Changeset 2786

Timestamp:

08/20/08 14:45:39 (4 months ago)

Author:

cpebenito

Message:

trunk: firstboot update from dan.

Files:

• trunk/policy/modules/admin/firstboot.if (modified) (1 diff)
• trunk/policy/modules/admin/firstboot.te (modified) (5 diffs)
• trunk/policy/modules/services/ntp.te (modified) (2 diffs)

trunk/policy/modules/admin/firstboot.if

@@ -143 +143 @@
-        dontaudit $1 firstboot_t:fifo_file { read write };
-')
+
+########################################
+## <summary>
+##      Do not audit attemps to read and write to a firstboot
+##      unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain to not audit.
+##      </summary>
+## </param>
+#
+interface(`firstboot_dontaudit_rw_stream_sockets',`
+        gen_require(`
+                type firstboot_t;
+        ')
+
+        dontaudit $1 firstboot_t:unix_stream_socket { read write };
+')

trunk/policy/modules/admin/firstboot.te

@@ -1 +1 @@
-
-0
+1
-
-gen_require(`
@@ -36 +36 @@
-allow firstboot_t firstboot_etc_t:file { getattr read };
-
-# The big hammer
-unconfined_domain(firstboot_t) 
-
-kernel_read_system_state(firstboot_t)
-kernel_read_kernel_sysctls(firstboot_t)
@@ -64 +61 @@
-files_manage_etc_files(firstboot_t)
-files_manage_etc_runtime_files(firstboot_t)
-files_etc_filetrans_etc_runtime(firstboot_t, { file dir })
-files_read_usr_files(firstboot_t)
-files_manage_var_dirs(firstboot_t)
@@ -111 +107 @@
-optional_policy(`
-        unconfined_domtrans(firstboot_t)
+        # The big hammer
+        unconfined_domain(firstboot_t) 
-')
-
@@ -132 +130 @@
-        domain_auto_trans(firstboot_t, userhelper_exec_t, sysadm_userhelper_t)
-')
-
-ifdef(`xserver.te', `
-        domain_auto_trans(firstboot_t, xserver_exec_t, xdm_xserver_t)
-')
-') dnl end TODO

trunk/policy/modules/services/ntp.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -118 +118 @@
-        firstboot_dontaudit_use_fds(ntpd_t)
-        firstboot_dontaudit_rw_pipes(ntpd_t)
+        firstboot_dontaudit_rw_stream_sockets(ntpd_t)
-')
-