From 4c71994852ce8ad7e915c3496af93a57bc407e2d Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Wed, 12 Oct 2005 17:32:41 +0000
Subject: [PATCH] add missing interface

---
 refpolicy/policy/modules/services/apache.te | 12 ++-------
 refpolicy/policy/modules/services/mysql.if  | 30 +++++++++++++--------
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/refpolicy/policy/modules/services/apache.te b/refpolicy/policy/modules/services/apache.te
index 0e4c00738..0f5b1d66b 100644
--- a/refpolicy/policy/modules/services/apache.te
+++ b/refpolicy/policy/modules/services/apache.te
@@ -360,6 +360,7 @@ optional_policy(`mta.te',`
 
 optional_policy(`mysql.te',`
 	mysql_stream_connect(httpd_t)
+	mysql_rw_db_socket(httpd_t)
 ')
 
 optional_policy(`nis.te',`
@@ -389,16 +390,6 @@ allow httpd_t home_root_t:dir getattr;
 dontaudit httpd_t sysadm_home_dir_t:dir getattr;
 allow httpd_sys_script_t var_spool_t:dir getattr;
 
-optional_policy(`mysql.te',`
-	allow httpd_t mysqld_db_t:dir search;
-	allow httpd_t mysqld_db_t:sock_file rw_file_perms;
-')
-
-optional_policy(`mysql.te',`
-	allow httpd_sys_script_t mysqld_db_t:dir search;
-	allow httpd_sys_script_t mysqld_db_t:sock_file rw_file_perms;
-')
-
 ifdef(`targeted_policy',`
 	if (httpd_enable_homedirs) {
 		allow httpd_t user_home_dir_t:dir { getattr search };
@@ -615,6 +606,7 @@ ifdef(`distro_redhat',`
 
 optional_policy(`mysql.te',`
 	mysql_stream_connect(httpd_sys_script_t)
+	mysql_rw_db_socket(httpd_sys_script_t)
 ')
 
 ########################################
diff --git a/refpolicy/policy/modules/services/mysql.if b/refpolicy/policy/modules/services/mysql.if
index fd6e75d5c..cbda7b41f 100644
--- a/refpolicy/policy/modules/services/mysql.if
+++ b/refpolicy/policy/modules/services/mysql.if
@@ -11,7 +11,6 @@
 interface(`mysql_signal',`
 	gen_require(`
 		type mysqld_t;
-		class process signal;
 	')
 
 	allow $1 mysqld_t:process signal;
@@ -28,9 +27,6 @@ interface(`mysql_signal',`
 interface(`mysql_stream_connect',`
 	gen_require(`
 		type mysqld_t, mysqld_var_run_t;
-		class unix_stream_socket connectto;
-		class dir search;
-		class sock_file write;
 	')
 
 	allow $1 mysqld_var_run_t:dir search;
@@ -49,9 +45,6 @@ interface(`mysql_stream_connect',`
 interface(`mysql_read_config',`
 	gen_require(`
 		type mysqld_etc_t;
-		class dir { getattr read search };
-		class file { read getattr };
-		class lnk_file { getattr read };
 	')
 
 	allow $1 mysqld_etc_t:dir { getattr read search };
@@ -73,7 +66,6 @@ interface(`mysql_read_config',`
 interface(`mysql_search_db_dir',`
 	gen_require(`
 		type mysqld_db_t;
-		class dir search;
 	')
 
 	files_search_var_lib($1)
@@ -91,7 +83,6 @@ interface(`mysql_search_db_dir',`
 interface(`mysql_rw_db_dir',`
 	gen_require(`
 		type mysqld_db_t;
-		class rw_dir_perms;
 	')
 
 	files_search_var_lib($1)
@@ -109,13 +100,31 @@ interface(`mysql_rw_db_dir',`
 interface(`mysql_manage_db_dir',`
 	gen_require(`
 		type mysql_db_t;
-		class create_dir_perms;
 	')
 
 	files_search_var_lib($1)
 	allow $1 mysqld_db_t:dir create_dir_perms;
 ')
 
+########################################
+## <summary>
+##	Read and write to the MySQL database
+##	named socket.
+## </summary>
+## <param name="domain">
+##	Domain allowed access.
+## </param>
+#
+interface(`mysql_rw_db_socket',`
+	gen_require(`
+		type mysqld_db_t;
+	')
+
+	files_search_var_lib($1)
+	allow $1 mysqld_db_t:dir search;
+	allow $1 mysqld_db_t:sock_file rw_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Write to the MySQL log.
@@ -127,7 +136,6 @@ interface(`mysql_manage_db_dir',`
 interface(`mysql_write_log',`
 	gen_require(`
 		type mysqld_log_t;
-		class file { write append setattr ioctl };
 	')
 
 	logging_search_logs($1)