- Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes
to handle usage from userhelper.
This commit is contained in:
parent
6a2975706a
commit
882186c933
@ -1,3 +1,5 @@
|
|||||||
|
- Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes
|
||||||
|
to handle usage from userhelper.
|
||||||
- Patch to allow amavis to read spamassassin libraries from Dan Walsh.
|
- Patch to allow amavis to read spamassassin libraries from Dan Walsh.
|
||||||
- Patch to allow slocate to getattr other filesystems and directories on those
|
- Patch to allow slocate to getattr other filesystems and directories on those
|
||||||
filesystems from Dan Walsh.
|
filesystems from Dan Walsh.
|
||||||
|
@ -552,6 +552,24 @@ interface(`kernel_read_debugfs',`
|
|||||||
list_dirs_pattern($1,debugfs_t,debugfs_t)
|
list_dirs_pattern($1,debugfs_t,debugfs_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Mount a kernel VM filesystem.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## The type of the domain mounting the filesystem.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`kernel_mount_kvmfs',`
|
||||||
|
gen_require(`
|
||||||
|
type kvmfs_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 kvmfs_t:filesystem mount;
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Unmount the proc filesystem.
|
## Unmount the proc filesystem.
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(kernel,1.6.0)
|
policy_module(kernel,1.6.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(modutils,1.3.0)
|
policy_module(modutils,1.3.1)
|
||||||
|
|
||||||
gen_require(`
|
gen_require(`
|
||||||
bool secure_mode_insmod;
|
bool secure_mode_insmod;
|
||||||
@ -58,6 +58,7 @@ kernel_load_module(insmod_t)
|
|||||||
kernel_read_system_state(insmod_t)
|
kernel_read_system_state(insmod_t)
|
||||||
kernel_write_proc_files(insmod_t)
|
kernel_write_proc_files(insmod_t)
|
||||||
kernel_mount_debugfs(insmod_t)
|
kernel_mount_debugfs(insmod_t)
|
||||||
|
kernel_mount_kvmfs(insmod_t)
|
||||||
kernel_read_debugfs(insmod_t)
|
kernel_read_debugfs(insmod_t)
|
||||||
# Rules for /proc/sys/kernel/tainted
|
# Rules for /proc/sys/kernel/tainted
|
||||||
kernel_read_kernel_sysctls(insmod_t)
|
kernel_read_kernel_sysctls(insmod_t)
|
||||||
@ -156,6 +157,10 @@ optional_policy(`
|
|||||||
rpm_rw_pipes(insmod_t)
|
rpm_rw_pipes(insmod_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
unconfined_dontaudit_rw_pipes(insmod_t)
|
||||||
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
# cjp: why is this needed:
|
# cjp: why is this needed:
|
||||||
dev_rw_xserver_misc(insmod_t)
|
dev_rw_xserver_misc(insmod_t)
|
||||||
|
Loading…
Reference in New Issue
Block a user