diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if index 1bb9f59..69a720d 100644 --- a/policy/modules/system/unconfined.if +++ b/policy/modules/system/unconfined.if @@ -278,6 +278,46 @@ interface(`unconfined_domtrans_to',` ######################################## ## +## Allow unconfined to execute the specified program in +## the specified domain. Allow the specified domain the +## unconfined role and use of unconfined user terminals. +## +## +##

+## Allow unconfined to execute the specified program in +## the specified domain. Allow the specified domain the +## unconfined role and use of unconfined user terminals. +##

+##

+## This is a interface to support third party modules +## and its use is not allowed in upstream reference +## policy. +##

+##
+## +## +## Domain to execute in. +## +## +## +## +## Domain entry point file. +## +## +# +interface(`unconfined_run_to',` + gen_require(` + type unconfined_t, unconfined_devpts_t, unconfined_tty_device_t; + role unconfined_r; + ') + + domtrans_pattern(unconfined_t,$2,$1) + role unconfined_r types $1; + allow $1 { unconfined_devpts_t unconfined_tty_device_t }:chr_file rw_term_perms; +') + +######################################## +## ## Inherit file descriptors from the unconfined domain. ## ## diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index 23fdddf..b44c48e 100644 --- a/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te @@ -1,5 +1,5 @@ -policy_module(unconfined,2.0.2) +policy_module(unconfined,2.0.3) ######################################## #