[selinux-policy: 230/3172] initial commit

[Daniel J Walsh]

commit b8fca44d3f7db88654f564e8e000249bc0ac21eb
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Tue May 31 20:39:15 2005 +0000

    initial commit

 refpolicy/policy/modules/admin/usermanage.if |  249 ++++++++++++++++++++++++++
 1 files changed, 249 insertions(+), 0 deletions(-)
---
diff --git a/refpolicy/policy/modules/admin/usermanage.if b/refpolicy/policy/modules/admin/usermanage.if
new file mode 100644
index 0000000..42558eb
--- /dev/null
+++ b/refpolicy/policy/modules/admin/usermanage.if
@@ -0,0 +1,249 @@
+# Copyright (C) 2005 Tresys Technology, LLC
+## <module name="usermanage" layer="system">
+## <summary>Policy for managing user accounts.</summary>
+
+########################################
+## <interface name="usermanage_chfn_transition">
+##	<description>
+##		Execute chfn in the chfn domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`usermanage_chfn_transition',`
+requires_block_template(`$0'_depend)
+allow $1 chfn_exec_t:file { getattr read execute };
+allow $1 chfn_t:process transition;
+type_transition $1 chfn_exec_t:process chfn_t;
+dontaudit $1 chfn_t:process { noatsecure siginh rlimitinh };
+allow $1 chfn_t:fd use;
+allow chfn_t $1:fd use;
+allow chfn_t $1:fifo_file rw_file_perms;
+allow chfn_t $1:process sigchld;
+')
+
+define(`usermanage_chfn_transition_depend',`
+type chfn_t, chfn_exec_t;
+class file { getattr read execute };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
+')
+
+########################################
+## <interface name="usermanage_chfn_transition_add_role_use_terminal">
+##	<description>
+##		Execute chfn in the chfn domain, and
+##		allow the specified role the chfn domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<parameter name="role">
+##		The role to be allowed the chfn domain.
+##	</parameter>
+##	<parameter name="terminal">
+##		The type of the terminal allow the chfn domain to use.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`usermanage_chfn_transition_add_role_use_terminal',`
+requires_block_template(`$0'_depend)
+usermanage_chfn_transition($1)
+role $2 types chfn_t;
+allow chfn_t $3:chr_file { getattr read write ioctl };
+')
+
+define(`usermanage_chfn_transition_add_role_use_terminal_depend',`
+type chfn_t;
+class chr_file { getattr read write ioctl };
+')
+
+########################################
+## <interface name="usermanage_groupadd_transition">
+##	<description>
+##		Execute groupadd in the groupadd domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`usermanage_groupadd_transition',`
+requires_block_template(`$0'_depend)
+allow $1 groupadd_exec_t:file { getattr read execute };
+allow $1 groupadd_t:process transition;
+type_transition $1 groupadd_exec_t:process groupadd_t;
+dontaudit $1 groupadd_t:process { noatsecure siginh rlimitinh };
+allow $1 groupadd_t:fd use;
+allow groupadd_t $1:fd use;
+allow groupadd_t $1:fifo_file rw_file_perms;
+allow groupadd_t $1:process sigchld;
+')
+
+define(`usermanage_groupadd_transition_depend',`
+type groupadd_t, groupadd_exec_t;
+class file { getattr read execute };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
+')
+
+########################################
+## <interface name="usermanage_groupadd_transition_add_role_use_terminal">
+##	<description>
+##		Execute groupadd in the groupadd domain, and
+##		allow the specified role the groupadd domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<parameter name="role">
+##		The role to be allowed the groupadd domain.
+##	</parameter>
+##	<parameter name="terminal">
+##		The type of the terminal allow the groupadd domain to use.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`usermanage_groupadd_transition_add_role_use_terminal',`
+requires_block_template(`$0'_depend)
+usermanage_groupadd_transition($1)
+role $2 types groupadd_t;
+allow groupadd_t $3:chr_file { getattr read write ioctl };
+')
+
+define(`usermanage_groupadd_transition_add_role_use_terminal_depend',`
+type groupadd_t;
+class chr_file { getattr read write ioctl };
+')
+
+########################################
+## <interface name="usermanage_passwd_transition">
+##	<description>
+##		Execute passwd in the passwd domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`usermanage_passwd_transition',`
+requires_block_template(`$0'_depend)
+allow $1 passwd_exec_t:file { getattr read execute };
+allow $1 passwd_t:process transition;
+type_transition $1 passwd_exec_t:process passwd_t;
+dontaudit $1 passwd_t:process { noatsecure siginh rlimitinh };
+allow $1 passwd_t:fd use;
+allow passwd_t $1:fd use;
+allow passwd_t $1:fifo_file rw_file_perms;
+allow passwd_t $1:process sigchld;
+')
+
+define(`usermanage_passwd_transition_depend',`
+type passwd_t, passwd_exec_t;
+class file { getattr read execute };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
+')
+
+########################################
+## <interface name="usermanage_passwd_transition_add_role_use_terminal">
+##	<description>
+##		Execute passwd in the passwd domain, and
+##		allow the specified role the passwd domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<parameter name="role">
+##		The role to be allowed the passwd domain.
+##	</parameter>
+##	<parameter name="terminal">
+##		The type of the terminal allow the passwd domain to use.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`usermanage_passwd_transition_add_role_use_terminal',`
+requires_block_template(`$0'_depend)
+usermanage_passwd_transition($1)
+role $2 types passwd_t;
+allow passwd_t $3:chr_file { getattr read write ioctl };
+')
+
+define(`usermanage_passwd_transition_add_role_use_terminal_depend',`
+type passwd_t;
+class chr_file { getattr read write ioctl };
+')
+
+########################################
+## <interface name="usermanage_useradd_transition">
+##	<description>
+##		Execute useradd in the useradd domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`usermanage_useradd_transition',`
+requires_block_template(`$0'_depend)
+allow $1 useradd_exec_t:file { getattr read execute };
+allow $1 useradd_t:process transition;
+type_transition $1 useradd_exec_t:process useradd_t;
+dontaudit $1 useradd_t:process { noatsecure siginh rlimitinh };
+allow $1 useradd_t:fd use;
+allow useradd_t $1:fd use;
+allow useradd_t $1:fifo_file rw_file_perms;
+allow useradd_t $1:process sigchld;
+')
+
+define(`usermanage_useradd_transition_depend',`
+type useradd_t, useradd_exec_t;
+class file { getattr read execute };
+class process { transition noatsecure siginh rlimitinh sigchld };
+class fd use;
+class fifo_file rw_file_perms;
+')
+
+########################################
+## <interface name="usermanage_useradd_transition_add_role_use_terminal">
+##	<description>
+##		Execute useradd in the useradd domain, and
+##		allow the specified role the useradd domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<parameter name="role">
+##		The role to be allowed the useradd domain.
+##	</parameter>
+##	<parameter name="terminal">
+##		The type of the terminal allow the useradd domain to use.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`usermanage_useradd_transition_add_role_use_terminal',`
+requires_block_template(`$0'_depend)
+usermanage_useradd_transition($1)
+role $2 types useradd_t;
+allow useradd_t $3:chr_file { getattr read write ioctl };
+')
+
+define(`usermanage_useradd_transition_add_role_use_terminal_depend',`
+type useradd_t;
+class chr_file { getattr read write ioctl };
+')
+
+## </module>