| 1 |
commit: 906ec39d92b4e6cc11ff59c1d466c294be67b0b0 |
| 2 |
Author: Chris PeBenito <chpebeni <AT> linux <DOT> microsoft <DOT> com> |
| 3 |
AuthorDate: Tue Feb 1 13:50:41 2022 +0000 |
| 4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Mon Feb 7 02:07:41 2022 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=906ec39d |
| 7 |
|
| 8 |
Revert "users: remove MCS categories from default users" |
| 9 |
|
| 10 |
This reverts commit 7d53784332b83ee264332d9c15fa0387a483ec89. |
| 11 |
|
| 12 |
Signed-off-by: Chris PeBenito <chpebeni <AT> linux.microsoft.com> |
| 13 |
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> |
| 14 |
|
| 15 |
policy/users | 14 +++++++------- |
| 16 |
1 file changed, 7 insertions(+), 7 deletions(-) |
| 17 |
|
| 18 |
diff --git a/policy/users b/policy/users |
| 19 |
index 3f9d0fae..ca203758 100644 |
| 20 |
--- a/policy/users |
| 21 |
+++ b/policy/users |
| 22 |
@@ -15,7 +15,7 @@ |
| 23 |
# and a user process should never be assigned the system user |
| 24 |
# identity. |
| 25 |
# |
| 26 |
-gen_user(system_u,, system_r, s0, s0 - mls_systemhigh) |
| 27 |
+gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats) |
| 28 |
|
| 29 |
# |
| 30 |
# user_u is a generic user identity for Linux users who have no |
| 31 |
@@ -25,14 +25,14 @@ gen_user(system_u,, system_r, s0, s0 - mls_systemhigh) |
| 32 |
# permit any access to such users, then remove this entry. |
| 33 |
# |
| 34 |
gen_user(user_u, user, user_r, s0, s0) |
| 35 |
-gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh) |
| 36 |
-gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh) |
| 37 |
+gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) |
| 38 |
+gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats) |
| 39 |
|
| 40 |
# Until order dependence is fixed for users: |
| 41 |
ifdef(`direct_sysadm_daemon',` |
| 42 |
- gen_user(unconfined_u, unconfined, unconfined_r system_r, s0, s0 - mls_systemhigh) |
| 43 |
+ gen_user(unconfined_u, unconfined, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) |
| 44 |
',` |
| 45 |
- gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh) |
| 46 |
+ gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats) |
| 47 |
') |
| 48 |
|
| 49 |
# |
| 50 |
@@ -43,7 +43,7 @@ ifdef(`direct_sysadm_daemon',` |
| 51 |
# not in the sysadm_r. |
| 52 |
# |
| 53 |
ifdef(`direct_sysadm_daemon',` |
| 54 |
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh) |
| 55 |
+ gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) |
| 56 |
',` |
| 57 |
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh) |
| 58 |
+ gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) |
| 59 |
') |
Archives