selinux-policy/modules-mls-base.conf

# Layer: kernel
# Module: bootloader
#
# Policy for the kernel modules, kernel image, and bootloader.
# 
bootloader = module

# Layer: kernel
# Module: corenetwork
# Required in base
#
# Policy controlling access to network objects
# 
corenetwork = base

# Layer: admin
# Module: dmesg
#
# Policy for dmesg.
# 
dmesg = module

# Layer: admin
# Module: netutils
#
# Network analysis utilities
# 
netutils = module

# Layer: admin
# Module: sudo
#
# Execute a command with a substitute user
# 
sudo = module

# Layer: admin
# Module: su
#
# Run shells with substitute user and group
# 
su = module

# Layer: admin
# Module: usermanage
#
# Policy for managing user accounts.
# 
usermanage = module

# Layer: apps
# Module: seunshare
#
# seunshare executable
# 
seunshare = module

# Layer: kernel
# Module: corecommands
# Required in base
#
# Core policy for shells, and generic programs
# in /bin, /sbin, /usr/bin, and /usr/sbin.
# 
corecommands = base

# Module: devices
# Required in base
#
# Device nodes and interfaces for many basic system devices.
# 
devices = base

# Module: domain
# Required in base
#
# Core policy for domains.
# 
domain = base

# Layer: system
# Module: userdomain
#
# Policy for user domains
# 
userdomain = module

# Module: files
# Required in base
#
# Basic filesystem types and interfaces.
# 
files = base

# Module: filesystem
# Required in base
#
# Policy for filesystems.
# 
filesystem = base

# Module: kernel
# Required in base
#
# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
# 
kernel = base

# Module: mcs
# Required in base
#
# MultiCategory security policy
# 
mcs = base

# Module: mls
# Required in base
#
# Multilevel security policy
# 
mls = base

# Module: selinux
# Required in base
#
# Policy for kernel security interface, in particular, selinuxfs.
# 
selinux = base

# Layer: kernel
# Module: storage
#
# Policy controlling access to storage devices
# 
storage = base

# Module: terminal
# Required in base
#
# Policy for terminals.
# 
terminal = base

# Layer: kernel
# Module: ubac
#
# 
# 
ubac = base

# Layer: kernel
# Module: unlabelednet
#
# The unlabelednet module.
#
unlabelednet = module

# Layer: role
# Module: auditadm
#
# auditadm account on tty logins
# 
auditadm = module

# Layer: role
# Module: logadm
#
# Minimally prived root role for managing logging system
# 
logadm = module

# Layer: role
# Module: secadm
#
# secadm account on tty logins
# 
secadm = module

# Layer:role
# Module: staff
#
# admin account 
# 
staff = module

# Layer:role
# Module: sysadm_secadm
#
# System Administrator with Security Admin rules
# 
sysadm_secadm = module

# Layer:role
# Module: sysadm
#
# System Administrator
# 
sysadm = module

# Layer: role
# Module: unprivuser
#
# Minimally privs guest account on tty logins
# 
unprivuser = module

# Layer: services
# Module: postgresql
#
# PostgreSQL relational database
# 
postgresql = module

# Layer: services
# Module: ssh
#
# Secure shell client and server policy.
# 
ssh = module

# Layer: services
# Module: xserver
#
# X windows login display manager
# 
xserver = module

# Module: application
# Required in base
#
# Defines attributs and interfaces for all user applications
# 
application = module

# Layer: system
# Module: authlogin
#
# Common policy for authentication and user login.
# 
authlogin = module

# Layer: system
# Module: clock
#
# Policy for reading and setting the hardware clock.
# 
clock = module

# Layer: system
# Module: fstools
#
# Tools for filesystem management, such as mkfs and fsck.
# 
fstools = module

# Layer: system
# Module: getty
#
# Policy for getty.
# 
getty = module

# Layer: system
# Module: hostname
#
# Policy for changing the system host name.
# 
hostname = module

# Layer: system
# Module: init
#
# System initialization programs (init and init scripts).
# 
init = module

# Layer: system
# Module: ipsec
#
# TCP/IP encryption
# 
ipsec = module

# Layer: system
# Module: iptables
#
# Policy for iptables.
# 
iptables = module

# Layer: system
# Module: libraries
#
# Policy for system libraries.
# 
libraries = module

# Layer: system
# Module: locallogin
#
# Policy for local logins.
# 
locallogin = module

# Layer: system
# Module: logging
#
# Policy for the kernel message logger and system logging daemon.
# 
logging = module

# Layer: system
# Module: lvm
#
# Policy for logical volume management programs.
# 
lvm = module

# Layer: system
# Module: miscfiles
#
# Miscelaneous files.
# 
miscfiles = module

# Layer: system
# Module: modutils
#
# Policy for kernel module utilities
# 
modutils = module

# Layer: system
# Module: mount
#
# Policy for mount.
# 
mount = module

# Layer: system
# Module: netlabel
#
# Basic netlabel types and interfaces.
# 
netlabel = module

# Layer: system
# Module: selinuxutil
#
# Policy for SELinux policy and userland applications.
# 
selinuxutil = module

# Module: setrans
# Required in base
#
# Policy for setrans
# 
setrans = module

# Layer: system
# Module: sysnetwork
#
# Policy for network configuration: ifconfig and dhcp client.
# 
sysnetwork = module

# Layer: system
# Module: systemd
#
# Policy for systemd components
# 
systemd = module

# Layer: system
# Module: udev
#
# Policy for udev.
# 
udev = module
Accepting request 1186574 from home:cahu:security:SELinux:policyupdate072024 - Enable sap module - Add equivalency in file_contexts.subs_dist * /bin /usr/bin * /sbin /usr/bin * /usr/sbin /usr/bin - Update to version 20240710: * Change fc in rebootmgr module for /sbin -> /usr/bin * Change fc in rpm module for /sbin -> /usr/bin * Change fc in rsync module for /sbin -> /usr/bin * Change fc in wicked module for /sbin -> /usr/bin * Confine libvirt-dbus * Allow virtqemud the kill capability in user namespace * Allow rshim get options of the netlink class for KOBJECT_UEVENT family * Allow dhcpcd the kill capability * Allow systemd-networkd list /var/lib/systemd/network * Allow sysadm_t run systemd-nsresourced bpf programs * Update policy for systemd generators interactions * Allow create memory.pressure files with cgroup_memory_pressure_t * Add support for libvirt hooks * Allow certmonger read and write tpm devices * Allow all domains to connect to systemd-nsresourced over a unix socket * Allow systemd-machined read the vsock device * Update policy for systemd generators * Allow ptp4l_t request that the kernel load a kernel module * Allow sbd to trace processes in user namespace * Allow request-key execute scripts * Update policy for haproxyd * Update policy for systemd-nsresourced * Correct sbin-related file context entries * Allow login_userdomain execute systemd-tmpfiles in the caller domain * Allow virt_driver_domain read files labeled unconfined_t * Allow virt_driver_domain dbus chat with policykit * Allow virtqemud manage nfs files when virt_use_nfs boolean is on * Add rules for interactions between generators * Label memory.pressure files with cgroup_memory_pressure_t * Revert "Allow some systemd services write to cgroup files" * Update policy for systemd-nsresourced * Label /usr/bin/ntfsck with fsadm_exec_t * Allow systemd_fstab_generator_t read tmpfs files * Update policy for systemd-nsresourced * Alias /usr/sbin to /usr/bin and change all /usr/sbin paths to /usr/bin * Remove a few lines duplicated between {dkim,milter}.fc * Alias /bin → /usr/bin and remove redundant paths * Drop duplicate line for /usr/sbin/unix_chkpwd * Drop duplicate paths for /usr/sbin * Update systemd-generator policy * Remove permissive domain for bootupd_t * Remove permissive domain for coreos_installer_t * Remove permissive domain for afterburn_t * Add the sap module to modules.conf * Move unconfined_domain(sap_unconfined_t) to an optional block * Create the sap module * Allow systemd-coredumpd sys_admin and sys_resource capabilities * Allow systemd-coredump read nsfs files * Allow generators auto file transition only for plain files * Allow systemd-hwdb write to the kernel messages device * Escape "interface" as a file name in a virt filetrans pattern * Allow gnome-software work for login_userdomain * Allow systemd-machined manage runtime sockets * Revert "Allow systemd-machined manage runtime sockets" * Allow postfix_domain connect to postgresql over a unix socket * Dontaudit systemd-coredump sys_admin capability - Update container-selinux OBS-URL: https://build.opensuse.org/request/show/1186574 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=233 2024-07-10 13:10:28 +02:00			`# Layer: kernel`
			`# Module: bootloader`
			`#`
			`# Policy for the kernel modules, kernel image, and bootloader.`
			`#`
			`bootloader = module`

			`# Layer: kernel`
			`# Module: corenetwork`
			`# Required in base`
			`#`
			`# Policy controlling access to network objects`
			`#`
			`corenetwork = base`

			`# Layer: admin`
			`# Module: dmesg`
			`#`
			`# Policy for dmesg.`
			`#`
			`dmesg = module`

			`# Layer: admin`
			`# Module: netutils`
			`#`
			`# Network analysis utilities`
			`#`
			`netutils = module`

			`# Layer: admin`
			`# Module: sudo`
			`#`
			`# Execute a command with a substitute user`
			`#`
			`sudo = module`

			`# Layer: admin`
			`# Module: su`
			`#`
			`# Run shells with substitute user and group`
			`#`
			`su = module`

			`# Layer: admin`
			`# Module: usermanage`
			`#`
			`# Policy for managing user accounts.`
			`#`
			`usermanage = module`

			`# Layer: apps`
			`# Module: seunshare`
			`#`
			`# seunshare executable`
			`#`
			`seunshare = module`

			`# Layer: kernel`
			`# Module: corecommands`
			`# Required in base`
			`#`
			`# Core policy for shells, and generic programs`
			`# in /bin, /sbin, /usr/bin, and /usr/sbin.`
			`#`
			`corecommands = base`

			`# Module: devices`
			`# Required in base`
			`#`
			`# Device nodes and interfaces for many basic system devices.`
			`#`
			`devices = base`

			`# Module: domain`
			`# Required in base`
			`#`
			`# Core policy for domains.`
			`#`
			`domain = base`

			`# Layer: system`
			`# Module: userdomain`
			`#`
			`# Policy for user domains`
			`#`
			`userdomain = module`

			`# Module: files`
			`# Required in base`
			`#`
			`# Basic filesystem types and interfaces.`
			`#`
			`files = base`

			`# Module: filesystem`
			`# Required in base`
			`#`
			`# Policy for filesystems.`
			`#`
			`filesystem = base`

			`# Module: kernel`
			`# Required in base`
			`#`
			`# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.`
			`#`
			`kernel = base`

			`# Module: mcs`
			`# Required in base`
			`#`
			`# MultiCategory security policy`
			`#`
			`mcs = base`

			`# Module: mls`
			`# Required in base`
			`#`
			`# Multilevel security policy`
			`#`
			`mls = base`

			`# Module: selinux`
			`# Required in base`
			`#`
			`# Policy for kernel security interface, in particular, selinuxfs.`
			`#`
			`selinux = base`

			`# Layer: kernel`
			`# Module: storage`
			`#`
			`# Policy controlling access to storage devices`
			`#`
			`storage = base`

			`# Module: terminal`
			`# Required in base`
			`#`
			`# Policy for terminals.`
			`#`
			`terminal = base`

			`# Layer: kernel`
			`# Module: ubac`
			`#`
			`#`
			`#`
			`ubac = base`

			`# Layer: kernel`
			`# Module: unlabelednet`
			`#`
			`# The unlabelednet module.`
			`#`
			`unlabelednet = module`

			`# Layer: role`
			`# Module: auditadm`
			`#`
			`# auditadm account on tty logins`
			`#`
			`auditadm = module`

			`# Layer: role`
			`# Module: logadm`
			`#`
			`# Minimally prived root role for managing logging system`
			`#`
			`logadm = module`

			`# Layer: role`
			`# Module: secadm`
			`#`
			`# secadm account on tty logins`
			`#`
			`secadm = module`

			`# Layer:role`
			`# Module: staff`
			`#`
			`# admin account`
			`#`
			`staff = module`

			`# Layer:role`
			`# Module: sysadm_secadm`
			`#`
			`# System Administrator with Security Admin rules`
			`#`
			`sysadm_secadm = module`

			`# Layer:role`
			`# Module: sysadm`
			`#`
			`# System Administrator`
			`#`
			`sysadm = module`

			`# Layer: role`
			`# Module: unprivuser`
			`#`
			`# Minimally privs guest account on tty logins`
			`#`
			`unprivuser = module`

			`# Layer: services`
			`# Module: postgresql`
			`#`
			`# PostgreSQL relational database`
			`#`
			`postgresql = module`

			`# Layer: services`
			`# Module: ssh`
			`#`
			`# Secure shell client and server policy.`
			`#`
			`ssh = module`

			`# Layer: services`
			`# Module: xserver`
			`#`
			`# X windows login display manager`
			`#`
			`xserver = module`

			`# Module: application`
			`# Required in base`
			`#`
			`# Defines attributs and interfaces for all user applications`
			`#`
			`application = module`

			`# Layer: system`
			`# Module: authlogin`
			`#`
			`# Common policy for authentication and user login.`
			`#`
			`authlogin = module`

			`# Layer: system`
			`# Module: clock`
			`#`
			`# Policy for reading and setting the hardware clock.`
			`#`
			`clock = module`

			`# Layer: system`
			`# Module: fstools`
			`#`
			`# Tools for filesystem management, such as mkfs and fsck.`
			`#`
			`fstools = module`

			`# Layer: system`
			`# Module: getty`
			`#`
			`# Policy for getty.`
			`#`
			`getty = module`

			`# Layer: system`
			`# Module: hostname`
			`#`
			`# Policy for changing the system host name.`
			`#`
			`hostname = module`

			`# Layer: system`
			`# Module: init`
			`#`
			`# System initialization programs (init and init scripts).`
			`#`
			`init = module`

			`# Layer: system`
			`# Module: ipsec`
			`#`
			`# TCP/IP encryption`
			`#`
			`ipsec = module`

			`# Layer: system`
			`# Module: iptables`
			`#`
			`# Policy for iptables.`
			`#`
			`iptables = module`

			`# Layer: system`
			`# Module: libraries`
			`#`
			`# Policy for system libraries.`
			`#`
			`libraries = module`

			`# Layer: system`
			`# Module: locallogin`
			`#`
			`# Policy for local logins.`
			`#`
			`locallogin = module`

			`# Layer: system`
			`# Module: logging`
			`#`
			`# Policy for the kernel message logger and system logging daemon.`
			`#`
			`logging = module`

			`# Layer: system`
			`# Module: lvm`
			`#`
			`# Policy for logical volume management programs.`
			`#`
			`lvm = module`

			`# Layer: system`
			`# Module: miscfiles`
			`#`
			`# Miscelaneous files.`
			`#`
			`miscfiles = module`

			`# Layer: system`
			`# Module: modutils`
			`#`
			`# Policy for kernel module utilities`
			`#`
			`modutils = module`

			`# Layer: system`
			`# Module: mount`
			`#`
			`# Policy for mount.`
			`#`
			`mount = module`

			`# Layer: system`
			`# Module: netlabel`
			`#`
			`# Basic netlabel types and interfaces.`
			`#`
			`netlabel = module`

			`# Layer: system`
			`# Module: selinuxutil`
			`#`
			`# Policy for SELinux policy and userland applications.`
			`#`
			`selinuxutil = module`

			`# Module: setrans`
			`# Required in base`
			`#`
			`# Policy for setrans`
			`#`
			`setrans = module`

			`# Layer: system`
			`# Module: sysnetwork`
			`#`
			`# Policy for network configuration: ifconfig and dhcp client.`
			`#`
			`sysnetwork = module`

			`# Layer: system`
			`# Module: systemd`
			`#`
			`# Policy for systemd components`
			`#`
			`systemd = module`

			`# Layer: system`
			`# Module: udev`
			`#`
			`# Policy for udev.`
			`#`
			`udev = module`