Attachment 311749 Details for Bug 442228 – Patch for SELinux policy for directory server

[patch] Patch for SELinux policy for directory server

dirsrvpolicy_update.080327 (text/plain), 3.70 KB, created by Pär Aronsson on 2008-07-14 18:57:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Pär Aronsson

Created: 2008-07-14 18:57:24 UTC

Size: 3.70 KB

patch

obsolete

>Index: dirsrv-admin.if
>===================================================================
>--- dirsrv-admin.if	(.../hemma.com/jess/SELinux_policy/dirsrv-admin.if)	(revision 264)
>+++ dirsrv-admin.if	(.../jess/SELinux_policy/services/dirsrv-admin.if)	(revision 282)
>@@ -33,8 +33,8 @@
> 
> ########################################
> ## <summary>
>-##	Execute dirsrv-admin setup programs in the dirsrvadmin_setup_t domain
>-##	and the system_r role. Targeted policy.
>+##	Execute dirsrv-admin setup programs in the dirsrvadmin_setup_t domain.
>+##	Targeted policy.
> ## </summary>
> ## <param name="domain">
> ##	<summary>
>@@ -71,6 +71,7 @@
> 	')
> 
> 	files_search_tmp($1)
>+	logging_search_logs($1)
> 	allow $1 dirsrvadmin_setuplog_t:file r_file_perms;
> ')
> 
>@@ -90,6 +91,7 @@
> 	')
> 
> 	files_search_tmp($1)
>+	logging_search_logs($1)
> 	allow $1 dirsrvadmin_setuplog_t:file manage_file_perms;
> ')
> 
>Index: dirsrv-admin.te
>===================================================================
>--- dirsrv-admin.te	(.../hemma.com/jess/SELinux_policy/dirsrv-admin.te)	(revision 264)
>+++ dirsrv-admin.te	(.../jess/SELinux_policy/services/dirsrv-admin.te)	(revision 282)
>@@ -1,4 +1,4 @@
>-policy_module(dirsrv-admin,1.0.0) 
>+policy_module(dirsrv-admin,1.0.1) 
> 
> ########################################
> #
>@@ -57,7 +57,7 @@
> 
> ## Before transition to httpd domain
> allow dirsrvadmin_t self:fifo_file { write read getattr };
>-allow dirsrvadmin_t self:capability { dac_read_search dac_override };
>+allow dirsrvadmin_t self:capability { dac_read_search dac_override sys_tty_config };
> logging_search_logs(dirsrvadmin_t)
> corecmd_exec_bin(dirsrvadmin_t)
> libs_exec_ld_so(dirsrvadmin_t)
>Index: dirsrv.fc
>===================================================================
>--- dirsrv.fc	(.../hemma.com/jess/SELinux_policy/dirsrv.fc)	(revision 264)
>+++ dirsrv.fc	(.../jess/SELinux_policy/services/dirsrv.fc)	(revision 281)
>@@ -4,11 +4,11 @@
> /usr/sbin/migrate-ds.pl --	gen_context(system_u:object_r:dirsrv_setupexec_t,s0)
> /usr/sbin/setup-ds.pl	--	gen_context(system_u:object_r:dirsrv_setupexec_t,s0)
> # Helper scripts
>-/usr/lib/dirsrv(/slapd-.*)?	gen_context(system_u:object_r:dirsrv_helper_exec_t,s0)
>+/usr/lib/dirsrv/(slapd-.*)?	gen_context(system_u:object_r:dirsrv_helper_exec_t,s0)
> # Configuration
>-/etc/dirsrv(/slapd-.*)?	 	gen_context(system_u:object_r:dirsrv_config_t,s0)
>+/etc/dirsrv/(slapd-.*)?	 	gen_context(system_u:object_r:dirsrv_config_t,s0)
> # Db files
>-/var/lib/dirsrv(/.*)?		gen_context(system_u:object_r:dirsrv_db_t,s0)
>+/var/lib/dirsrv/(.*)?		gen_context(system_u:object_r:dirsrv_db_t,s0)
> # Lock files
> /var/lock/dirsrv(/.*)?		gen_context(system_u:object_r:dirsrv_lock_t,s0)
> # Log files
>Index: dirsrv.if
>===================================================================
>--- dirsrv.if	(.../hemma.com/jess/SELinux_policy/dirsrv.if)	(revision 264)
>+++ dirsrv.if	(.../jess/SELinux_policy/services/dirsrv.if)	(revision 280)
>@@ -113,6 +113,7 @@
> 	')
> 
> 	files_search_tmp($1)
>+	logging_search_logs($1)
> 	allow $1 dirsrv_setuplog_t:file r_file_perms;
> ')
> 
>Index: dirsrv.te
>===================================================================
>--- dirsrv.te	(.../hemma.com/jess/SELinux_policy/dirsrv.te)	(revision 264)
>+++ dirsrv.te	(.../jess/SELinux_policy/services/dirsrv.te)	(revision 280)
>@@ -1,4 +1,4 @@
>-policy_module(dirsrv,1.0.0) 
>+policy_module(dirsrv,1.0.1) 
> 
> ########################################
> #
>@@ -89,8 +89,6 @@
> allow dirsrv_t dirsrv_log_t:file { create rename setattr manage_file_perms };
> allow dirsrv_t dirsrv_log_t:dir { setattr rw_dir_perms };
> allow dirsrv_t self:unix_dgram_socket create_socket_perms;
>-# Allow search in /var/log
>-logging_search_logs(dirsrv_t)
> ## var_run
> allow dirsrv_t dirsrv_var_run_t:file manage_file_perms;
> allow dirsrv_t dirsrv_var_run_t:dir rw_dir_perms;

Actions: View | Diff

Attachments on bug 442228: 311749 | 312055