rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

misc fixes

Browse Source
This commit is contained in:
Chris PeBenito 2005-09-07 13:31:37 +00:00
parent 8d93523409
commit 763a5e30c6
2 changed files with 14 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
refpolicy/policy/modules/services/nscd.te
View File

@ -7,7 +7,7 @@ policy_module(nscd,1.0)
# #
# nscd is both the client program and the daemon. # nscd is both the client program and the daemon.
type nscd_t; #, userspace_objmgr type nscd_t;
type nscd_exec_t; type nscd_exec_t;
init_daemon_domain(nscd_t,nscd_exec_t) init_daemon_domain(nscd_t,nscd_exec_t)
@ -22,13 +22,13 @@ files_pid_file(nscd_var_run_t)
allow nscd_t self:capability { kill setgid setuid }; allow nscd_t self:capability { kill setgid setuid };
dontaudit nscd_t self:capability sys_tty_config; dontaudit nscd_t self:capability sys_tty_config;
allow nscd_t self:process { getattr setsched }; allow nscd_t self:process { getattr setsched };
allow nscd_t self:fifo_file { read write };
allow nscd_t self:unix_stream_socket create_stream_socket_perms; allow nscd_t self:unix_stream_socket create_stream_socket_perms;
allow nscd_t self:unix_dgram_socket create_socket_perms; allow nscd_t self:unix_dgram_socket create_socket_perms;
allow nscd_t self:netlink_selinux_socket create_socket_perms; allow nscd_t self:netlink_selinux_socket create_socket_perms;
allow nscd_t self:netlink_route_socket r_netlink_socket_perms; allow nscd_t self:netlink_route_socket r_netlink_socket_perms;
allow nscd_t self:tcp_socket create_socket_perms; allow nscd_t self:tcp_socket create_socket_perms;
allow nscd_t self:udp_socket { connect connected_socket_perms }; allow nscd_t self:udp_socket create_socket_perms;
allow nscd_t self:fifo_file { read write };
# For client program operation, invoked from sysadm_t. # For client program operation, invoked from sysadm_t.
# Transition occurs to nscd_t due to direct_sysadm_daemon. # Transition occurs to nscd_t due to direct_sysadm_daemon.
@ -66,6 +66,12 @@ corenet_udp_sendrecv_all_ports(nscd_t)
corenet_tcp_bind_all_nodes(nscd_t) corenet_tcp_bind_all_nodes(nscd_t)
corenet_udp_bind_all_nodes(nscd_t) corenet_udp_bind_all_nodes(nscd_t)
selinux_get_fs_mount(nscd_t)
selinux_validate_context(nscd_t)
selinux_compute_access_vector(nscd_t)
selinux_compute_create_context(nscd_t)
selinux_compute_relabel_context(nscd_t)
selinux_compute_user_contexts(nscd_t)
domain_use_wide_inherit_fd(nscd_t) domain_use_wide_inherit_fd(nscd_t)
files_read_etc_files(nscd_t) files_read_etc_files(nscd_t)
@ -80,6 +86,10 @@ logging_send_syslog_msg(nscd_t)
miscfiles_read_localization(nscd_t) miscfiles_read_localization(nscd_t)
seutil_read_config(nscd_t)
seutil_read_default_contexts(nscd_t)
seutil_sigchld_newrole(nscd_t)
sysnet_read_config(nscd_t) sysnet_read_config(nscd_t)
userdom_dontaudit_use_unpriv_user_fd(nscd_t) userdom_dontaudit_use_unpriv_user_fd(nscd_t)
@ -95,16 +105,11 @@ optional_policy(`nis.te',`
nis_use_ypbind(nscd_t) nis_use_ypbind(nscd_t)
') ')
optional_policy(`selinuxutils.te',`
seutil_sigchld_newrole(nscd_t)
')
optional_policy(`udev.te', ` optional_policy(`udev.te', `
udev_read_db(nscd_t) udev_read_db(nscd_t)
') ')
ifdef(`TODO',` ifdef(`TODO',`
nscd_socket_domain(daemon) nscd_socket_domain(daemon)
optional_policy(`winbind.te', ` optional_policy(`winbind.te', `

6
refpolicy/policy/modules/services/ntp.te
View File

@ -120,7 +120,7 @@ ifdef(`targeted_policy', `
optional_policy(`crond.te',` optional_policy(`crond.te',`
# for cron jobs # for cron jobs
# system_crond_t is not right, cron is not doing what it should # system_crond_t is not right, cron is not doing what it should
cron_system_entry(ntpd_t,ntpd_exec_t) cron_system_entry(ntpdate_t,ntpd_exec_t)
') ')
optional_policy(`firstboot.te',` optional_policy(`firstboot.te',`
@ -155,10 +155,6 @@ ifdef(`TODO',`
optional_policy(`rhgb.te',` optional_policy(`rhgb.te',`
rhgb_domain(ntpd_t) rhgb_domain(ntpd_t)
') ')
# so the start script can change firewall entries
allow initrc_t net_conf_t:file { getattr read ioctl };
allow ntpd_t sysadm_t:udp_socket sendto; allow ntpd_t sysadm_t:udp_socket sendto;
allow sysadm_t ntpd_t:udp_socket recvfrom; allow sysadm_t ntpd_t:udp_socket recvfrom;