RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bird: fixes for bird 2.0 

Signed-off-by: bauen1 <j2468h@gmail.com>

bird: allow admin to connect to the bird daemon socket

Signed-off-by: bauen1 <j2468h@gmail.com>

bird: read /proc/sys/crypto/fips_enabled

Signed-off-by: bauen1 <j2468h@gmail.com>
This commit is contained in:
bauen1 2019-09-28 14:50:50 +02:00
parent 841cce42e8
commit 56d16a79ae
No known key found for this signature in database
GPG Key ID: FF0AAF5E0812BA9C
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/services/bird.fc
View File

@ -11,3 +11,5 @@
/var/log/bird\.log.* -- gen_context(system_u:object_r:bird_log_t,s0)
/run/bird\.ctl -s gen_context(system_u:object_r:bird_runtime_t,s0)
/run/bird(/.*)? gen_context(system_u:object_r:bird_runtime_t,s0)

2
policy/modules/services/bird.if
View File

@ -36,4 +36,6 @@ interface(`bird_admin',`
files_list_pids($1)
admin_pattern($1, bird_runtime_t)
stream_connect_pattern($1, bird_runtime_t, bird_runtime_t, bird_t)
')

10
policy/modules/services/bird.te
View File

@ -26,17 +26,23 @@ files_pid_file(bird_runtime_t)
# Local policy
#
allow bird_t self:capability net_admin;
allow bird_t self:capability { net_admin net_raw };
allow bird_t self:netlink_route_socket create_netlink_socket_perms;
allow bird_t self:tcp_socket create_stream_socket_perms;
allow bird_t self:unix_stream_socket create_stream_socket_perms;
allow bird_t self:rawip_socket { create read write setopt };
allow bird_t bird_etc_t:file read_file_perms;
allow bird_t bird_etc_t:dir list_dir_perms;
allow bird_t bird_log_t:file { create_file_perms append_file_perms setattr_file_perms };
logging_log_filetrans(bird_t, bird_log_t, file)
allow bird_t bird_runtime_t:sock_file manage_sock_file_perms;
files_pid_filetrans(bird_t, bird_runtime_t, sock_file)
allow bird_t bird_runtime_t:dir manage_dir_perms;
files_pid_filetrans(bird_t, bird_runtime_t, { sock_file dir })
kernel_read_crypto_sysctls(bird_t)
corenet_all_recvfrom_unlabeled(bird_t)
corenet_all_recvfrom_netlabel(bird_t)