RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

chronyd patch from Dan Walsh 

Fixed a couple style/spacing issues.
Added files_search_etc for chronyd_keys file
This commit is contained in:
Jeremy Solt 2010-03-24 15:57:15 -04:00 committed by Chris PeBenito
parent c586c1bfa6
commit dcbb332992
3 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/services/chronyd.fc
View File

@ -1,3 +1,5 @@
/etc/chrony\.keys -- gen_context(system_u:object_r:chronyd_keys_t,s0)
/etc/rc\.d/init\.d/chronyd -- gen_context(system_u:object_r:chronyd_initrc_exec_t,s0) /etc/rc\.d/init\.d/chronyd -- gen_context(system_u:object_r:chronyd_initrc_exec_t,s0)
/usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0) /usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0)

9
policy/modules/services/chronyd.if
View File

@ -6,7 +6,7 @@
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## The type of the process performing this action. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
# #
@ -25,7 +25,7 @@ interface(`chronyd_domtrans',`
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
## The type of the process performing this action. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
# #
@ -77,7 +77,7 @@ interface(`chronyd_admin',`
gen_require(` gen_require(`
type chronyd_t, chronyd_var_log_t; type chronyd_t, chronyd_var_log_t;
type chronyd_var_run_t, chronyd_var_lib_t; type chronyd_var_run_t, chronyd_var_lib_t;
type chronyd_initrc_exec_t; type chronyd_initrc_exec_t, chronyd_keys_t;
') ')
allow $1 chronyd_t:process { ptrace signal_perms }; allow $1 chronyd_t:process { ptrace signal_perms };
@ -88,6 +88,9 @@ interface(`chronyd_admin',`
role_transition $2 chronyd_initrc_exec_t system_r; role_transition $2 chronyd_initrc_exec_t system_r;
allow $2 system_r; allow $2 system_r;
files_search_etc($1)
admin_pattern($1, chronyd_keys_t)
logging_search_logs($1) logging_search_logs($1)
admin_pattern($1, chronyd_var_log_t) admin_pattern($1, chronyd_var_log_t)

19
policy/modules/services/chronyd.te
View File

@ -13,6 +13,9 @@ init_daemon_domain(chronyd_t, chronyd_exec_t)
type chronyd_initrc_exec_t; type chronyd_initrc_exec_t;
init_script_file(chronyd_initrc_exec_t) init_script_file(chronyd_initrc_exec_t)
type chronyd_keys_t;
files_type(chronyd_keys_t)
type chronyd_var_lib_t; type chronyd_var_lib_t;
files_type(chronyd_var_lib_t) files_type(chronyd_var_lib_t)
@ -27,13 +30,17 @@ files_pid_file(chronyd_var_run_t)
# Local policy # Local policy
# #
allow chronyd_t self:capability { setuid setgid sys_time }; allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time };
allow chronyd_t self:process { getcap setcap }; allow chronyd_t self:process { getcap setcap setrlimit };
allow chronyd_t self:unix_dgram_socket create_socket_perms; allow chronyd_t self:shm create_shm_perms;
allow chronyd_t self:udp_socket create_socket_perms; allow chronyd_t self:udp_socket create_socket_perms;
allow chronyd_t self:unix_dgram_socket create_socket_perms;
allow chronyd_t chronyd_keys_t:file read_file_perms;
manage_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t) manage_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
manage_dirs_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t) manage_dirs_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
manage_sock_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
files_var_lib_filetrans(chronyd_t, chronyd_var_lib_t, { file dir }) files_var_lib_filetrans(chronyd_t, chronyd_var_lib_t, { file dir })
manage_files_pattern(chronyd_t, chronyd_var_log_t, chronyd_var_log_t) manage_files_pattern(chronyd_t, chronyd_var_log_t, chronyd_var_log_t)
@ -42,7 +49,7 @@ logging_log_filetrans(chronyd_t, chronyd_var_log_t, { file dir })
manage_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t) manage_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
manage_dirs_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t) manage_dirs_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
files_pid_filetrans(chronyd_t, chronyd_var_run_t, { file }) files_pid_filetrans(chronyd_t, chronyd_var_run_t, file)
corenet_udp_bind_ntp_port(chronyd_t) corenet_udp_bind_ntp_port(chronyd_t)
# bind to udp/323 # bind to udp/323
@ -56,3 +63,7 @@ auth_use_nsswitch(chronyd_t)
logging_send_syslog_msg(chronyd_t) logging_send_syslog_msg(chronyd_t)
miscfiles_read_localization(chronyd_t) miscfiles_read_localization(chronyd_t)
optional_policy(`
gpsd_rw_shm(chronyd_t)
')