[selinux-policy: 110/3172] add in system_domain

[Daniel J Walsh]

commit d0eddb6b0dd9b13b8986d848e1a0cc0190c96a7f
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Thu May 5 17:44:11 2005 +0000

    add in system_domain

 refpolicy/policy/modules/kernel/terminal.if |   17 ++++++++-
 refpolicy/policy/modules/system/domain.if   |   53 ++++++++++++++++++++++-----
 refpolicy/policy/modules/system/domain.te   |    8 ++++-
 refpolicy/policy/modules/system/files.if    |   14 +++++++
 refpolicy/policy/modules/system/init.te     |    8 ++--
 5 files changed, 83 insertions(+), 17 deletions(-)
---
diff --git a/refpolicy/policy/modules/kernel/terminal.if b/refpolicy/policy/modules/kernel/terminal.if
index 6e3cfa1..fe95e5d 100644
--- a/refpolicy/policy/modules/kernel/terminal.if
+++ b/refpolicy/policy/modules/kernel/terminal.if
@@ -187,14 +187,27 @@ devices_list_device_nodes_depend
 #
 define(`terminal_use_controlling_terminal',`
 requires_block_template(`$0'_depend)
-devices_list_device_nodes($1,optional)
+devices_list_device_nodes($1)
 allow $1 devtty_t:chr_file { read write };
 ')
 
 define(`terminal_use_controlling_terminal_depend',`
 type devtty_t;
 class chr_file { read write };
-devices_list_device_nodes_depend
+')
+
+########################################
+#
+# terminal_ignore_use_controlling_terminal(domain)
+#
+define(`terminal_ignore_use_controlling_terminal',`
+requires_block_template(`$0'_depend)
+dontaudit $1 devtty_t:chr_file { read write };
+')
+
+define(`terminal_ignore_use_controlling_terminal_depend',`
+type devtty_t;
+class chr_file { read write };
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/system/domain.if b/refpolicy/policy/modules/system/domain.if
index ce4c059..f1ac710 100644
--- a/refpolicy/policy/modules/system/domain.if
+++ b/refpolicy/policy/modules/system/domain.if
@@ -57,8 +57,8 @@ class file entrypoint;
 #
 define(`domain_make_init_domain',`
 requires_block_template(`$0'_depend)
-domain_make_domain($1,optional)
-domain_make_entrypoint_file($1,$2,optional)
+domain_make_domain($1)
+domain_make_entrypoint_file($1,$2)
 typeattribute $1 init_domain;
 typeattribute $2 init_domain_entry;
 role system_r types $1;
@@ -67,8 +67,6 @@ role system_r types $1;
 define(`domain_make_init_domain_depend',`
 attribute init_domain, init_domain_entry;
 role system_r;
-domain_make_domain_depend
-domain_make_entrypoint_file_depend
 ')
 
 ########################################
@@ -77,8 +75,8 @@ domain_make_entrypoint_file_depend
 #
 define(`domain_make_daemon_domain',`
 requires_block_template(`$0'_depend)
-domain_make_domain($1,optional)
-domain_make_entrypoint_file($1,$2,optional)
+domain_make_domain($1)
+domain_make_entrypoint_file($1,$2)
 typeattribute $1 daemon_domain;
 typeattribute $2 daemon_domain_entry;
 role system_r types $1;
@@ -87,8 +85,24 @@ role system_r types $1;
 define(`domain_make_daemon_domain_depend',`
 attribute init_domain, init_domain_entry;
 role system_r;
-domain_make_domain_depend
-domain_make_entrypoint_file_depend
+')
+
+########################################
+#
+# domain_make_system_domain(domain,entrypointfile)
+#
+define(`domain_make_system_domain',`
+requires_block_template(`$0'_depend)
+domain_make_domain($1)
+domain_make_entrypoint_file($1,$2)
+typeattribute $1 system_domain;
+typeattribute $2 system_domain_entry;
+role system_r types $1;
+')
+
+define(`domain_make_system_domain_depend',`
+attribute system_domain, system_domain_entry;
+role system_r;
 ')
 
 ########################################
@@ -140,7 +154,7 @@ define(`domain_all_init_domains_transition',`
 requires_block_template(`$0'_depend)
 allow $1 init_domain:process transition;
 allow $1 init_domain_entry:file { getattr read execute };
-dontaudit $1 daemon_domain:process { noatsecure siginh rlimitinh };
+dontaudit $1 init_domain:process { noatsecure siginh rlimitinh };
 ')
 
 define(`domain_all_init_domains_transition_depend',`
@@ -157,7 +171,7 @@ define(`domain_all_daemon_domains_transition',`
 requires_block_template(`$0'_depend)
 allow $1 daemon_domain:process transition;
 allow $1 daemon_domain_entry:file { getattr read execute };
-allow init_domain $1:fd use;
+allow daemon_domain $1:fd use;
 allow $1 daemon_domain:process { noatsecure siginh rlimitinh };
 ')
 
@@ -169,6 +183,25 @@ class file { getattr read execute };
 
 ########################################
 #
+# domain_all_system_domains_transition(domain)
+#
+define(`domain_all_system_domains_transition',`
+requires_block_template(`$0'_depend)
+allow $1 system_domain:process transition;
+allow $1 system_domain_entry:file { getattr read execute };
+allow system_domain $1:fd use;
+allow $1 system_domain:process { noatsecure siginh rlimitinh };
+')
+
+define(`domain_all_system_domains_transition_depend',`
+attribute system_domain, system_domain_entry;
+class process { transition noatsecure siginh rlimitinh };
+class file { getattr read execute };
+')
+
+
+########################################
+#
 # domain_signal_all_domains(domain)
 #
 define(`domain_signal_all_domains',`
diff --git a/refpolicy/policy/modules/system/domain.te b/refpolicy/policy/modules/system/domain.te
index 9eb8590..62eeef5 100644
--- a/refpolicy/policy/modules/system/domain.te
+++ b/refpolicy/policy/modules/system/domain.te
@@ -12,7 +12,13 @@ attribute entry_type;
 attribute init_domain;
 attribute init_domain_entry;
 
-# processes started by init scripts
+# short running processes started by init scripts,
+# such as mount, usually for initializing the system
+attribute system_domain;
+attribute system_domain_entry;
+
+# long running application processes started by 
+# init scripts, such as sshd
 attribute daemon_domain;
 attribute daemon_domain_entry;
 
diff --git a/refpolicy/policy/modules/system/files.if b/refpolicy/policy/modules/system/files.if
index d8c50e6..bb4e451 100644
--- a/refpolicy/policy/modules/system/files.if
+++ b/refpolicy/policy/modules/system/files.if
@@ -502,6 +502,20 @@ class dir search;
 
 ########################################
 #
+# files_ignore_search_system_state_data_directory(domain)
+#
+define(`files_ignore_search_system_state_data_directory',`
+requires_block_template(`$0'_depend)
+dontaudit $1 var_t:dir search;
+')
+
+define(`files_ignore_search_system_state_data_directory_depend',`
+type var_t;
+class dir search;
+')
+
+########################################
+#
 # files_manage_pseudorandom_saved_seed(domain)
 #
 define(`files_manage_pseudorandom_saved_seed',`
diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
index aa302e2..6111e34 100644
--- a/refpolicy/policy/modules/system/init.te
+++ b/refpolicy/policy/modules/system/init.te
@@ -213,10 +213,6 @@ corenetwork_network_udp_on_all_ports(initrc_t)
 corenetwork_bind_tcp_on_all_nodes(initrc_t)
 corenetwork_bind_udp_on_all_nodes(initrc_t)
 
-domain_kill_all_domains(initrc_t)
-domain_read_all_domains_process_state(initrc_t)
-domain_all_daemon_domains_transition(initrc_t)
-
 devices_get_random_data(initrc_t)
 devices_get_pseudorandom_data(initrc_t)
 devices_add_entropy(initrc_t)
@@ -236,6 +232,10 @@ terminal_reset_physical_terminal_labels(initrc_t)
 
 bootloader_read_kernel_symbol_table(initrc_t)
 
+domain_kill_all_domains(initrc_t)
+domain_read_all_domains_process_state(initrc_t)
+domain_all_daemon_domains_transition(initrc_t)
+domain_all_system_domains_transition(initrc_t)
 domain_use_widely_inheritable_file_descriptors(initrc_t)
 
 libraries_modify_dynamic_loader_cache(initrc_t)