diff --git a/policy/modules/services/samba.if b/policy/modules/services/samba.if index 93b58ea..aea4eac 100644 --- a/policy/modules/services/samba.if +++ b/policy/modules/services/samba.if @@ -490,8 +490,7 @@ interface(`samba_manage_var_files',` # interface(`samba_domtrans_smbcontrol',` gen_require(` - type smbcontrol_t; - type smbcontrol_exec_t; + type smbcontrol_t, smbcontrol_exec_t; ') domtrans_pattern($1, smbcontrol_exec_t, smbcontrol_t) @@ -756,16 +755,12 @@ template(`samba_helper_template',` # interface(`samba_admin',` gen_require(` - type nmbd_t, nmbd_var_run_t; - type smbd_t, smbd_tmp_t; - type smbd_var_run_t; - type samba_initrc_exec_t; - type samba_log_t, samba_var_t; - type samba_etc_t, samba_share_t; - type samba_secrets_t; + type nmbd_t, nmbd_var_run_t, smbd_var_run_t; + type smbd_t, smbd_tmp_t, samba_secrets_t; + type samba_initrc_exec_t, samba_log_t, samba_var_t; + type samba_etc_t, samba_share_t, winbind_log_t; type swat_var_run_t, swat_tmp_t; type winbind_var_run_t, winbind_tmp_t; - type winbind_log_t; type samba_unconfined_script_t, samba_unconfined_script_exec_t; ') diff --git a/policy/modules/services/sssd.if b/policy/modules/services/sssd.if index 39cc338..6dbfc01 100644 --- a/policy/modules/services/sssd.if +++ b/policy/modules/services/sssd.if @@ -229,8 +229,7 @@ interface(`sssd_stream_connect',` # interface(`sssd_admin',` gen_require(` - type sssd_t, sssd_public_t; - type sssd_initrc_exec_t; + type sssd_t, sssd_public_t, sssd_initrc_exec_t; ') allow $1 sssd_t:process { ptrace signal_perms }; diff --git a/policy/modules/services/tuned.if b/policy/modules/services/tuned.if index fa7ade8..329f139 100644 --- a/policy/modules/services/tuned.if +++ b/policy/modules/services/tuned.if @@ -112,8 +112,7 @@ interface(`tuned_initrc_domtrans',` # interface(`tuned_admin',` gen_require(` - type tuned_t, tuned_var_run_t; - type tuned_initrc_exec_t; + type tuned_t, tuned_var_run_t, tuned_initrc_exec_t; ') allow $1 tuned_t:process { ptrace signal_perms }; diff --git a/policy/modules/services/ulogd.if b/policy/modules/services/ulogd.if index 48c528a..e3c66d8 100644 --- a/policy/modules/services/ulogd.if +++ b/policy/modules/services/ulogd.if @@ -119,9 +119,8 @@ interface(`ulogd_append_log',` # interface(`ulogd_admin',` gen_require(` - type ulogd_t, ulogd_etc_t; + type ulogd_t, ulogd_etc_t, ulogd_modules_t; type ulogd_var_log_t, ulogd_initrc_exec_t; - type ulogd_modules_t; ') allow $1 ulogd_t:process { ptrace signal_perms }; diff --git a/policy/modules/services/varnishd.if b/policy/modules/services/varnishd.if index 0bbbb0d..e0f819e 100644 --- a/policy/modules/services/varnishd.if +++ b/policy/modules/services/varnishd.if @@ -151,9 +151,8 @@ interface(`varnishd_manage_log',` # interface(`varnishd_admin_varnishlog',` gen_require(` - type varnishlog_t; + type varnishlog_t, varnishlog_initrc_exec_t; type varnishlog_var_run_t, varnishlog_log_t; - type varnishlog_initrc_exec_t; ') allow $1 varnishlog_t:process { ptrace signal_perms }; diff --git a/policy/modules/services/virt.if b/policy/modules/services/virt.if index 50ef959..6fa35aa 100644 --- a/policy/modules/services/virt.if +++ b/policy/modules/services/virt.if @@ -14,8 +14,7 @@ template(`virt_domain_template',` gen_require(` type virtd_t; - attribute virt_image_type; - attribute virt_domain; + attribute virt_image_type, virt_domain; ') type $1_t, virt_domain; @@ -154,8 +153,7 @@ interface(`virt_attach_tun_iface',` # interface(`virt_read_config',` gen_require(` - type virt_etc_t; - type virt_etc_rw_t; + type virt_etc_t, virt_etc_rw_t; ') files_search_etc($1) @@ -176,8 +174,7 @@ interface(`virt_read_config',` # interface(`virt_manage_config',` gen_require(` - type virt_etc_t; - type virt_etc_rw_t; + type virt_etc_t, virt_etc_rw_t; ') files_search_etc($1) diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if index 54f5506..73432ea 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -363,9 +363,8 @@ template(`xserver_common_x_domain_template',` type xevent_t, client_xevent_t; type input_xevent_t, $1_input_xevent_t; - attribute x_domain; + attribute x_domain, input_xevent_type; attribute xdrawable_type, xcolormap_type; - attribute input_xevent_type; class x_drawable all_x_drawable_perms; class x_property all_x_property_perms; @@ -783,8 +782,7 @@ interface(`xserver_dontaudit_rw_xdm_pipes',` # interface(`xserver_stream_connect_xdm',` gen_require(` - type xdm_t, xdm_tmp_t; - type xdm_var_run_t; + type xdm_t, xdm_tmp_t, xdm_var_run_t; ') files_search_tmp($1) @@ -1323,13 +1321,12 @@ interface(`xserver_read_tmp_files',` # interface(`xserver_manage_core_devices',` gen_require(` - type xserver_t; + type xserver_t, root_xdrawable_t; class x_device all_x_device_perms; class x_pointer all_x_pointer_perms; class x_keyboard all_x_keyboard_perms; class x_screen all_x_screen_perms; class x_drawable { manage }; - type root_xdrawable_t; attribute x_domain; class x_drawable { read manage setattr show }; class x_resource { write read }; @@ -1357,8 +1354,7 @@ interface(`xserver_manage_core_devices',` # interface(`xserver_unconfined',` gen_require(` - attribute x_domain; - attribute xserver_unconfined_type; + attribute x_domain, xserver_unconfined_type; ') typeattribute $1 x_domain; @@ -1377,8 +1373,7 @@ interface(`xserver_unconfined',` # interface(`xserver_dontaudit_append_xdm_home_files',` gen_require(` - type xdm_home_t; - type xserver_tmp_t; + type xdm_home_t, xserver_tmp_t; ') dontaudit $1 xdm_home_t:file rw_inherited_file_perms; @@ -1405,8 +1400,7 @@ interface(`xserver_dontaudit_append_xdm_home_files',` # interface(`xserver_append_xdm_home_files',` gen_require(` - type xdm_home_t; - type xserver_tmp_t; + type xdm_home_t, xserver_tmp_t; ') allow $1 xdm_home_t:file append_file_perms; @@ -1570,8 +1564,7 @@ template(`xserver_read_user_iceauth',` # interface(`xserver_rw_inherited_user_fonts',` gen_require(` - type user_fonts_t; - type user_fonts_config_t; + type user_fonts_t, user_fonts_config_t; ') allow $1 user_fonts_t:file rw_inherited_file_perms; @@ -1678,8 +1671,7 @@ interface(`xserver_run_xauth',` # interface(`xserver_manage_home_fonts',` gen_require(` - type user_fonts_t; - type user_fonts_config_t; + type user_fonts_t, user_fonts_config_t; ') manage_dirs_pattern($1, user_fonts_t, user_fonts_t)