RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

gssproxy: Allow others to stream connect 

kernel AVC:
 * Starting gssproxy ...
Failed to write to /proc/net/rpc/use-gss-proxy: 13 (Permission denied)
 * start-stop-daemon: failed to start `gssproxy'

type=AVC msg=audit(1490858215.578:386110): avc:  denied  { connectto } for  pid=25447 comm="gssproxy" path="/run/gssproxy.sock" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:gssproxy_t:s0 tclass=unix_stream_socket permissive=0
This commit is contained in:
Jason Zaman 2017-11-03 01:30:47 +08:00 committed by Chris PeBenito
parent 6efe498a9b
commit 9adc6c5ddb
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/kernel/kernel.te
View File

@ -423,6 +423,10 @@ optional_policy(`
rpc_tcp_rw_nfs_sockets(kernel_t) rpc_tcp_rw_nfs_sockets(kernel_t)
rpc_udp_rw_nfs_sockets(kernel_t) rpc_udp_rw_nfs_sockets(kernel_t)
optional_policy(`
gssproxy_stream_connect(kernel_t)
')
tunable_policy(`nfs_export_all_ro',` tunable_policy(`nfs_export_all_ro',`
fs_getattr_noxattr_fs(kernel_t) fs_getattr_noxattr_fs(kernel_t)
fs_list_noxattr_fs(kernel_t) fs_list_noxattr_fs(kernel_t)

4
policy/modules/roles/sysadm.te
View File

@ -454,6 +454,10 @@ optional_policy(`
gpsd_admin(sysadm_t, sysadm_r) gpsd_admin(sysadm_t, sysadm_r)
') ')
optional_policy(`
gssproxy_admin(sysadm_t)
')
optional_policy(` optional_policy(`
hadoop_role(sysadm_r, sysadm_t) hadoop_role(sysadm_r, sysadm_t)
') ')

4
policy/modules/system/userdomain.if
View File

@ -663,6 +663,10 @@ template(`userdom_common_user_template',`
dpkg_read_db($1_t) dpkg_read_db($1_t)
') ')
optional_policy(`
gssproxy_stream_connect($1_t)
')
optional_policy(` optional_policy(`
hwloc_exec_dhwd($1_t) hwloc_exec_dhwd($1_t)
hwloc_read_runtime_files($1_t) hwloc_read_runtime_files($1_t)