RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

locallogin: fine tune DAC override permissions 

Improve the locallogin module by curbing on dac_override permissions
in the sulogin domain (read/search permissions only).

Thanks to Dominick Grift for suggesting this.

Other modules are likely affected by the same issue.

Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
This commit is contained in:
Guido Trentalancia 2017-04-28 01:45:33 +02:00 committed by Chris PeBenito
parent bb8f9f49c3
commit f4706daf3b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/system/locallogin.te
View File

@ -216,7 +216,8 @@ optional_policy(`
# Sulogin local policy
#
allow sulogin_t self:capability { dac_override sys_admin sys_tty_config };
dontaudit sulogin_t self:capability dac_override;
allow sulogin_t self:capability { dac_read_search sys_admin sys_tty_config };
allow sulogin_t self:process setexec;
allow sulogin_t self:fd use;
allow sulogin_t self:fifo_file rw_fifo_file_perms;