dontaudit attempts by xdm_t to write to bin_t for kdm

This commit is contained in:
Dan Walsh 2010-09-29 15:03:51 -04:00
parent f6e966f3ae
commit 20f707ce5e
3 changed files with 21 additions and 1 deletions

View File

@ -163,7 +163,7 @@ interface(`corecmd_list_bin',`
######################################## ########################################
## <summary> ## <summary>
## Do not auidt attempts to write bin directories. ## Do not audit attempts to write bin directories.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@ -179,6 +179,24 @@ interface(`corecmd_dontaudit_write_bin_dirs',`
dontaudit $1 bin_t:dir write; dontaudit $1 bin_t:dir write;
') ')
########################################
## <summary>
## Do not audit attempts to write bin files.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`corecmd_dontaudit_write_bin_files',`
gen_require(`
type bin_t;
')
dontaudit $1 bin_t:file write;
')
######################################## ########################################
## <summary> ## <summary>
## Get the attributes of files in bin directories. ## Get the attributes of files in bin directories.

View File

@ -521,6 +521,7 @@ kernel_stream_connect(xdm_t)
corecmd_exec_shell(xdm_t) corecmd_exec_shell(xdm_t)
corecmd_exec_bin(xdm_t) corecmd_exec_bin(xdm_t)
corecmd_dontaudit_write_bin_files(xdm_t)
corenet_all_recvfrom_unlabeled(xdm_t) corenet_all_recvfrom_unlabeled(xdm_t)
corenet_all_recvfrom_netlabel(xdm_t) corenet_all_recvfrom_netlabel(xdm_t)

View File

@ -375,6 +375,7 @@ files_setattr_pid_dirs(initrc_t)
files_read_kernel_symbol_table(initrc_t) files_read_kernel_symbol_table(initrc_t)
files_exec_etc_files(initrc_t) files_exec_etc_files(initrc_t)
files_manage_etc_symlinks(initrc_t) files_manage_etc_symlinks(initrc_t)
files_manage_system_conf_files(initrc_t)
fs_manage_tmpfs_dirs(initrc_t) fs_manage_tmpfs_dirs(initrc_t)
fs_tmpfs_filetrans(initrc_t, initrc_state_t, file) fs_tmpfs_filetrans(initrc_t, initrc_state_t, file)