[refpolicy] [PATCH] refpolicy and certs

Chris PeBenito pebenito at ieee.org
Tue Oct 31 01:40:31 UTC 2017


On 10/30/2017 07:29 AM, Russell Coker via refpolicy wrote:
> The following patch allows mon_t to set limits for it's children and removes
> cert_t labelling from CA public keys (that aren't secret) so that processes
> which only need to verify keys (EG https clients) don't need cert_t access.
> 
> Index: refpolicy-2.20171016/policy/modules/contrib/mon.te
> ===================================================================
> --- refpolicy-2.20171016.orig/policy/modules/contrib/mon.te
> +++ refpolicy-2.20171016/policy/modules/contrib/mon.te
> @@ -46,6 +46,9 @@ files_tmp_file(mon_tmp_t)
>   allow mon_t self:fifo_file rw_fifo_file_perms;
>   allow mon_t self:tcp_socket create_stream_socket_perms;
>   
> +# for mailxmpp.alert to set ulimit
> +allow mon_t self:process setrlimit;
> +
>   domtrans_pattern(mon_t, mon_local_test_exec_t, mon_local_test_t)
>   
>   manage_dirs_pattern(mon_t, mon_tmp_t, mon_tmp_t)
> Index: refpolicy-2.20171016/policy/modules/system/miscfiles.fc
> ===================================================================
> --- refpolicy-2.20171016.orig/policy/modules/system/miscfiles.fc
> +++ refpolicy-2.20171016/policy/modules/system/miscfiles.fc
> @@ -44,12 +44,9 @@ ifdef(`distro_redhat',`
>   
>   /usr/lib/perl5/man(/.*)?	gen_context(system_u:object_r:man_t,s0)
>   
> -/usr/local/share/ca-certificates(/.*)?	gen_context(system_u:object_r:cert_t,s0)
> -
>   /usr/local/share/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
>   
>   /usr/share/docbook2X/xslt/man(/.*)?	gen_context(system_u:object_r:usr_t,s0)
> -/usr/share/ca-certificates(/.*)?	gen_context(system_u:object_r:cert_t,s0)
>   /usr/share/fonts(/.*)?		gen_context(system_u:object_r:fonts_t,s0)
>   /usr/share/X11/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
>   /usr/share/ghostscript/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)

Merged.

-- 
Chris PeBenito


More information about the refpolicy mailing list