73b0346a7d
These permissions are already allowed indirectly via unconfineddomain and via domain, but ultimately we plan to remove them from those two attributes. Explicitly allow the ones we expect to be required, matching the complement of the auditallow rules in domain.te. Change-Id: I43edca89d59c159b97d49932239f8952a848031c Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
29 lines
1,003 B
Text
29 lines
1,003 B
Text
# Life begins with the kernel.
|
|
type kernel, domain;
|
|
|
|
# setcon to init domain.
|
|
allow kernel self:process setcurrent;
|
|
allow kernel init:process dyntransition;
|
|
|
|
# The kernel is unconfined.
|
|
unconfined_domain(kernel)
|
|
|
|
# cgroup filesystem initialization prior to setting the cgroup root directory label.
|
|
allow kernel unlabeled:dir search;
|
|
|
|
# init direct restorecon calls prior to switching to init domain
|
|
# /dev and /dev/socket
|
|
allow kernel { device socket_device }:dir relabelto;
|
|
# /dev/__properties__
|
|
allow kernel properties_device:file relabelto;
|
|
# /sys
|
|
allow kernel sysfs:{ dir file lnk_file } relabelfrom;
|
|
allow kernel sysfs_type:{ dir file lnk_file } relabelto;
|
|
|
|
# Initial setenforce by init prior to switching to init domain.
|
|
# We use dontaudit instead of allow to prevent a kernel spawned userspace
|
|
# process from turning off SELinux once enabled.
|
|
dontaudit kernel self:security setenforce;
|
|
|
|
# Set checkreqprot by init.rc prior to switching to init domain.
|
|
allow kernel self:security setcheckreqprot;
|