RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

chronyd patch from Dan Walsh 

Fixed a couple style/spacing issues.
Added files_search_etc for chronyd_keys file
This commit is contained in:
Jeremy Solt 2010-03-24 15:57:15 -04:00 committed by Chris PeBenito
parent c586c1bfa6
commit dcbb332992
3 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/services/chronyd.fc
View File

@ -1,3 +1,5 @@
/etc/chrony\.keys -- gen_context(system_u:object_r:chronyd_keys_t,s0)
/etc/rc\.d/init\.d/chronyd -- gen_context(system_u:object_r:chronyd_initrc_exec_t,s0)
/usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0)

9
policy/modules/services/chronyd.if
View File

@ -6,7 +6,7 @@
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -25,7 +25,7 @@ interface(`chronyd_domtrans',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -77,7 +77,7 @@ interface(`chronyd_admin',`
gen_require(`
type chronyd_t, chronyd_var_log_t;
type chronyd_var_run_t, chronyd_var_lib_t;
type chronyd_initrc_exec_t;
type chronyd_initrc_exec_t, chronyd_keys_t;
')
allow $1 chronyd_t:process { ptrace signal_perms };
@ -88,6 +88,9 @@ interface(`chronyd_admin',`
role_transition $2 chronyd_initrc_exec_t system_r;
allow $2 system_r;
files_search_etc($1)
admin_pattern($1, chronyd_keys_t)
logging_search_logs($1)
admin_pattern($1, chronyd_var_log_t)

19
policy/modules/services/chronyd.te
View File

@ -13,6 +13,9 @@ init_daemon_domain(chronyd_t, chronyd_exec_t)
type chronyd_initrc_exec_t;
init_script_file(chronyd_initrc_exec_t)
type chronyd_keys_t;
files_type(chronyd_keys_t)
type chronyd_var_lib_t;
files_type(chronyd_var_lib_t)
@ -27,13 +30,17 @@ files_pid_file(chronyd_var_run_t)
# Local policy
#
allow chronyd_t self:capability { setuid setgid sys_time };
allow chronyd_t self:process { getcap setcap };
allow chronyd_t self:unix_dgram_socket create_socket_perms;
allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time };
allow chronyd_t self:process { getcap setcap setrlimit };
allow chronyd_t self:shm create_shm_perms;
allow chronyd_t self:udp_socket create_socket_perms;
allow chronyd_t self:unix_dgram_socket create_socket_perms;
allow chronyd_t chronyd_keys_t:file read_file_perms;
manage_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
manage_dirs_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
manage_sock_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
files_var_lib_filetrans(chronyd_t, chronyd_var_lib_t, { file dir })
manage_files_pattern(chronyd_t, chronyd_var_log_t, chronyd_var_log_t)
@ -42,7 +49,7 @@ logging_log_filetrans(chronyd_t, chronyd_var_log_t, { file dir })
manage_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
manage_dirs_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
files_pid_filetrans(chronyd_t, chronyd_var_run_t, { file })
files_pid_filetrans(chronyd_t, chronyd_var_run_t, file)
corenet_udp_bind_ntp_port(chronyd_t)
# bind to udp/323
@ -56,3 +63,7 @@ auth_use_nsswitch(chronyd_t)
logging_send_syslog_msg(chronyd_t)
miscfiles_read_localization(chronyd_t)
optional_policy(`
gpsd_rw_shm(chronyd_t)
')