[selinux-policy: 628/3172] misc fixes
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 19:58:56 UTC 2010
commit 763a5e30c6c55bca078a4c388ee8ac9c654d3cb9
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Wed Sep 7 13:31:37 2005 +0000
misc fixes
refpolicy/policy/modules/services/nscd.te | 21 +++++++++++++--------
refpolicy/policy/modules/services/ntp.te | 6 +-----
2 files changed, 14 insertions(+), 13 deletions(-)
---
diff --git a/refpolicy/policy/modules/services/nscd.te b/refpolicy/policy/modules/services/nscd.te
index 4c54c2c..43c01dc 100644
--- a/refpolicy/policy/modules/services/nscd.te
+++ b/refpolicy/policy/modules/services/nscd.te
@@ -7,7 +7,7 @@ policy_module(nscd,1.0)
#
# nscd is both the client program and the daemon.
-type nscd_t; #, userspace_objmgr
+type nscd_t;
type nscd_exec_t;
init_daemon_domain(nscd_t,nscd_exec_t)
@@ -22,13 +22,13 @@ files_pid_file(nscd_var_run_t)
allow nscd_t self:capability { kill setgid setuid };
dontaudit nscd_t self:capability sys_tty_config;
allow nscd_t self:process { getattr setsched };
+allow nscd_t self:fifo_file { read write };
allow nscd_t self:unix_stream_socket create_stream_socket_perms;
allow nscd_t self:unix_dgram_socket create_socket_perms;
allow nscd_t self:netlink_selinux_socket create_socket_perms;
allow nscd_t self:netlink_route_socket r_netlink_socket_perms;
allow nscd_t self:tcp_socket create_socket_perms;
-allow nscd_t self:udp_socket { connect connected_socket_perms };
-allow nscd_t self:fifo_file { read write };
+allow nscd_t self:udp_socket create_socket_perms;
# For client program operation, invoked from sysadm_t.
# Transition occurs to nscd_t due to direct_sysadm_daemon.
@@ -66,6 +66,12 @@ corenet_udp_sendrecv_all_ports(nscd_t)
corenet_tcp_bind_all_nodes(nscd_t)
corenet_udp_bind_all_nodes(nscd_t)
+selinux_get_fs_mount(nscd_t)
+selinux_validate_context(nscd_t)
+selinux_compute_access_vector(nscd_t)
+selinux_compute_create_context(nscd_t)
+selinux_compute_relabel_context(nscd_t)
+selinux_compute_user_contexts(nscd_t)
domain_use_wide_inherit_fd(nscd_t)
files_read_etc_files(nscd_t)
@@ -80,6 +86,10 @@ logging_send_syslog_msg(nscd_t)
miscfiles_read_localization(nscd_t)
+seutil_read_config(nscd_t)
+seutil_read_default_contexts(nscd_t)
+seutil_sigchld_newrole(nscd_t)
+
sysnet_read_config(nscd_t)
userdom_dontaudit_use_unpriv_user_fd(nscd_t)
@@ -95,16 +105,11 @@ optional_policy(`nis.te',`
nis_use_ypbind(nscd_t)
')
-optional_policy(`selinuxutils.te',`
- seutil_sigchld_newrole(nscd_t)
-')
-
optional_policy(`udev.te', `
udev_read_db(nscd_t)
')
ifdef(`TODO',`
-
nscd_socket_domain(daemon)
optional_policy(`winbind.te', `
diff --git a/refpolicy/policy/modules/services/ntp.te b/refpolicy/policy/modules/services/ntp.te
index 97a1203..638dbe4 100644
--- a/refpolicy/policy/modules/services/ntp.te
+++ b/refpolicy/policy/modules/services/ntp.te
@@ -120,7 +120,7 @@ ifdef(`targeted_policy', `
optional_policy(`crond.te',`
# for cron jobs
# system_crond_t is not right, cron is not doing what it should
- cron_system_entry(ntpd_t,ntpd_exec_t)
+ cron_system_entry(ntpdate_t,ntpd_exec_t)
')
optional_policy(`firstboot.te',`
@@ -155,10 +155,6 @@ ifdef(`TODO',`
optional_policy(`rhgb.te',`
rhgb_domain(ntpd_t)
')
-
-# so the start script can change firewall entries
-allow initrc_t net_conf_t:file { getattr read ioctl };
-
allow ntpd_t sysadm_t:udp_socket sendto;
allow sysadm_t ntpd_t:udp_socket recvfrom;
More information about the scm-commits
mailing list