From 62cdea27c31e10add98b901ad636b8ee34b87ba8 Mon Sep 17 00:00:00 2001 From: Sven Vermeulen Date: Wed, 20 Jul 2011 21:00:08 +0200 Subject: [PATCH] Update entropyd_t with privileges needed for haveged Haveged by itself requires a few additional privileges (create a unix socket and write access to some proc/sys/kernel files (like /proc/sys/kernel/random/write_wakeup_threshold). Signed-off-by: Sven Vermeulen --- policy/modules/services/audioentropy.te | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/policy/modules/services/audioentropy.te b/policy/modules/services/audioentropy.te index 7ece78d47..67f546d64 100644 --- a/policy/modules/services/audioentropy.te +++ b/policy/modules/services/audioentropy.te @@ -27,11 +27,12 @@ files_pid_file(entropyd_var_run_t) allow entropyd_t self:capability { dac_override ipc_lock sys_admin }; dontaudit entropyd_t self:capability sys_tty_config; allow entropyd_t self:process signal_perms; +allow entropyd_t self:unix_dgram_socket create_socket_perms; manage_files_pattern(entropyd_t, entropyd_var_run_t, entropyd_var_run_t) files_pid_filetrans(entropyd_t, entropyd_var_run_t, file) -kernel_read_kernel_sysctls(entropyd_t) +kernel_rw_kernel_sysctl(entropyd_t) kernel_list_proc(entropyd_t) kernel_read_proc_symlinks(entropyd_t)