loadable module build fixes
This commit is contained in:
parent
058f3efd60
commit
7572070111
@ -62,3 +62,19 @@ interface(`amanda_search_lib',`
|
|||||||
allow $1 amanda_usr_lib_t:dir search;
|
allow $1 amanda_usr_lib_t:dir search;
|
||||||
files_search_usr($1)
|
files_search_usr($1)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Do not audit attempts to read /etc/dumpdates.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## Domain to not audit.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`amanda_dontaudit_read_dumpdates',`
|
||||||
|
gen_require(`
|
||||||
|
type amanda_dumpdates_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
dontaudit $1 amanda_dumpdates_t:file { getattr read };
|
||||||
|
')
|
||||||
|
@ -175,3 +175,22 @@ interface(`rpm_manage_db',`
|
|||||||
allow $1 rpm_var_lib_t:file { getattr create read write append unlink };
|
allow $1 rpm_var_lib_t:file { getattr create read write append unlink };
|
||||||
allow $1 rpm_var_lib_t:lnk_file { getattr read write unlink };
|
allow $1 rpm_var_lib_t:lnk_file { getattr read write unlink };
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Do not audit attempts to create, read,
|
||||||
|
## write, and delete the RPM package database.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## Domain to not audit.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`rpm_dontaudit_manage_db',`
|
||||||
|
gen_require(`
|
||||||
|
type rpm_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
dontaudit $1 rpm_var_lib_t:dir rw_dir_perms;
|
||||||
|
dontaudit $1 rpm_var_lib_t:file create_file_perms;
|
||||||
|
dontaudit $1 rpm_var_lib_t:lnk_file create_lnk_perms;
|
||||||
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(snmp,1.0)
|
policy_module(snmp,1.0.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -117,6 +117,7 @@ userdom_dontaudit_search_sysadm_home_dir(snmpd_t)
|
|||||||
ifdef(`distro_redhat', `
|
ifdef(`distro_redhat', `
|
||||||
optional_policy(`rpm',`
|
optional_policy(`rpm',`
|
||||||
rpm_read_db(snmpd_t)
|
rpm_read_db(snmpd_t)
|
||||||
|
rpm_dontaudit_manage_db(snmpd_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -126,6 +127,10 @@ ifdef(`targeted_policy', `
|
|||||||
files_dontaudit_read_root_file(snmpd_t)
|
files_dontaudit_read_root_file(snmpd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
optional_policy(`amanda',`
|
||||||
|
amanda_dontaudit_read_dumpdates(snmpd_t)
|
||||||
|
')
|
||||||
|
|
||||||
optional_policy(`nis',`
|
optional_policy(`nis',`
|
||||||
nis_use_ypbind(snmpd_t)
|
nis_use_ypbind(snmpd_t)
|
||||||
')
|
')
|
||||||
@ -151,16 +156,5 @@ optional_policy(`cupsd',`
|
|||||||
')
|
')
|
||||||
') dnl end TODO
|
') dnl end TODO
|
||||||
|
|
||||||
ifdef(`distro_redhat', `
|
|
||||||
optional_policy(`rpm',`
|
|
||||||
dontaudit snmpd_t rpm_var_lib_t:dir write;
|
|
||||||
dontaudit snmpd_t rpm_var_lib_t:file write;
|
|
||||||
')
|
|
||||||
')
|
|
||||||
|
|
||||||
optional_policy(`amanda',`
|
|
||||||
dontaudit snmpd_t amanda_dumpdates_t:file { getattr read };
|
|
||||||
')
|
|
||||||
|
|
||||||
allow snmpd_t rpc_pipefs_t:dir getattr;
|
allow snmpd_t rpc_pipefs_t:dir getattr;
|
||||||
allow snmpd_t var_lib_nfs_t:dir search;
|
allow snmpd_t var_lib_nfs_t:dir search;
|
||||||
|
@ -29,7 +29,7 @@
|
|||||||
# toggled on activation of spamc, and similarly for spamd.
|
# toggled on activation of spamc, and similarly for spamd.
|
||||||
template(`spamassassin_per_userdomain_template',`
|
template(`spamassassin_per_userdomain_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type spamd_t;
|
type spamd_t, spamd_tmp_t;
|
||||||
type spamc_exec_t, spamassassin_exec_t;
|
type spamc_exec_t, spamassassin_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -287,16 +287,6 @@ template(`spamassassin_per_userdomain_template',`
|
|||||||
corenet_tcp_connect_all_ports($1_spamassassin_t)
|
corenet_tcp_connect_all_ports($1_spamassassin_t)
|
||||||
|
|
||||||
sysnet_read_config($1_spamassassin_t)
|
sysnet_read_config($1_spamassassin_t)
|
||||||
|
|
||||||
optional_policy(`mount',`
|
|
||||||
mount_send_nfs_client_request($1_spamassassin_t)
|
|
||||||
')
|
|
||||||
')
|
|
||||||
|
|
||||||
tunable_policy(`spamassasin_can_network && allow_ypbind',`
|
|
||||||
optional_policy(`nis',`
|
|
||||||
nis_use_ypbind_uncond($1_spamassassin_t)
|
|
||||||
')
|
|
||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -312,7 +302,13 @@ template(`spamassassin_per_userdomain_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`nis',`
|
optional_policy(`nis',`
|
||||||
|
# cjp: clearly some redundancy here
|
||||||
|
|
||||||
nis_use_ypbind($1_spamassassin_t)
|
nis_use_ypbind($1_spamassassin_t)
|
||||||
|
|
||||||
|
tunable_policy(`spamassasin_can_network && allow_ypbind',`
|
||||||
|
nis_use_ypbind_uncond($1_spamassassin_t)
|
||||||
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`sendmail',`
|
optional_policy(`sendmail',`
|
||||||
|
@ -1000,7 +1000,7 @@ template(`admin_user_template',`
|
|||||||
#
|
#
|
||||||
template(`userdom_home_file',`
|
template(`userdom_home_file',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type $1_file_type;
|
attribute $1_file_type;
|
||||||
')
|
')
|
||||||
|
|
||||||
typeattribute $2 $1_file_type;
|
typeattribute $2 $1_file_type;
|
||||||
|
Loading…
Reference in New Issue
Block a user