1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
From 2d04fadd54814ce01d143262f36edbf0b1700a9b Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 5 Apr 2019 11:53:28 -0400
Subject: [PATCH] refpolicy-minimum: make sysadmin module optional
The init and locallogin modules have a depend for sysadm module
because they have called sysadm interfaces(sysadm_shell_domtrans).
Since sysadm is not a core module, we could make the
sysadm_shell_domtrans calls optionally by optional_policy.
So, we could make the minimum policy without sysadm module.
Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
policy/modules/system/init.te | 14 ++++++++------
policy/modules/system/locallogin.te | 4 +++-
2 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index c2380d8b4..31f77cf43 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -645,13 +645,15 @@ ifdef(`init_systemd',`
unconfined_write_keys(init_t)
')
',`
- tunable_policy(`init_upstart',`
- corecmd_shell_domtrans(init_t, initrc_t)
+ optional_policy(`
+ tunable_policy(`init_upstart',`
+ corecmd_shell_domtrans(init_t, initrc_t)
',`
- # Run the shell in the sysadm role for single-user mode.
- # causes problems with upstart
- ifndef(`distro_debian',`
- sysadm_shell_domtrans(init_t)
+ # Run the shell in the sysadm role for single-user mode.
+ # causes problems with upstart
+ ifndef(`distro_debian',`
+ sysadm_shell_domtrans(init_t)
+ ')
')
')
')
diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
index 8330be8a9..933e94b24 100644
--- a/policy/modules/system/locallogin.te
+++ b/policy/modules/system/locallogin.te
@@ -277,7 +277,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
userdom_search_user_home_dirs(sulogin_t)
userdom_use_user_ptys(sulogin_t)
-sysadm_shell_domtrans(sulogin_t)
+optional_policy(`
+ sysadm_shell_domtrans(sulogin_t)
+')
# by default, sulogin does not use pam...
# sulogin_pam might need to be defined otherwise
--
2.25.1
|
