diff --git a/policy/modules/system/hostname.te b/policy/modules/system/hostname.te index f6cbda923..380197b21 100644 --- a/policy/modules/system/hostname.te +++ b/policy/modules/system/hostname.te @@ -51,6 +51,7 @@ logging_send_syslog_msg(hostname_t) miscfiles_read_localization(hostname_t) +sysnet_dontaudit_rw_dhcpc_udp_sockets(hostname_t) sysnet_dontaudit_rw_dhcpc_unix_stream_sockets(hostname_t) sysnet_read_config(hostname_t) sysnet_dns_name_resolve(hostname_t) diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if index 52b548cee..2cea692c0 100644 --- a/policy/modules/system/sysnetwork.if +++ b/policy/modules/system/sysnetwork.if @@ -45,6 +45,25 @@ interface(`sysnet_run_dhcpc',` roleattribute $2 dhcpc_roles; ') +######################################## +## +## Do not audit attempts to read and +## write dhcpc udp socket descriptors. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysnet_dontaudit_rw_dhcpc_udp_sockets',` + gen_require(` + type dhcpc_t; + ') + + dontaudit $1 dhcpc_t:udp_socket { read write }; +') + ######################################## ## ## Do not audit attempts to use