Attachment 160257 Details for Bug 249695 – fix up ntfs selinux policy

[patch] fix up ntfs selinux policy

serefpolicy-2.6.4-ntfs.patch (text/plain), 1.90 KB, created by Tom "spot" Callaway on 2007-07-30 17:44:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tom "spot" Callaway

Created: 2007-07-30 17:44:33 UTC

Size: 1.90 KB

patch

obsolete

>diff -up serefpolicy-2.6.4/policy/modules/system/mount.te.ntfsfix serefpolicy-2.6.4/policy/modules/system/mount.te
>--- serefpolicy-2.6.4/policy/modules/system/mount.te.ntfsfix	2007-07-30 12:47:28.000000000 -0500
>+++ serefpolicy-2.6.4/policy/modules/system/mount.te	2007-07-30 13:14:35.000000000 -0500
>@@ -240,10 +240,17 @@ allow mount_ntfs_t self:fifo_file { read
> allow mount_ntfs_t self:unix_stream_socket create_stream_socket_perms;
> allow mount_ntfs_t self:unix_dgram_socket { connect create };
> 
>+allow mount_ntfs_t tmp_t:dir { write add_name create remove_name rmdir };
>+
> corecmd_read_bin_symlinks(mount_ntfs_t)
> corecmd_exec_shell(mount_ntfs_t)
> 
> files_read_etc_files(mount_ntfs_t)
>+files_search_all(mount_ntfs_t)
>+files_mounton_non_security_dir(mount_ntfs_t)
>+fs_getattr_all_dirs(mount_ntfs_t)
>+fs_mount_fusefs(mount_ntfs_t)
>+fs_unmount_fusefs(mount_ntfs_t)
> 
> libs_use_ld_so(mount_ntfs_t)
> libs_use_shared_libs(mount_ntfs_t)
>@@ -261,6 +268,7 @@ miscfiles_read_localization(mount_ntfs_t
> 
> modutils_domtrans_insmod(mount_ntfs_t)
> 
>+mount_domtrans(mount_ntfs_t)
> mount_ntfs_domtrans(mount_t)
> 
> storage_raw_read_fixed_disk(mount_ntfs_t)
>diff -up serefpolicy-2.6.4/policy/modules/kernel/filesystem.if.ntfsfix serefpolicy-2.6.4/policy/modules/kernel/filesystem.if
>--- serefpolicy-2.6.4/policy/modules/kernel/filesystem.if.ntfsfix	2007-07-30 12:47:28.000000000 -0500
>+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if	2007-07-30 12:47:28.000000000 -0500
>@@ -3477,3 +3477,21 @@ interface(`fs_mount_fusefs',`
> 
>         allow $1 fusefs_t:filesystem mount;
> ')
>+
>+########################################
>+## <summary>
>+##      Unmount a fuse filesystem.
>+## </summary>
>+## <param name="domain">
>+##      <summary>
>+##      Domain allowed access.
>+##      </summary>
>+## </param>
>+#
>+interface(`fs_unmount_fusefs',`
>+        gen_require(`
>+                type fusefs_t;
>+        ')
>+
>+        allow $1 fusefs_t:filesystem unmount;
>+')

Actions: View | Diff

Attachments on bug 249695: 160257 | 160350