61 lines
2.4 KiB
Diff
61 lines
2.4 KiB
Diff
Index: refpolicy/policy/modules/services/cron.fc
|
|
===================================================================
|
|
--- refpolicy.orig/policy/modules/services/cron.fc 2018-11-27 13:46:40.344580166 +0100
|
|
+++ refpolicy/policy/modules/services/cron.fc 2018-11-27 13:47:44.725617173 +0100
|
|
@@ -68,7 +68,9 @@ ifdef(`distro_gentoo',`
|
|
')
|
|
|
|
ifdef(`distro_suse',`
|
|
-/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
|
|
+/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
|
|
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
|
-/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
|
+/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
|
+/var/spool/cron/tabs/root -- gen_context(system_u:object_r:sysadm_cron_spool_t,s0)
|
|
+/var/spool/cron/tabs/[^/]* -- gen_context(system_u:object_r:user_cron_spool_t,s0)
|
|
')
|
|
Index: refpolicy/policy/modules/services/cron.te
|
|
===================================================================
|
|
--- refpolicy.orig/policy/modules/services/cron.te 2018-11-27 13:46:21.396274896 +0100
|
|
+++ refpolicy/policy/modules/services/cron.te 2018-11-27 13:46:40.344580166 +0100
|
|
@@ -761,3 +761,9 @@ tunable_policy(`cron_userdomain_transiti
|
|
optional_policy(`
|
|
unconfined_domain(unconfined_cronjob_t)
|
|
')
|
|
+
|
|
+ifdef(`distro_suse',`
|
|
+ files_read_default_symlinks(crontab_t)
|
|
+ userdom_manage_user_home_dirs(crontab_t)
|
|
+ xserver_non_drawing_client(crontab_t)
|
|
+')
|
|
Index: refpolicy/policy/modules/services/cron.if
|
|
===================================================================
|
|
--- refpolicy.orig/policy/modules/services/cron.if 2018-11-27 13:46:40.344580166 +0100
|
|
+++ refpolicy/policy/modules/services/cron.if 2018-11-27 13:49:17.339129179 +0100
|
|
@@ -139,7 +139,7 @@ interface(`cron_role',`
|
|
#
|
|
interface(`cron_unconfined_role',`
|
|
gen_require(`
|
|
- type unconfined_cronjob_t, crontab_t, crontab_exec_t;
|
|
+ type unconfined_cronjob_t, admin_crontab_t, crontab_t, crontab_exec_t;
|
|
type crond_t, user_cron_spool_t;
|
|
bool cron_userdomain_transition;
|
|
')
|
|
@@ -149,14 +149,14 @@ interface(`cron_unconfined_role',`
|
|
# Declarations
|
|
#
|
|
|
|
- role $1 types { unconfined_cronjob_t crontab_t };
|
|
+ role $1 types { unconfined_cronjob_t admin_crontab_t crontab_t };
|
|
|
|
##############################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
- domtrans_pattern($2, crontab_exec_t, crontab_t)
|
|
+ domtrans_pattern($2, crontab_exec_t, admin_crontab_t)
|
|
|
|
dontaudit crond_t $2:process { noatsecure siginh rlimitinh };
|
|
allow $2 crond_t:process sigchld;
|