Skip to content
This repository has been archived by the owner on Jul 2, 2018. It is now read-only.

selinux: fix context of secure_mode_policyload boolean #102

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

selinux: fix context of secure_mode_policyload boolean #102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions policy/modules/kernel/selinux.fc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,5 @@
# This module currently does not have any file contexts.

/sys/fs/selinux(/.*)? gen_context(system_u:object_r:security_t,s0)
/sys/fs/selinux/null -c gen_context(system_u:object_r:null_device_t,s0)
/sys/fs/selinux/booleans/secure_mode_policyload -- gen_context(system_u:object_r:secure_mode_policyload_t,s0)
2 changes: 2 additions & 0 deletions policy/modules/kernel/selinux.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@
## </param>
#
interface(`selinux_labeled_boolean',`
refpolicywarn(`$0($*) has been deprecated.')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, this will not be deprecated. Even though there is only one use in refpolicy, I want this interface to continue for users to use.


gen_require(`
attribute boolean_type;
')
Expand Down
4 changes: 2 additions & 2 deletions policy/modules/kernel/selinux.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@ attribute can_setenforce;
attribute can_setsecparam;
attribute selinux_unconfined_type;

type secure_mode_policyload_t;
selinux_labeled_boolean(secure_mode_policyload_t, secure_mode_policyload)
type secure_mode_policyload_t, boolean_type;
genfscon selinuxfs /booleans/secure_mode_policyload gen_context(system_u:object_r:secure_mode_policyload_t,s0)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change should be dropped.


#
# security_t is the target type when checking
Expand Down