summaryrefslogtreecommitdiff
path: root/Makefile.am
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2012-09-06 16:23:11 -0400
committerLennart Poettering <lennart@poettering.net>2012-09-18 01:21:17 +0200
commite2417e4143bb892e4599b01de7b031763421bb64 (patch)
tree28ce7be138180c76054bac7bfa0b30d1a653c7b5 /Makefile.am
parente9ace802cf907d3652e1ef082b39a0cbed4e19a7 (diff)
selinux: add bus service access control
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch adds the ability to look at the calling process that is trying to do dbus calls into systemd, then it checks with the SELinux policy to see if the calling process is allowed to do the activity. The basic idea is we want to allow NetworkManager_t to be able to start and stop ntpd.service, but not necessarly mysqld.service. Similarly we want to allow a root admin webadm_t that can only manage the apache environment. systemctl enable httpd.service, systemctl disable iptables.service bad. To make this code cleaner, we really need to refactor the dbus-manager.c code. This has just become a huge if-then-else blob, which makes doing the correct check difficult. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlBJBi8ACgkQrlYvE4MpobOzTwCdEUikbvRWUCwOb83KlVF0Nuy5 lRAAnjZZNuc19Z+aNxm3k3nwD4p/JYco =yops -----END PGP SIGNATURE-----
Diffstat (limited to 'Makefile.am')
-rw-r--r--Makefile.am2
1 files changed, 2 insertions, 0 deletions
diff --git a/Makefile.am b/Makefile.am
index 6d211404fe..637a5367b1 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -977,6 +977,8 @@ libsystemd_core_la_SOURCES = \
src/core/dbus-path.h \
src/core/cgroup.c \
src/core/cgroup.h \
+ src/core/selinux-access.c \
+ src/core/selinux-access.h \
src/core/selinux-setup.c \
src/core/selinux-setup.h \
src/core/ima-setup.c \