[refpolicy] [PATCHv2 4/8] Allow the sysadm domain to execute rc

Sven Vermeulen sven.vermeulen at siphos.be
Sat Sep 3 09:21:09 CDT 2011


The /sbin/rc binary is used by the system administrator to manage
runlevels (add/delete), check runlevel state, etc. all which do not
require a transition to occur. Hence the /sbin/rc (now labeled
rc_exec_t) is allowed to be executed without transitioning.

Signed-off-by: Sven Vermeulen <sven.vermeulen at siphos.be>
---
 policy/modules/roles/sysadm.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index fcf7605..cf84f62 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -51,6 +51,10 @@ ifdef(`direct_sysadm_daemon',`
 	')
 ')
 
+ifdef(`distro_gentoo',`
+	init_rc_exec(sysadm_t)
+')
+
 ifndef(`enable_mls',`
 	logging_manage_audit_log(sysadm_t)
 	logging_manage_audit_config(sysadm_t)
-- 
1.7.3.4



More information about the refpolicy mailing list