RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #369 from jpds/irc-sock-and-screen-fixes

This commit is contained in:
Chris PeBenito 2021-05-11 08:38:37 -04:00
parent f5d97c7eda 5703b622cd
commit 07dc9a3c80
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
policy/modules/apps/irc.te
View File

@ -40,7 +40,7 @@ userdom_user_tmp_file(irc_tmp_t)
allow irc_t self:process { getsched signal sigkill };
allow irc_t self:fifo_file rw_fifo_file_perms;
allow irc_t self:unix_dgram_socket create_socket_perms;
allow irc_t self:unix_dgram_socket { create_socket_perms sendto };
allow irc_t self:unix_stream_socket { accept listen };
allow irc_t irc_conf_t:file read_file_perms;
@ -132,6 +132,10 @@ tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_symlinks(irc_t)
')
optional_policy(`
screen_execute_sock_file(irc_t)
')
optional_policy(`
seutil_use_newrole_fds(irc_t)
')

19
policy/modules/apps/screen.if
View File

@ -90,3 +90,22 @@ template(`screen_role_template',`
fs_nfs_domtrans($1_screen_t, $3)
')
')
########################################
## <summary>
## Execute the screen runtime sock file.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
interface(`screen_execute_sock_file',`
gen_require(`
type screen_tmp_t;
type screen_runtime_t;
')
allow $1 screen_runtime_t:sock_file execute;
allow $1 screen_tmp_t:dir search;
')