Attachment 308417 Details for Bug 443646 – This patch against refpolicy makes it quiet about openswan leaked file descriptors

[patch] This patch against refpolicy makes it quiet about openswan leaked file descriptors

selinux-policy-2.4.6-openswan-dontaudit.patch (text/plain), 2.41 KB, created by Tuomo Soini on 2008-06-05 07:55:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tuomo Soini

Created: 2008-06-05 07:55:45 UTC

Size: 2.41 KB

patch

obsolete

>--- serefpolicy-2.4.6/policy/modules/system/sysnetwork.te.openswan_dontaudit	2007-11-15 09:00:10.000000000 +0200
>+++ serefpolicy-2.4.6/policy/modules/system/sysnetwork.te	2007-11-15 09:00:10.000000000 +0200
>@@ -277,6 +277,9 @@
> # Create UDP sockets, necessary when called from dhcpc
> allow ifconfig_t self:udp_socket create_socket_perms;
> 
>+# Don't audit ifconfig write to ifconfig_var_run_t
>+init_dontaudit_write_var_run(ifconfig_t)
>+
> # for /sbin/ip
> allow ifconfig_t self:packet_socket create_socket_perms;
> allow ifconfig_t self:netlink_route_socket create_netlink_socket_perms;
>@@ -310,6 +313,12 @@
> init_use_fds(ifconfig_t)
> init_use_script_ptys(ifconfig_t)
> 
>+# Don't audit ip write to unix stream socket owned by initrc_t
>+init_dontaudit_rw_unix_stream_socket(ifconfig_t)
>+
>+# Don't audit ip access to netlink selinux socket
>+init_dontaudit_rw_netlink_selinux_socket(ifconfig_t)
>+
> libs_use_ld_so(ifconfig_t)
> libs_use_shared_libs(ifconfig_t)
> libs_read_lib_files(ifconfig_t)
>--- serefpolicy-2.4.6/policy/modules/system/init.if.openswan_dontaudit	2007-11-15 09:00:10.000000000 +0200
>+++ serefpolicy-2.4.6/policy/modules/system/init.if	2007-11-15 09:00:10.000000000 +0200
>@@ -1384,3 +1384,59 @@
> 
> 	allow $1 init_t:process ptrace;
> ')
>+
>+########################################
>+## <summary>
>+##	Do not audit attempts to write to file
>+## </summary>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed access.
>+##	</summary>
>+## </param>
>+#
>+interface(`init_dontaudit_write_var_run',`
>+	gen_require(`
>+		type initrc_var_run_t;
>+	')
>+
>+	dontaudit $1 initrc_var_run_t:file write;
>+')
>+
>+########################################
>+## <summary>
>+##	Do not audit attempts to use
>+##	unix stream socket owned by init_t
>+## </summary>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed access.
>+##	</summary>
>+## </param>
>+#
>+interface(`init_dontaudit_rw_unix_stream_socket',`
>+	gen_require(`
>+		class unix_stream_socket { read write };
>+	')
>+
>+	dontaudit $1 initrc_t:unix_stream_socket { read write };
>+')
>+
>+########################################
>+## <summary>
>+##	Do not audit attempts to use netlink
>+##	selinux socket owned by init_t
>+## </summary>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed access.
>+##	</summary>
>+## </param>
>+#
>+interface(`init_dontaudit_rw_netlink_selinux_socket',`
>+	gen_require(`
>+		class netlink_selinux_socket { read write };
>+	')
>+
>+	dontaudit $1 initrc_t:netlink_selinux_socket { read write };
>+')

Actions: View | Diff

Attachments on bug 443646: 308417