From d783374bc9b068e112e989433b13fc939ce57d20 Mon Sep 17 00:00:00 2001 From: Dominick Grift Date: Wed, 24 Feb 2010 13:41:39 +0100 Subject: [PATCH] Various arpwatch fixes. Allow domains to search /var/lib to enable interaction with arpwatch data. Allow domains to search /tmp to enable interaction with arpwatch tmp content. Create arpwatch initrc domtrans. Call arpwatch initrc domtrans from arpwatch_admin. Remove obsolete require. Signed-off-by: Dominick Grift --- policy/modules/services/arpwatch.if | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/policy/modules/services/arpwatch.if b/policy/modules/services/arpwatch.if index 92e2dc8c..0c3e8304 100644 --- a/policy/modules/services/arpwatch.if +++ b/policy/modules/services/arpwatch.if @@ -1,5 +1,23 @@ ## Ethernet activity monitor. +######################################## +## +## Execute arpwatch server in the arpwatch domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`arpwatch_initrc_domtrans',` + gen_require(` + type arpwatch_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, arpwatch_initrc_exec_t) +') + ######################################## ## ## Search arpwatch's data file directories. @@ -15,6 +33,7 @@ interface(`arpwatch_search_data',` type arpwatch_data_t; ') + files_search_var_lib($1) allow $1 arpwatch_data_t:dir search_dir_perms; ') @@ -33,6 +52,7 @@ interface(`arpwatch_manage_data_files',` type arpwatch_data_t; ') + files_search_var_lib($1) manage_files_pattern($1, arpwatch_data_t, arpwatch_data_t) ') @@ -51,6 +71,7 @@ interface(`arpwatch_rw_tmp_files',` type arpwatch_tmp_t; ') + files_search_tmp($1) allow $1 arpwatch_tmp_t:file rw_file_perms; ') @@ -69,6 +90,7 @@ interface(`arpwatch_manage_tmp_files',` type arpwatch_tmp_t; ') + files_search_tmp($1) allow $1 arpwatch_tmp_t:file manage_file_perms; ') @@ -112,13 +134,12 @@ interface(`arpwatch_admin',` gen_require(` type arpwatch_t, arpwatch_tmp_t; type arpwatch_data_t, arpwatch_var_run_t; - type arpwatch_initrc_exec_t; ') allow $1 arpwatch_t:process { ptrace signal_perms getattr }; ps_process_pattern($1, arpwatch_t) - init_labeled_script_domtrans($1, arpwatch_initrc_exec_t) + arpwatch_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 arpwatch_initrc_exec_t system_r; allow $2 system_r;