | ||
sid sysctl_net u:object_r:unlabeled:s0 | ||
sid sysctl_net_unix u:object_r:unlabeled:s0 | ||
sid sysctl_vm u:object_r:unlabeled:s0 | ||
sid sysctl_dev u:object_r:unlabeled:s0 | ||
sid kmod u:object_r:unlabeled:s0 | ||
sid policy u:object_r:unlabeled:s0 | ||
sid scmp_packet u:object_r:unlabeled:s0 | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
# portcon statements go here, e.g. | ||
# portcon tcp 80 u:object_r:http_port:s0 | ||
|