rpms/selinux-policy
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Clamav patch from Dan Walsh.

Browse Source
This commit is contained in:
Chris PeBenito 2010-05-03 15:01:35 -04:00
parent d8eb3c71c6
commit 4804cd43a0
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/services/clamav.if
View File

@ -133,7 +133,7 @@ interface(`clamav_exec_clamscan',`
######################################## ########################################
## <summary> ## <summary>
## All of the rules required to administrate ## All of the rules required to administrate
## an clamav environment ## an clamav environment
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">

18
policy/modules/services/clamav.te
View File

@ -1,5 +1,12 @@
policy_module(clamav, 1.7.1) policy_module(clamav, 1.7.2)
## <desc>
## <p>
## Allow clamd to use JIT compiler
## </p>
## </desc>
gen_tunable(clamd_use_jit, false)
######################################## ########################################
# #
@ -57,6 +64,7 @@ logging_log_file(freshclam_var_log_t)
# #
allow clamd_t self:capability { kill setgid setuid dac_override }; allow clamd_t self:capability { kill setgid setuid dac_override };
dontaudit clamd_t self:capability sys_tty_config;
allow clamd_t self:fifo_file rw_fifo_file_perms; allow clamd_t self:fifo_file rw_fifo_file_perms;
allow clamd_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow clamd_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow clamd_t self:unix_dgram_socket create_socket_perms; allow clamd_t self:unix_dgram_socket create_socket_perms;
@ -189,6 +197,8 @@ files_read_etc_runtime_files(freshclam_t)
auth_use_nsswitch(freshclam_t) auth_use_nsswitch(freshclam_t)
logging_send_syslog_msg(freshclam_t)
miscfiles_read_localization(freshclam_t) miscfiles_read_localization(freshclam_t)
clamav_stream_connect(freshclam_t) clamav_stream_connect(freshclam_t)
@ -246,6 +256,12 @@ clamav_stream_connect(clamscan_t)
mta_send_mail(clamscan_t) mta_send_mail(clamscan_t)
tunable_policy(`clamd_use_jit',`
allow clamd_t self:process execmem;
', `
dontaudit clamd_t self:process execmem;
')
optional_policy(` optional_policy(`
amavis_read_spool_files(clamscan_t) amavis_read_spool_files(clamscan_t)
') ')