RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

system/ipsec: Add signull access for strongSwan 

Allows ipsec_supervisor_t domain to signull other
strongSwan domains.

Signed-off-by: David Graziano <david.graziano@rockwellcollins.com>
This commit is contained in:
David Graziano 2017-10-09 15:42:59 -05:00
parent 2ae2b38e6d
commit 99aebc2af5
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/system/ipsec.te
View File

@ -461,7 +461,7 @@ userdom_use_user_terminals(setkey_t)
#
allow ipsec_supervisor_t self:capability { dac_override dac_read_search kill net_admin };
allow ipsec_supervisor_t self:process { signal };
allow ipsec_supervisor_t self:process { signal signull };
allow ipsec_supervisor_t self:fifo_file rw_fifo_file_perms;
allow ipsec_supervisor_t self:netlink_route_socket rw_netlink_socket_perms;
allow ipsec_supervisor_t self:netlink_xfrm_socket create_netlink_socket_perms;
@ -472,7 +472,7 @@ read_files_pattern(ipsec_supervisor_t, ipsec_conf_file_t, ipsec_conf_file_t);
manage_files_pattern(ipsec_supervisor_t, ipsec_key_file_t, ipsec_key_file_t)
allow ipsec_supervisor_t ipsec_t:unix_stream_socket { connectto };
allow ipsec_supervisor_t ipsec_t:process { signal };
allow ipsec_supervisor_t ipsec_t:process { signal signull };
allow ipsec_supervisor_t ipsec_var_run_t:sock_file { rw_sock_file_perms unlink };
manage_dirs_pattern(ipsec_supervisor_t, ipsec_var_run_t, ipsec_var_run_t)