diff options
| author |   Chris PeBenito <chpebeni@linux.microsoft.com> | 2022-02-01 08:50:41 -0500 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2022-02-06 18:07:41 -0800 |
| commit | 906ec39d92b4e6cc11ff59c1d466c294be67b0b0 (patch) | |
| tree | 11fea851ca18e9c328ac7401427246e8794c249b /policy/users | |
| parent | node_exporter: Added initial policy. (diff) | |
| download | hardened-refpolicy-906ec39d92b4e6cc11ff59c1d466c294be67b0b0.tar.gz hardened-refpolicy-906ec39d92b4e6cc11ff59c1d466c294be67b0b0.tar.bz2 hardened-refpolicy-906ec39d92b4e6cc11ff59c1d466c294be67b0b0.zip | |
Revert "users: remove MCS categories from default users"
This reverts commit 7d53784332b83ee264332d9c15fa0387a483ec89.
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
Diffstat (limited to 'policy/users')
| -rw-r--r-- | policy/users | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/policy/users b/policy/users index 3f9d0fae..ca203758 100644 --- a/policy/users +++ b/policy/users @@ -15,7 +15,7 @@ # and a user process should never be assigned the system user # identity. # -gen_user(system_u,, system_r, s0, s0 - mls_systemhigh) +gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats) # # user_u is a generic user identity for Linux users who have no @@ -25,14 +25,14 @@ gen_user(system_u,, system_r, s0, s0 - mls_systemhigh) # permit any access to such users, then remove this entry. # gen_user(user_u, user, user_r, s0, s0) -gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh) -gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh) +gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) +gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats) # Until order dependence is fixed for users: ifdef(`direct_sysadm_daemon',` - gen_user(unconfined_u, unconfined, unconfined_r system_r, s0, s0 - mls_systemhigh) + gen_user(unconfined_u, unconfined, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) ',` - gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh) + gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats) ') # @@ -43,7 +43,7 @@ ifdef(`direct_sysadm_daemon',` # not in the sysadm_r. # ifdef(`direct_sysadm_daemon',` - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh) + gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) ',` - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh) + gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) ') |