From e426b5785f14e353f0b74070556a255bdc8466e5 Mon Sep 17 00:00:00 2001 From: Alexander Miroshnichenko Date: Sun, 30 Dec 2018 18:27:30 +0300 Subject: [PATCH] Add required permissions for nsd_t to be able running. Add required permissions to nsd_t for NSD work properly. --- policy/modules/services/nsd.te | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/policy/modules/services/nsd.te b/policy/modules/services/nsd.te index eb4051147..355ce0c7b 100644 --- a/policy/modules/services/nsd.te +++ b/policy/modules/services/nsd.te @@ -34,7 +34,7 @@ files_type(nsd_zone_t) # Local policy # -allow nsd_t self:capability { chown dac_override kill setgid setuid }; +allow nsd_t self:capability { chown dac_override kill setgid setuid dac_read_search net_admin }; dontaudit nsd_t self:capability sys_tty_config; allow nsd_t self:process signal_perms; allow nsd_t self:fifo_file rw_fifo_file_perms; @@ -44,12 +44,14 @@ allow nsd_t nsd_conf_t:dir list_dir_perms; allow nsd_t nsd_conf_t:file read_file_perms; allow nsd_t nsd_conf_t:lnk_file read_lnk_file_perms; +allow nsd_t nsd_db_t:file map; allow nsd_t nsd_db_t:file manage_file_perms; filetrans_pattern(nsd_t, nsd_zone_t, nsd_db_t, file) manage_files_pattern(nsd_t, nsd_var_run_t, nsd_var_run_t) files_pid_filetrans(nsd_t, nsd_var_run_t, file) +allow nsd_t nsd_zone_t:file { map }; manage_dirs_pattern(nsd_t, nsd_zone_t, nsd_zone_t) manage_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) manage_lnk_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t)