From: bigon@debian.org (Laurent Bigonville) Date: Wed, 5 Sep 2012 17:50:28 +0200 Subject: [refpolicy] [PATCH v2 2/3] user access to DOS filesystems In-Reply-To: <1346828428.15262.53.camel@d30.localdomain> References: <1346828428.15262.53.camel@d30.localdomain> Message-ID: <1346860228-12760-1-git-send-email-bigon@debian.org> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com From: Mika Pfl?ger Add a new boolean to grant users access to dosfs_t. --- policy/global_tunables | 7 +++++++ policy/modules/system/userdomain.if | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/policy/global_tunables b/policy/global_tunables index 4705ab6..092df0b 100644 --- a/policy/global_tunables +++ b/policy/global_tunables @@ -111,3 +111,10 @@ gen_tunable(use_samba_home_dirs,false) ##

## gen_tunable(user_tcp_server,false) + +## +##

+## Determine whether users can manage dosfs content. +##

+## +gen_tunable(userdomain_manage_dos_content,false) diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index e720dcd..949c738 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -117,6 +117,12 @@ template(`userdom_base_user_template',` # Allow making the stack executable via mprotect. allow $1_t self:process execstack; ') + + tunable_policy(`userdomain_manage_dos_content',` + fs_manage_dos_dirs($1_t) + fs_manage_dos_files($1_t) + ') + ') ####################################### -- 1.7.10.4