diff options
| author |   Yi Zhao <yi.zhao@windriver.com> | 2024-06-30 22:24:57 +0800 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2024-09-21 15:28:29 -0700 |
| commit | 178a97b84b25ad2ad2efcf38ef21a1adc8f8e388 (patch) | |
| tree | db42658d3318d87a65fd66b0030c75ba3abaf8e2 | |
| parent | node_exporter: allow reading RPC sysctls (diff) | |
| download | hardened-refpolicy-178a97b84b25ad2ad2efcf38ef21a1adc8f8e388.tar.gz hardened-refpolicy-178a97b84b25ad2ad2efcf38ef21a1adc8f8e388.tar.bz2 hardened-refpolicy-178a97b84b25ad2ad2efcf38ef21a1adc8f8e388.zip | |
userdomain: allow administrative user to get attributes of shadow history file
Before the patch:
root@qemux86-64:~# ls -lZ /etc/security/opasswd
-?????????? ? ? ? ? ? ? /etc/security/opasswd
After the patch:
root@qemux86-64:~# ls -lZ /etc/security/opasswd
-rw-------. 1 root root user_u:object_r:shadow_history_t 237 Jun 30 12:03 /etc/security/opasswd
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
| -rw-r--r-- | policy/modules/system/authlogin.if | 19 | ||||
| -rw-r--r-- | policy/modules/system/userdomain.if | 1 |
2 files changed, 20 insertions, 0 deletions
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if index 1357a0ad..1c312506 100644 --- a/policy/modules/system/authlogin.if +++ b/policy/modules/system/authlogin.if @@ -761,6 +761,25 @@ interface(`auth_etc_filetrans_shadow',` ######################################## ## <summary> +## Get the attributes of the shadow history file. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`auth_getattr_shadow_history',` + gen_require(` + type shadow_history_t; + ') + + files_search_etc($1) + allow $1 shadow_history_t:file getattr; +') + +######################################## +## <summary> ## Read the shadow history file. ## </summary> ## <param name="domain"> diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index 74e9f2e9..7755e753 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -1440,6 +1440,7 @@ template(`userdom_admin_user_template',` term_use_all_terms($1_t) auth_getattr_shadow($1_t) + auth_getattr_shadow_history($1_t) # Manage almost all files files_manage_non_auth_files($1_t) files_map_non_auth_files($1_t) |