diff --git a/policy/modules/services/gpsd.fc b/policy/modules/services/gpsd.fc index e7bbeb14d..5e81e3345 100644 --- a/policy/modules/services/gpsd.fc +++ b/policy/modules/services/gpsd.fc @@ -1 +1,6 @@ -/usr/sbin/gpsd -- gen_context(system_u:object_r:gpsd_exec_t,s0) +/etc/rc\.d/init\.d/gpsd -- gen_context(system_u:object_r:gpsd_initrc_exec_t,s0) + +/usr/sbin/gpsd -- gen_context(system_u:object_r:gpsd_exec_t,s0) + +/var/run/gpsd\.pid -- gen_context(system_u:object_r:gpsd_var_run_t,s0) +/var/run/gpsd\.sock -s gen_context(system_u:object_r:gpsd_var_run_t,s0) diff --git a/policy/modules/services/gpsd.if b/policy/modules/services/gpsd.if index 7597332d2..39fc12f76 100644 --- a/policy/modules/services/gpsd.if +++ b/policy/modules/services/gpsd.if @@ -33,11 +33,6 @@ interface(`gpsd_domtrans',` ## The role to be allowed the gpsd domain. ## ## -## -## -## The type of the role's terminal. -## -## # interface(`gpsd_run',` gen_require(` @@ -46,11 +41,10 @@ interface(`gpsd_run',` gpsd_domtrans($1) role $2 types gpsd_t; - allow gpsd_t $3:chr_file rw_term_perms; ') ######################################## -## +## ## Read and write gpsd shared memory. ## ## diff --git a/policy/modules/services/gpsd.te b/policy/modules/services/gpsd.te index 9cdc1f140..d8c1654f9 100644 --- a/policy/modules/services/gpsd.te +++ b/policy/modules/services/gpsd.te @@ -1,5 +1,5 @@ -policy_module(gpsd, 1.0.0) +policy_module(gpsd, 1.0.1) ######################################## # @@ -11,15 +11,21 @@ type gpsd_exec_t; application_domain(gpsd_t, gpsd_exec_t) init_daemon_domain(gpsd_t, gpsd_exec_t) +type gpsd_initrc_exec_t; +init_script_file(gpsd_initrc_exec_t) + type gpsd_tmpfs_t; files_tmpfs_file(gpsd_tmpfs_t) +type gpsd_var_run_t; +files_pid_file(gpsd_var_run_t) + ######################################## # # gpsd local policy # -allow gpsd_t self:capability { setuid sys_nice setgid fowner }; +allow gpsd_t self:capability { fsetid setuid sys_nice setgid fowner }; allow gpsd_t self:process setsched; allow gpsd_t self:shm create_shm_perms; allow gpsd_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -29,6 +35,10 @@ manage_dirs_pattern(gpsd_t, gpsd_tmpfs_t, gpsd_tmpfs_t) manage_files_pattern(gpsd_t, gpsd_tmpfs_t, gpsd_tmpfs_t) fs_tmpfs_filetrans(gpsd_t, gpsd_tmpfs_t, { dir file }) +manage_files_pattern(gpsd_t, gpsd_var_run_t, gpsd_var_run_t) +manage_sock_files_pattern(gpsd_t, gpsd_var_run_t, gpsd_var_run_t) +files_pid_filetrans(gpsd_t, gpsd_var_run_t, { file sock_file }) + corenet_all_recvfrom_unlabeled(gpsd_t) corenet_all_recvfrom_netlabel(gpsd_t) corenet_tcp_sendrecv_generic_if(gpsd_t) @@ -51,5 +61,5 @@ optional_policy(` ') optional_policy(` - ntpd_rw_shm(gpsd_t) + ntp_rw_shm(gpsd_t) ')