diff --git a/policy/modules/roles/sysadm.if b/policy/modules/roles/sysadm.if index 42be030..ff92430 100644 --- a/policy/modules/roles/sysadm.if +++ b/policy/modules/roles/sysadm.if @@ -116,6 +116,41 @@ interface(`sysadm_entry_spec_domtrans',` ######################################## ## +## Allow sysadm to execute all entrypoint files in +## a specified domain. This is an explicit transition, +## requiring the caller to use setexeccon(). +## +## +##

+## Allow sysadm to execute all entrypoint files in +## a specified domain. This is an explicit transition, +## requiring the caller to use setexeccon(). +##

+##

+## This is a interface to support third party modules +## and its use is not allowed in upstream reference +## policy. +##

+##
+## +## +## Domain allowed access. +## +## +# +interface(`sysadm_entry_spec_domtrans_to',` + gen_require(` + type sysadm_t; + ') + + domain_entry_file_spec_domtrans(sysadm_t, $1) + allow $1 sysadm_t:fd use; + allow $1 sysadm_t:fifo_file rw_file_perms; + allow $1 sysadm_t:process sigchld; +') + +######################################## +## ## Allow sysadm to execute a generic bin program in ## a specified domain. This is an explicit transition, ## requiring the caller to use setexeccon(). diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index e69ab7c..b17984d 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -1,5 +1,5 @@ -policy_module(sysadm, 2.0.0) +policy_module(sysadm, 2.0.1) ######################################## #