Index: sandbox/linux/selinux/chromium-browser.te |
diff --git a/sandbox/linux/selinux/chromium-browser.te b/sandbox/linux/selinux/chromium-browser.te |
deleted file mode 100644 |
index ae2f8b7a46ad144526530c0dc1c9b35a53876a3d..0000000000000000000000000000000000000000 |
--- a/sandbox/linux/selinux/chromium-browser.te |
+++ /dev/null |
@@ -1,40 +0,0 @@ |
-policy_module(chromium-browser,1.0.0) |
- |
-gen_require(` |
- type gnome_home_t; |
- type proc_t; |
- type tmpfs_t; |
- type unconfined_t; |
- type urandom_device_t; |
- type user_devpts_t; |
- type user_tmpfs_t; |
-') |
- |
-type chromium_renderer_t; |
-domain_base_type(chromium_renderer_t) |
-role unconfined_r types chromium_renderer_t; |
- |
-allow unconfined_t chromium_renderer_t:process { dyntransition }; |
- |
-allow chromium_renderer_t unconfined_t:unix_stream_socket { read write send_msg recv_msg }; |
-allow unconfined_t chromium_renderer_t:unix_stream_socket { read write send_msg recv_msg }; |
- |
-allow chromium_renderer_t urandom_device_t:chr_file { read }; |
-allow chromium_renderer_t user_devpts_t:chr_file { write }; |
-allow chromium_renderer_t self:process { execmem }; |
-allow chromium_renderer_t self:fifo_file { read write }; |
-allow chromium_renderer_t self:unix_dgram_socket { read write create send_msg recv_msg sendto }; |
-allow chromium_renderer_t unconfined_t:unix_dgram_socket { read write send_msg recv_msg }; |
-allow unconfined_t chromium_renderer_t:unix_dgram_socket { read write send_msg recv_msg }; |
-allow chromium_renderer_t user_tmpfs_t:file { read write append open getattr }; |
-allow chromium_renderer_t tmpfs_t:file { read write }; |
-allow chromium_renderer_t self:shm { create destroy getattr setattr read write associate unix_read unix_write }; |
- |
-# For reading dictionaries out of the user-data-dir |
-allow chromium_renderer_t gnome_home_t:file { read getattr }; |
- |
-miscfiles_read_localization(chromium_renderer_t); |
-miscfiles_read_fonts(chromium_renderer_t); |
- |
-# The renderer will attempt to read meminfo |
-dontaudit chromium_renderer_t proc_t:file { read }; |