selinux-policy/policy/modules/services/bind.te


policy_module(bind, 1.7.1)

########################################
#
# Declarations
#

## <desc>
## <p>
## Allow BIND to write the master zone files.
## Generally this is used for dynamic DNS or zone transfers.
## </p>
## </desc>
gen_tunable(named_write_master_zones, false)

# for DNSSEC key files
type dnssec_t;
files_security_file(dnssec_t)

type named_t;
type named_exec_t;
init_daemon_domain(named_t, named_exec_t)
role system_r types named_t;

type named_checkconf_exec_t;
init_system_domain(named_t, named_checkconf_exec_t)

# A type for configuration files of named.
type named_conf_t;
files_type(named_conf_t)
files_mountpoint(named_conf_t)

# for secondary zone files
type named_cache_t;
files_type(named_cache_t)

type named_log_t;
logging_log_file(named_log_t)

type named_tmp_t;
files_tmp_file(named_tmp_t)

type named_var_run_t;
files_pid_file(named_var_run_t)

# for primary zone files
type named_zone_t;
files_type(named_zone_t)

type ndc_t;
type ndc_exec_t;
init_system_domain(ndc_t, ndc_exec_t)
role system_r types ndc_t;

########################################
#
# Named local policy
#

allow named_t self:capability { chown dac_override fowner setgid setuid sys_chroot sys_nice sys_resource };
dontaudit named_t self:capability sys_tty_config;
allow named_t self:process { setsched setcap setrlimit signal_perms };
allow named_t self:fifo_file rw_fifo_file_perms;
allow named_t self:unix_stream_socket create_stream_socket_perms;
allow named_t self:unix_dgram_socket create_socket_perms;
allow named_t self:tcp_socket create_stream_socket_perms;
allow named_t self:udp_socket create_socket_perms;

allow named_t dnssec_t:file { getattr read };

# read configuration
allow named_t named_conf_t:dir list_dir_perms;
read_files_pattern(named_t, named_conf_t, named_conf_t)
read_lnk_files_pattern(named_t, named_conf_t, named_conf_t)

# write cache for secondary zones
manage_files_pattern(named_t, named_cache_t, named_cache_t)
manage_lnk_files_pattern(named_t, named_cache_t, named_cache_t)

can_exec(named_t, named_exec_t)

manage_files_pattern(named_t, named_log_t, named_log_t)
logging_log_filetrans(named_t, named_log_t, { file dir })

manage_dirs_pattern(named_t, named_tmp_t, named_tmp_t)
manage_files_pattern(named_t, named_tmp_t, named_tmp_t)
files_tmp_filetrans(named_t, named_tmp_t, { file dir })

manage_files_pattern(named_t, named_var_run_t, named_var_run_t)
manage_sock_files_pattern(named_t, named_var_run_t, named_var_run_t)
files_pid_filetrans(named_t, named_var_run_t, { file sock_file })

# read zone files
allow named_t named_zone_t:dir list_dir_perms;
read_files_pattern(named_t, named_zone_t, named_zone_t)
read_lnk_files_pattern(named_t, named_zone_t, named_zone_t)

kernel_read_kernel_sysctls(named_t)
kernel_read_system_state(named_t)
kernel_read_network_state(named_t)

corecmd_search_bin(named_t)

corenet_all_recvfrom_unlabeled(named_t)
corenet_all_recvfrom_netlabel(named_t)
corenet_tcp_sendrecv_all_if(named_t)
corenet_udp_sendrecv_all_if(named_t)
corenet_tcp_sendrecv_all_nodes(named_t)
corenet_udp_sendrecv_all_nodes(named_t)
corenet_tcp_sendrecv_all_ports(named_t)
corenet_udp_sendrecv_all_ports(named_t)
corenet_tcp_bind_all_nodes(named_t)
corenet_udp_bind_all_nodes(named_t)
corenet_tcp_bind_dns_port(named_t)
corenet_udp_bind_dns_port(named_t)
corenet_tcp_bind_rndc_port(named_t)
corenet_tcp_connect_all_ports(named_t)
corenet_sendrecv_dns_server_packets(named_t)
corenet_sendrecv_dns_client_packets(named_t)
corenet_sendrecv_rndc_server_packets(named_t)
corenet_sendrecv_rndc_client_packets(named_t)
corenet_udp_bind_all_unreserved_ports(named_t)

dev_read_sysfs(named_t)
dev_read_rand(named_t)
dev_read_urand(named_t)

domain_use_interactive_fds(named_t)

files_read_etc_files(named_t)
files_read_etc_runtime_files(named_t)

fs_getattr_all_fs(named_t)
fs_search_auto_mountpoints(named_t)

auth_use_nsswitch(named_t)

libs_use_ld_so(named_t)
libs_use_shared_libs(named_t)

logging_send_syslog_msg(named_t)

miscfiles_read_localization(named_t)
miscfiles_read_certs(named_t)

sysnet_read_config(named_t)

userdom_dontaudit_use_unpriv_user_fds(named_t)

sysadm_dontaudit_search_home_dirs(named_t)

tunable_policy(`named_write_master_zones',`
	manage_dirs_pattern(named_t, named_zone_t, named_zone_t)
	manage_files_pattern(named_t, named_zone_t,named_zone_t)
	manage_lnk_files_pattern(named_t, named_zone_t, named_zone_t)
')

optional_policy(`
	init_dbus_chat_script(named_t)

	sysnet_dbus_chat_dhcpc(named_t)

	dbus_system_bus_client_template(named, named_t)
	dbus_connect_system_bus(named_t)

	optional_policy(`
		networkmanager_dbus_chat(named_t)
	')
')

optional_policy(`
	kerberos_use(named_t)
')

optional_policy(`
	# this seems like fds that arent being
	# closed.  these should probably be
	# dontaudits instead.
	networkmanager_rw_udp_sockets(named_t)
	networkmanager_rw_packet_sockets(named_t)
	networkmanager_rw_routing_sockets(named_t)
')

optional_policy(`
	seutil_sigchld_newrole(named_t)
')

optional_policy(`
	udev_read_db(named_t)
')

########################################
#
# NDC local policy
#

# cjp: why net_admin?!
allow ndc_t self:capability { dac_override net_admin };
allow ndc_t self:process { fork signal_perms };
allow ndc_t self:fifo_file { read write getattr ioctl };
allow ndc_t self:unix_stream_socket { connect create_stream_socket_perms };
allow ndc_t self:tcp_socket create_socket_perms;
allow ndc_t self:netlink_route_socket r_netlink_socket_perms;

allow ndc_t dnssec_t:file { getattr read };
allow ndc_t dnssec_t:lnk_file { getattr read };

allow ndc_t named_t:unix_stream_socket connectto;

allow ndc_t named_conf_t:file { getattr read };
allow ndc_t named_conf_t:lnk_file { getattr read };

allow ndc_t named_var_run_t:sock_file rw_file_perms;

allow ndc_t named_zone_t:dir search;

kernel_read_kernel_sysctls(ndc_t)

corenet_all_recvfrom_unlabeled(ndc_t)
corenet_all_recvfrom_netlabel(ndc_t)
corenet_tcp_sendrecv_all_if(ndc_t)
corenet_tcp_sendrecv_all_nodes(ndc_t)
corenet_tcp_sendrecv_all_ports(ndc_t)
corenet_tcp_connect_rndc_port(ndc_t)
corenet_sendrecv_rndc_client_packets(ndc_t)

domain_use_interactive_fds(ndc_t)

files_read_etc_files(ndc_t)
files_search_pids(ndc_t)

fs_getattr_xattr_fs(ndc_t)

init_use_fds(ndc_t)
init_use_script_ptys(ndc_t)

libs_use_ld_so(ndc_t)
libs_use_shared_libs(ndc_t)

logging_send_syslog_msg(ndc_t)

miscfiles_read_localization(ndc_t)

sysnet_read_config(ndc_t)
sysnet_dns_name_resolve(ndc_t)

# for /etc/rndc.key
ifdef(`distro_redhat',`
	allow ndc_t named_conf_t:dir search;
')

optional_policy(`
	nis_use_ypbind(ndc_t)
')

optional_policy(`
	nscd_socket_use(ndc_t)
')

optional_policy(`
	ppp_dontaudit_use_fds(ndc_t)
')
add bind 2005-08-23 17:26:19 +00:00
trunk: Logrotate and Bind updates from Vaclav Ovsik. 2008-09-03 14:12:56 +00:00			`policy_module(bind, 1.7.1)`
add bind 2005-08-23 17:26:19 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00			`## <desc>`
			`## <p>`
			`## Allow BIND to write the master zone files.`
trunk: Improve several tunables descriptions from Dan Walsh. 2007-12-07 15:44:53 +00:00			`## Generally this is used for dynamic DNS or zone transfers.`
- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00			`## </p>`
			`## </desc>`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`gen_tunable(named_write_master_zones, false)`
- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00
add bind 2005-08-23 17:26:19 +00:00			`# for DNSSEC key files`
start adding secure_file_type implementation 2005-09-28 19:07:22 +00:00			`type dnssec_t;`
			`files_security_file(dnssec_t)`
add bind 2005-08-23 17:26:19 +00:00
			`type named_t;`
			`type named_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_daemon_domain(named_t, named_exec_t)`
add bind 2005-08-23 17:26:19 +00:00			`role system_r types named_t;`

more updates 2005-09-15 21:03:29 +00:00			`type named_checkconf_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_system_domain(named_t, named_checkconf_exec_t)`
more updates 2005-09-15 21:03:29 +00:00
add bind 2005-08-23 17:26:19 +00:00			`# A type for configuration files of named.`
			`type named_conf_t;`
			`files_type(named_conf_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00			`files_mountpoint(named_conf_t)`
add bind 2005-08-23 17:26:19 +00:00
			`# for secondary zone files`
			`type named_cache_t;`
			`files_type(named_cache_t)`

more updates 2005-09-15 21:03:29 +00:00			`type named_log_t;`
			`logging_log_file(named_log_t)`

add bind 2005-08-23 17:26:19 +00:00			`type named_tmp_t;`
			`files_tmp_file(named_tmp_t)`

			`type named_var_run_t;`
			`files_pid_file(named_var_run_t)`

			`# for primary zone files`
			`type named_zone_t;`
			`files_type(named_zone_t)`

			`type ndc_t;`
			`type ndc_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_system_domain(ndc_t, ndc_exec_t)`
add bind 2005-08-23 17:26:19 +00:00			`role system_r types ndc_t;`

			`########################################`
			`#`
			`# Named local policy`
			`#`

			`allow named_t self:capability { chown dac_override fowner setgid setuid sys_chroot sys_nice sys_resource };`
			`dontaudit named_t self:capability sys_tty_config;`
Added rules to the bind policy for the named server so that it would start 2005-10-24 18:06:31 +00:00			`allow named_t self:process { setsched setcap setrlimit signal_perms };`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow named_t self:fifo_file rw_fifo_file_perms;`
add bind 2005-08-23 17:26:19 +00:00			`allow named_t self:unix_stream_socket create_stream_socket_perms;`
			`allow named_t self:unix_dgram_socket create_socket_perms;`
			`allow named_t self:tcp_socket create_stream_socket_perms;`
			`allow named_t self:udp_socket create_socket_perms;`

			`allow named_t dnssec_t:file { getattr read };`

			`# read configuration`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow named_t named_conf_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(named_t, named_conf_t, named_conf_t)`
			`read_lnk_files_pattern(named_t, named_conf_t, named_conf_t)`
add bind 2005-08-23 17:26:19 +00:00
			`# write cache for secondary zones`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(named_t, named_cache_t, named_cache_t)`
			`manage_lnk_files_pattern(named_t, named_cache_t, named_cache_t)`
add bind 2005-08-23 17:26:19 +00:00
			`can_exec(named_t, named_exec_t)`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(named_t, named_log_t, named_log_t)`
			`logging_log_filetrans(named_t, named_log_t, { file dir })`
more updates 2005-09-15 21:03:29 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(named_t, named_tmp_t, named_tmp_t)`
			`manage_files_pattern(named_t, named_tmp_t, named_tmp_t)`
another round of renaming 2006-02-21 18:40:44 +00:00			`files_tmp_filetrans(named_t, named_tmp_t, { file dir })`
add bind 2005-08-23 17:26:19 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(named_t, named_var_run_t, named_var_run_t)`
			`manage_sock_files_pattern(named_t, named_var_run_t, named_var_run_t)`
			`files_pid_filetrans(named_t, named_var_run_t, { file sock_file })`
add bind 2005-08-23 17:26:19 +00:00
			`# read zone files`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow named_t named_zone_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(named_t, named_zone_t, named_zone_t)`
			`read_lnk_files_pattern(named_t, named_zone_t, named_zone_t)`
add bind 2005-08-23 17:26:19 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(named_t)`
add bind 2005-08-23 17:26:19 +00:00			`kernel_read_system_state(named_t)`
			`kernel_read_network_state(named_t)`

trunk: reorganize amanda and bind 2007-10-12 17:50:11 +00:00			`corecmd_search_bin(named_t)`

trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(named_t)`
			`corenet_all_recvfrom_netlabel(named_t)`
add bind 2005-08-23 17:26:19 +00:00			`corenet_tcp_sendrecv_all_if(named_t)`
			`corenet_udp_sendrecv_all_if(named_t)`
			`corenet_tcp_sendrecv_all_nodes(named_t)`
			`corenet_udp_sendrecv_all_nodes(named_t)`
			`corenet_tcp_sendrecv_all_ports(named_t)`
			`corenet_udp_sendrecv_all_ports(named_t)`
			`corenet_tcp_bind_all_nodes(named_t)`
			`corenet_udp_bind_all_nodes(named_t)`
			`corenet_tcp_bind_dns_port(named_t)`
			`corenet_udp_bind_dns_port(named_t)`
more updates 2005-09-15 21:03:29 +00:00			`corenet_tcp_bind_rndc_port(named_t)`
			`corenet_tcp_connect_all_ports(named_t)`
packet updates for kernel, nscd, bind, ntp, spamassassin, and dhcpc 2006-05-26 18:04:46 +00:00			`corenet_sendrecv_dns_server_packets(named_t)`
			`corenet_sendrecv_dns_client_packets(named_t)`
			`corenet_sendrecv_rndc_server_packets(named_t)`
			`corenet_sendrecv_rndc_client_packets(named_t)`
trunk: 2 patches from dan. 2007-10-12 17:35:56 +00:00			`corenet_udp_bind_all_unreserved_ports(named_t)`
add bind 2005-08-23 17:26:19 +00:00
			`dev_read_sysfs(named_t)`
			`dev_read_rand(named_t)`
patch from dan Thu, 18 May 2006 11:56:22 -0400 2006-05-19 14:02:24 +00:00			`dev_read_urand(named_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(named_t)`
add bind 2005-08-23 17:26:19 +00:00
			`files_read_etc_files(named_t)`
			`files_read_etc_runtime_files(named_t)`

trunk: reorganize amanda and bind 2007-10-12 17:50:11 +00:00			`fs_getattr_all_fs(named_t)`
			`fs_search_auto_mountpoints(named_t)`

trunk: 2 patches from dan. 2007-10-12 17:35:56 +00:00			`auth_use_nsswitch(named_t)`

add bind 2005-08-23 17:26:19 +00:00			`libs_use_ld_so(named_t)`
			`libs_use_shared_libs(named_t)`

			`logging_send_syslog_msg(named_t)`

			`miscfiles_read_localization(named_t)`
patch from dan Thu, 18 May 2006 11:56:22 -0400 2006-05-19 14:02:24 +00:00			`miscfiles_read_certs(named_t)`
add bind 2005-08-23 17:26:19 +00:00
			`sysnet_read_config(named_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(named_t)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00
			`sysadm_dontaudit_search_home_dirs(named_t)`
add bind 2005-08-23 17:26:19 +00:00
many loadable module build fixes 2005-12-02 22:06:05 +00:00			tunable_policy(`named_write_master_zones',`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(named_t, named_zone_t, named_zone_t)`
			`manage_files_pattern(named_t, named_zone_t,named_zone_t)`
			`manage_lnk_files_pattern(named_t, named_zone_t, named_zone_t)`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`init_dbus_chat_script(named_t)`

			`sysnet_dbus_chat_dhcpc(named_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`dbus_system_bus_client_template(named, named_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00			`dbus_connect_system_bus(named_t)`
many loadable module build fixes 2005-12-02 22:06:05 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`networkmanager_dbus_chat(named_t)`
			`')`
			`')`

trunk: 2 patches from dan. 2007-10-12 17:35:56 +00:00			optional_policy(`
			`kerberos_use(named_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`# this seems like fds that arent being`
			`# closed. these should probably be`
			`# dontaudits instead.`
another slew of renaming 2006-02-02 21:08:12 +00:00			`networkmanager_rw_udp_sockets(named_t)`
			`networkmanager_rw_packet_sockets(named_t)`
			`networkmanager_rw_routing_sockets(named_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add bind 2005-08-23 17:26:19 +00:00			`seutil_sigchld_newrole(named_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add bind 2005-08-23 17:26:19 +00:00			`udev_read_db(named_t)`
			`')`

			`########################################`
			`#`
			`# NDC local policy`
			`#`

			`# cjp: why net_admin?!`
			`allow ndc_t self:capability { dac_override net_admin };`
			`allow ndc_t self:process { fork signal_perms };`
			`allow ndc_t self:fifo_file { read write getattr ioctl };`
			`allow ndc_t self:unix_stream_socket { connect create_stream_socket_perms };`
			`allow ndc_t self:tcp_socket create_socket_perms;`
			`allow ndc_t self:netlink_route_socket r_netlink_socket_perms;`

			`allow ndc_t dnssec_t:file { getattr read };`
patch from dan Wed, 23 Aug 2006 14:03:49 -0400 2006-08-29 02:41:00 +00:00			`allow ndc_t dnssec_t:lnk_file { getattr read };`
add bind 2005-08-23 17:26:19 +00:00
			`allow ndc_t named_t:unix_stream_socket connectto;`

			`allow ndc_t named_conf_t:file { getattr read };`
patch from dan Fri, 22 Sep 2006 16:30:34 -0400 2006-09-25 18:53:06 +00:00			`allow ndc_t named_conf_t:lnk_file { getattr read };`
add bind 2005-08-23 17:26:19 +00:00
			`allow ndc_t named_var_run_t:sock_file rw_file_perms;`

			`allow ndc_t named_zone_t:dir search;`

renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(ndc_t)`
			`corenet_all_recvfrom_netlabel(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00			`corenet_tcp_sendrecv_all_if(ndc_t)`
			`corenet_tcp_sendrecv_all_nodes(ndc_t)`
			`corenet_tcp_sendrecv_all_ports(ndc_t)`
more updates 2005-09-15 21:03:29 +00:00			`corenet_tcp_connect_rndc_port(ndc_t)`
packet updates for kernel, nscd, bind, ntp, spamassassin, and dhcpc 2006-05-26 18:04:46 +00:00			`corenet_sendrecv_rndc_client_packets(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
			`files_read_etc_files(ndc_t)`
			`files_search_pids(ndc_t)`

trunk: reorganize amanda and bind 2007-10-12 17:50:11 +00:00			`fs_getattr_xattr_fs(ndc_t)`

make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`init_use_fds(ndc_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
			`libs_use_ld_so(ndc_t)`
			`libs_use_shared_libs(ndc_t)`

			`logging_send_syslog_msg(ndc_t)`

			`miscfiles_read_localization(ndc_t)`

			`sysnet_read_config(ndc_t)`
more updates 2005-09-15 21:03:29 +00:00			`sysnet_dns_name_resolve(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
			`# for /etc/rndc.key`
			ifdef(`distro_redhat',`
			`allow ndc_t named_conf_t:dir search;`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add bind 2005-08-23 17:26:19 +00:00			`nis_use_ypbind(ndc_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another slew of renaming 2006-02-02 21:08:12 +00:00			`nscd_socket_use(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00			`')`
add networkmanager 2005-10-22 17:44:04 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`ppp_dontaudit_use_fds(ndc_t)`
pile of sediff fixes 2005-11-08 22:00:30 +00:00			`')`