From b058561a14b75b0d7bef03b5e539349208c20ba0 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Mon, 1 Nov 2010 11:21:02 -0400 Subject: [PATCH] Rearrange rules in vlock. --- policy/modules/apps/vlock.te | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/policy/modules/apps/vlock.te b/policy/modules/apps/vlock.te index 06d0fb824..44302e51d 100644 --- a/policy/modules/apps/vlock.te +++ b/policy/modules/apps/vlock.te @@ -9,7 +9,6 @@ type vlock_t; type vlock_exec_t; application_domain(vlock_t, vlock_exec_t) - ######################################## # # Local policy @@ -21,6 +20,8 @@ allow vlock_t self:fifo_file rw_fifo_file_perms; allow vlock_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; allow vlock_t self:unix_dgram_socket { create connect }; +kernel_read_system_state(vlock_t) + corecmd_list_bin(vlock_t) corecmd_read_bin_symlinks(vlock_t) @@ -31,13 +32,16 @@ domain_use_interactive_fds(vlock_t) files_dontaudit_search_home(vlock_t) files_read_etc_files(vlock_t) -term_use_all_user_ttys(vlock_t) -term_use_all_user_ptys(vlock_t) - -kernel_read_system_state(vlock_t) +# pam_tally2 module could be used by vlock for authentication, +# /var/log/tallylog's SL is usually s0, while the caller's SL could +# be higher than s0. +mls_file_write_all_levels(vlock_t) selinux_dontaudit_getattr_fs(vlock_t) +term_use_all_user_ttys(vlock_t) +term_use_all_user_ptys(vlock_t) + auth_domtrans_chk_passwd(vlock_t) init_dontaudit_rw_utmp(vlock_t) @@ -48,10 +52,3 @@ miscfiles_read_localization(vlock_t) userdom_dontaudit_search_user_home_dirs(vlock_t) userdom_use_user_terminals(vlock_t) - -# pam_tally2 module could be used by vlock for authentication, -# /var/log/tallylog's SL is usually s0, while the caller's SL could -# be higher than s0. -ifdef(`enable_mls',` - mls_file_write_all_levels(vlock_t) -')