tequilaOS/platform_external_selinux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_external_selinux/dbus/org.selinux.policy

83 lines
3.2 KiB
Text
Raw Normal View History

These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>
<vendor>Red Hat Inc.</vendor>
<vendor_url>http://www.redhat.com</vendor_url>
<action id="org.selinux.restorecon">
<description>SELinux write access</description>
<message>System policy prevents restorecon access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 16:38:08 +01:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.selinux.setenforce">
<description>SELinux write access</description>
<message>System policy prevents setenforce access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 16:38:08 +01:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.selinux.semanage">
<description>SELinux write access</description>
<message>System policy prevents semanage access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 16:38:08 +01:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.selinux.customized">
<description>SELinux Read access</description>
<message>System policy prevents read access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 16:38:08 +01:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
org.selinux.policy: Require auth_admin_keep for all actions. Fedora permits obtaining local policy customizations and the list of policy modules without admin authentication, but we would prefer more conservative defaults upstream. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-27 21:13:34 +01:00
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
</defaults>
</action>
<action id="org.selinux.semodule_list">
<description>SELinux list modules access</description>
<message>System policy prevents read access to SELinux modules</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 16:38:08 +01:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
org.selinux.policy: Require auth_admin_keep for all actions. Fedora permits obtaining local policy customizations and the list of policy modules without admin authentication, but we would prefer more conservative defaults upstream. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-27 21:13:34 +01:00
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
</defaults>
</action>
<action id="org.selinux.relabel_on_boot">
<description>SELinux write access</description>
<message>System policy prevents relabel_on_boot access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 16:38:08 +01:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
</defaults>
</action>
<action id="org.selinux.change_default_policy">
<description>SELinux write access</description>
<message>System policy prevents change_default_policy access to SELinux</message>
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 16:38:08 +01:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
</defaults>
</action>
dbus: Fix name of polkit function Add missing action org.selinux.change_default_mode for change_default_mode() and remove unused action org.selinux.change_policy_type. Fixes: e8718ef51463 ("Make sure we do the polkit check on all dbus interfaces.") Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-07 10:18:44 +01:00
<action id="org.selinux.change_default_mode">
<description>Change SELinux default enforcing mode</description>
<message>System policy prevents change_default_policy access to SELinux</message>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
<defaults>
Make sure we do the polkit check on all dbus interfaces. Change policy kit to only allow access on the console.
2013-11-13 16:38:08 +01:00
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
These are massive changes involved in building new GUI. Too difficult to break out into seperate patches at this point. Since almost no other groups are using sepolicy yet, I will push together.
2013-10-11 16:16:57 +02:00
</defaults>
</action>
</policyconfig>
Reference in a new issue Copy permalink