diff --git a/policy/modules/roles/sysadm.if b/policy/modules/roles/sysadm.if index 42be030..ff92430 100644 --- a/policy/modules/roles/sysadm.if +++ b/policy/modules/roles/sysadm.if @@ -116,6 +116,41 @@ interface(`sysadm_entry_spec_domtrans',` ######################################## ## <summary> +## Allow sysadm to execute all entrypoint files in +## a specified domain. This is an explicit transition, +## requiring the caller to use setexeccon(). +## </summary> +## <desc> +## <p> +## Allow sysadm to execute all entrypoint files in +## a specified domain. This is an explicit transition, +## requiring the caller to use setexeccon(). +## </p> +## <p> +## This is a interface to support third party modules +## and its use is not allowed in upstream reference +## policy. +## </p> +## </desc> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`sysadm_entry_spec_domtrans_to',` + gen_require(` + type sysadm_t; + ') + + domain_entry_file_spec_domtrans(sysadm_t, $1) + allow $1 sysadm_t:fd use; + allow $1 sysadm_t:fifo_file rw_file_perms; + allow $1 sysadm_t:process sigchld; +') + +######################################## +## <summary> ## Allow sysadm to execute a generic bin program in ## a specified domain. This is an explicit transition, ## requiring the caller to use setexeccon(). diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index e69ab7c..b17984d 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -1,5 +1,5 @@ -policy_module(sysadm, 2.0.0) +policy_module(sysadm, 2.0.1) ######################################## #