[refpolicy] [PATCH 2/7] Label /var/spool/postfix/dev/ files

Nicolas Iooss nicolas.iooss at m4x.org
Sat Aug 23 07:35:46 EDT 2014


On Debian, /var/spool/postfix/dev contains log, urandom and random in
the same types as the files in /dev.
---
 policy/modules/kernel/devices.fc | 4 ++++
 policy/modules/system/logging.fc | 1 +
 2 files changed, 5 insertions(+)

diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index d6ebfcd4e570..2356cf0d4dc8 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -201,6 +201,10 @@ ifdef(`distro_debian',`
 /sys(/.*)?			gen_context(system_u:object_r:sysfs_t,s0)
 /sys/devices/system/cpu/online	--	gen_context(system_u:object_r:cpu_online_t,s0)
 
+/var/spool/postfix/dev		-d	gen_context(system_u:object_r:device_t,s0)
+/var/spool/postfix/dev/random	-c	gen_context(system_u:object_r:random_device_t,s0)
+/var/spool/postfix/dev/urandom	-c	gen_context(system_u:object_r:urandom_device_t,s0)
+
 ifdef(`distro_redhat',`
 # originally from named.fc
 /var/named/chroot/dev	-d	gen_context(system_u:object_r:device_t,s0)
diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
index 428e43f117e5..374fb53ee0fd 100644
--- a/policy/modules/system/logging.fc
+++ b/policy/modules/system/logging.fc
@@ -72,6 +72,7 @@ ifdef(`distro_redhat',`
 /var/spool/bacula/log(/.*)? 	gen_context(system_u:object_r:var_log_t,s0)
 /var/spool/postfix/pid	-d	gen_context(system_u:object_r:var_run_t,s0)
 /var/spool/plymouth/boot\.log	gen_context(system_u:object_r:var_log_t,mls_systemhigh)
+/var/spool/postfix/dev/log -s	gen_context(system_u:object_r:devlog_t,s0)
 /var/spool/rsyslog(/.*)? 	gen_context(system_u:object_r:var_log_t,s0)
 
 /var/tinydns/log/main(/.*)?	gen_context(system_u:object_r:var_log_t,s0)
-- 
2.0.4



More information about the refpolicy mailing list