[selinux-policy: 1702/3172] Two patches from Paul Moore to for ipsec to remove redundant rules and have setkey read the config f
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 21:32:06 UTC 2010
commit a26923c32ef39bb83e17ecfe07332e24e2c95191
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Wed Mar 28 18:47:45 2007 +0000
Two patches from Paul Moore to for ipsec to remove redundant rules and have setkey read the config file.
Changelog | 2 ++
policy/modules/system/ipsec.te | 10 +++++++---
2 files changed, 9 insertions(+), 3 deletions(-)
---
diff --git a/Changelog b/Changelog
index dc1eebf..8fe62ff 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,5 @@
+- Two patches from Paul Moore to for ipsec to remove redundant rules and
+ have setkey read the config file.
- Move booleans and tunables to modules when it is only used in a single
module.
- Add support for tunables and booleans local to a module.
diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 794838b..e3897a0 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -1,5 +1,5 @@
-policy_module(ipsec,1.2.2)
+policy_module(ipsec,1.2.3)
########################################
#
@@ -330,8 +330,6 @@ logging_send_syslog_msg(racoon_t)
miscfiles_read_localization(racoon_t)
-seutil_read_config(setkey_t)
-
########################################
#
# Setkey local policy
@@ -341,6 +339,10 @@ allow setkey_t self:capability net_admin;
allow setkey_t self:key_socket { create read setopt write };
allow setkey_t self:netlink_route_socket create_netlink_socket_perms;
+allow setkey_t ipsec_conf_file_t:dir list_dir_perms;
+read_files_pattern(setkey_t,ipsec_conf_file_t,ipsec_conf_file_t)
+read_lnk_files_pattern(setkey_t,ipsec_conf_file_t,ipsec_conf_file_t)
+
# allow setkey to set the context for ipsec SAs and policy.
allow setkey_t ipsec_spd_t:association setcontext;
@@ -349,6 +351,8 @@ domain_ipsec_setcontext_all_domains(setkey_t)
files_read_etc_files(setkey_t)
+init_dontaudit_use_fds(setkey_t)
+
locallogin_use_fds(setkey_t)
libs_use_ld_so(setkey_t)
More information about the scm-commits
mailing list