PERFORCE change 113421 for review

Todd Miller millert at FreeBSD.org
Mon Jan 22 20:18:27 UTC 2007


http://perforce.freebsd.org/chv.cgi?CH=113421

Change 113421 by millert at millert_macbook on 2007/01/22 20:14:27

	Conditionalize rules for unconfined_t.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/darwin.te#7 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/darwin.te#7 (text+ko) ====

@@ -26,26 +26,29 @@
 fs_associate(darwin_global_pref_t)
 fs_associate(darwin_private_t)
 
-# Temporary rules for unconfined_t
-mach_allow_message(unconfined_t, unconfined_t)
-mach_allow_message(unconfined_t, kernel_t)
-mach_allow_message(unconfined_t, init_t)
-mach_allow_message(unconfined_t, securityd_t)
+define(`enable_unconfined', `true')
+ifdef(`enable_unconfined',`
+	# Temporary rules for unconfined_t
+	mach_allow_message(unconfined_t, unconfined_t)
+	mach_allow_message(unconfined_t, kernel_t)
+	mach_allow_message(unconfined_t, init_t)
+	mach_allow_message(unconfined_t, securityd_t)
 
-allow unconfined_t init_t:mi_bootstrap { bootstrap_look_up bootstrap_subset };
-allow unconfined_t init_t:mi_notify_ipc { notify_server_register_check notify_server_get_state notify_server_register_plain };
-allow unconfined_t { darwin_system_t framework_t darwin_private_t darwin_CoreServices_t darwin_global_pref_t darwin_system_t darwin_host_pref_t var_vm_t }:dir { search getattr };
-allow unconfined_t { darwin_CoreServices_t darwin_global_pref_t darwin_host_pref_t }:file read;
-allow unconfined_t framework_t:{file dir lnk_file} read;
-allow unconfined_t framework_t:file getattr;
+	allow unconfined_t init_t:mi_bootstrap { bootstrap_look_up bootstrap_subset };
+	allow unconfined_t init_t:mi_notify_ipc { notify_server_register_check notify_server_get_state notify_server_register_plain };
+	allow unconfined_t { darwin_system_t framework_t darwin_private_t darwin_CoreServices_t darwin_global_pref_t darwin_system_t darwin_host_pref_t var_vm_t }:dir { search getattr };
+	allow unconfined_t { darwin_CoreServices_t darwin_global_pref_t darwin_host_pref_t }:file read;
+	allow unconfined_t framework_t:{file dir lnk_file} read;
+	allow unconfined_t framework_t:file getattr;
 
-# Allow communication with unconfined
-mach_allow_ipc(configd_t, unconfined_t)
-mach_allow_ipc(coreservicesd_t, unconfined_t)
-mach_allow_ipc(diskarbitrationd_t, unconfined_t)
-mach_allow_ipc(init_t, unconfined_t)
-mach_allow_ipc(kextd_t, unconfined_t)
-mach_allow_ipc(loginwindow_t, unconfined_t)
-mach_allow_ipc(memberd_t, unconfined_t)
-mach_allow_ipc(notifyd_t, unconfined_t)
-mach_allow_ipc(securityd_t, unconfined_t)
+	# Allow communication with unconfined
+	mach_allow_ipc(configd_t, unconfined_t)
+	mach_allow_ipc(coreservicesd_t, unconfined_t)
+	mach_allow_ipc(diskarbitrationd_t, unconfined_t)
+	mach_allow_ipc(init_t, unconfined_t)
+	mach_allow_ipc(kextd_t, unconfined_t)
+	mach_allow_ipc(loginwindow_t, unconfined_t)
+	mach_allow_ipc(memberd_t, unconfined_t)
+	mach_allow_ipc(notifyd_t, unconfined_t)
+	mach_allow_ipc(securityd_t, unconfined_t)
+')


More information about the trustedbsd-cvs mailing list