[refpolicy] [PATCH 2/6] Allow init scripts to handle sysctls

Christopher J. PeBenito cpebenito at tresys.com
Mon Jul 2 09:46:05 CDT 2012


On 06/27/12 17:52, Sven Vermeulen wrote:
> The init script(s) that set/reset the sysctl's require the sys_admin capability
> (as you cannot change sysctls without it).
> 
> Signed-off-by: Sven Vermeulen <sven.vermeulen at siphos.be>
> ---
>  policy/modules/system/init.te |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
> index 9fdd704..7dfd9a9 100644
> --- a/policy/modules/system/init.te
> +++ b/policy/modules/system/init.te
> @@ -222,7 +222,7 @@ optional_policy(`
>  #
>  
>  allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
> -allow initrc_t self:capability ~{ sys_admin sys_module };
> +allow initrc_t self:capability ~{ sys_module };
>  dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
>  allow initrc_t self:passwd rootok;
>  allow initrc_t self:key manage_key_perms;
 
We typically try to separate out the sys_admin privileges since its so broad.  Can a new domain be created?

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com




More information about the refpolicy mailing list