[selinux-policy: 2567/3172] Tuned patch from Dan Walsh.
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 22:48:08 UTC 2010
commit 461b53e028adf6228be0a001c37e94dc54190d30
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Mon Mar 22 10:33:31 2010 -0400
Tuned patch from Dan Walsh.
policy/modules/services/tuned.fc | 3 +++
policy/modules/services/tuned.te | 11 +++++++++++
2 files changed, 14 insertions(+), 0 deletions(-)
---
diff --git a/policy/modules/services/tuned.fc b/policy/modules/services/tuned.fc
index 2188cc8..639c962 100644
--- a/policy/modules/services/tuned.fc
+++ b/policy/modules/services/tuned.fc
@@ -2,4 +2,7 @@
/usr/sbin/tuned -- gen_context(system_u:object_r:tuned_exec_t,s0)
+/var/log/tuned(/.*)? gen_context(system_u:object_r:tuned_log_t,s0)
+/var/log/tuned\.log -- gen_context(system_u:object_r:tuned_log_t,s0)
+
/var/run/tuned\.pid -- gen_context(system_u:object_r:tuned_var_run_t,s0)
diff --git a/policy/modules/services/tuned.te b/policy/modules/services/tuned.te
index 8e40b3b..fef3fe2 100644
--- a/policy/modules/services/tuned.te
+++ b/policy/modules/services/tuned.te
@@ -13,6 +13,9 @@ init_daemon_domain(tuned_t, tuned_exec_t)
type tuned_initrc_exec_t;
init_script_file(tuned_initrc_exec_t)
+type tuned_log_t;
+logging_log_file(tuned_log_t)
+
type tuned_var_run_t;
files_pid_file(tuned_var_run_t)
@@ -23,14 +26,20 @@ files_pid_file(tuned_var_run_t)
dontaudit tuned_t self:capability { dac_override sys_tty_config };
+manage_dirs_pattern(tuned_t, tuned_log_t, tuned_log_t)
+manage_files_pattern(tuned_t, tuned_log_t, tuned_log_t)
+logging_log_filetrans(tuned_t, tuned_log_t, file)
+
manage_files_pattern(tuned_t, tuned_var_run_t, tuned_var_run_t)
files_pid_filetrans(tuned_t, tuned_var_run_t, file)
corecmd_exec_shell(tuned_t)
+corecmd_exec_bin(tuned_t)
kernel_read_system_state(tuned_t)
kernel_read_network_state(tuned_t)
+dev_read_urand(tuned_t)
dev_read_sysfs(tuned_t)
# to allow cpu tuning
dev_rw_netcontrol(tuned_t)
@@ -39,6 +48,8 @@ files_read_etc_files(tuned_t)
files_read_usr_files(tuned_t)
files_dontaudit_search_home(tuned_t)
+logging_send_syslog_msg(tuned_t)
+
miscfiles_read_localization(tuned_t)
userdom_dontaudit_search_user_home_dirs(tuned_t)
More information about the scm-commits
mailing list