RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Consider jitterentropy to belong to entropyd family 

Also allow jitterentropy (or rather some libs) to read
/proc/crypto/fips_enabled.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
This commit is contained in:
Topi Miettinen 2020-02-10 14:24:02 +02:00
parent 61923c23d7
commit 1d6982b0ea
No known key found for this signature in database
GPG Key ID: 87E1A51C590B0577
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/services/entropyd.fc
View File

@ -1,12 +1,14 @@
/etc/rc\.d/init\.d/((audio-entropyd)|(haveged)) -- gen_context(system_u:object_r:entropyd_initrc_exec_t,s0)
/etc/rc\.d/init\.d/((audio-entropyd)|(haveged)|(jitterentropy-rngd)) -- gen_context(system_u:object_r:entropyd_initrc_exec_t,s0)
/usr/lib/systemd/system/haveged.*\.service -- gen_context(system_u:object_r:entropyd_unit_t,s0)
/usr/lib/systemd/system/jitterentropy.*\.service -- gen_context(system_u:object_r:entropyd_unit_t,s0)
/usr/bin/audio-entropyd -- gen_context(system_u:object_r:entropyd_exec_t,s0)
/usr/bin/haveged -- gen_context(system_u:object_r:entropyd_exec_t,s0)
/usr/sbin/audio-entropyd -- gen_context(system_u:object_r:entropyd_exec_t,s0)
/usr/sbin/haveged -- gen_context(system_u:object_r:entropyd_exec_t,s0)
/usr/sbin/jitterentropy-rngd -- gen_context(system_u:object_r:entropyd_exec_t,s0)
/run/audio-entropyd\.pid -- gen_context(system_u:object_r:entropyd_runtime_t,s0)
/run/haveged\.pid -- gen_context(system_u:object_r:entropyd_runtime_t,s0)

1
policy/modules/services/entropyd.te
View File

@ -42,6 +42,7 @@ files_pid_filetrans(entropyd_t, entropyd_runtime_t, file)
kernel_read_system_state(entropyd_t)
kernel_rw_kernel_sysctl(entropyd_t)
kernel_read_crypto_sysctls(entropyd_t)
dev_read_sysfs(entropyd_t)
dev_read_urand(entropyd_t)