diff --git a/policy/modules/contrib/screen.fc b/policy/modules/contrib/screen.fc index 661fcc0791..14e7b3c3fa 100644 --- a/policy/modules/contrib/screen.fc +++ b/policy/modules/contrib/screen.fc @@ -2,6 +2,9 @@ HOME_DIR/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0) HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0) HOME_DIR/\.tmux\.conf -- gen_context(system_u:object_r:screen_home_t,s0) +/root/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0) +/root/\.tmux\.conf -- gen_context(system_u:object_r:screen_home_t,s0) + /root/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0) /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0) diff --git a/policy/modules/contrib/screen.if b/policy/modules/contrib/screen.if index 57cc45e211..fb5bb83473 100644 --- a/policy/modules/contrib/screen.if +++ b/policy/modules/contrib/screen.if @@ -48,7 +48,7 @@ template(`screen_role_template',` domtrans_pattern($3, screen_exec_t, $1_screen_t) allow $3 $1_screen_t:process { signal sigchld }; - dontaudit $3 $1_screen_t:unix_stream_socket { ioctl read write }; + allow $3 $1_screen_t:unix_stream_socket { ioctl read write }; allow $1_screen_t $3:unix_stream_socket { connectto }; allow $1_screen_t $3:process signal; allow $3 screen_exec_t:file entrypoint; @@ -99,6 +99,35 @@ template(`screen_role_template',` ') ') +####################################### +## +## The admin role template for the screen module +## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +## +## The role associated with the user domain. +## +## +## +## +## The type of the user domain. +## +## +# +template(`screen_admin_role_template',` + screen_role_template($1, $2, $3) + + userdom_admin_home_dir_filetrans($1_screen_t, screen_home_t, file, ".screenrc") + userdom_admin_home_dir_filetrans($1_screen_t, screen_home_t, file, ".tmux.conf") +') + + ####################################### ## ## Execute the rssh program diff --git a/policy/modules/roles/auditadm.te b/policy/modules/roles/auditadm.te index 404a5c6770..5375a5f0f3 100644 --- a/policy/modules/roles/auditadm.te +++ b/policy/modules/roles/auditadm.te @@ -48,7 +48,7 @@ optional_policy(` ') optional_policy(` - screen_role_template(auditadm, auditadm_r, auditadm_t) + screen_admin_role_template(auditadm, auditadm_r, auditadm_t) ') optional_policy(` diff --git a/policy/modules/roles/secadm.te b/policy/modules/roles/secadm.te index 782a09758c..55868cf9b4 100644 --- a/policy/modules/roles/secadm.te +++ b/policy/modules/roles/secadm.te @@ -63,7 +63,7 @@ optional_policy(` ') optional_policy(` - screen_role_template(secadm, secadm_r, secadm_t) + screen_admin_role_template(secadm, secadm_r, secadm_t) ') optional_policy(` diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index ea5bf7ae7a..f7afd1be4c 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -561,7 +561,7 @@ optional_policy(` ') optional_policy(` - screen_role_template(sysadm, sysadm_r, sysadm_t) + screen_admin_role_template(sysadm, sysadm_r, sysadm_t) allow sysadm_screen_t self:capability { dac_read_search dac_override chown }; ')