5fb1249f37
Use create_netlink_socket_perms when allowing netlink socket creation
...
create_netlink_socket_perms is defined as:
{ create_socket_perms nlmsg_read nlmsg_write }
This means that it is redundant to allow create_socket_perms and
nlmsg_read/nlmsg_write.
Clean up things without allowing anything new.
2014-10-23 08:07:44 -04:00
d6af57e5e7
Allow iw to create generic netlink sockets
...
iw uses generic netlink socket to configure WiFi properties. For
example, "strace iw dev wlan0 set power_save on" outputs:
socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_GENERIC) = 3
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [32768], 4) = 0
setsockopt(3, SOL_SOCKET, SO_RCVBUF, [32768], 4) = 0
bind(3, {sa_family=AF_NETLINK, pid=7836, groups=00000000}, 12) = 0
Some AVC denials are reported in audit.log:
type=AVC msg=audit(1408829044.820:486): avc: denied { create } for
pid=5950 comm="iw" scontext=system_u:system_r:ifconfig_t
tcontext=system_u:system_r:ifconfig_t tclass=netlink_socket
permissive=1
type=AVC msg=audit(1408829044.820:487): avc: denied { setopt } for
pid=5950 comm="iw" scontext=system_u:system_r:ifconfig_t
tcontext=system_u:system_r:ifconfig_t tclass=netlink_socket
permissive=1
type=AVC msg=audit(1408829044.820:488): avc: denied { bind } for
pid=5950 comm="iw" scontext=system_u:system_r:ifconfig_t
tcontext=system_u:system_r:ifconfig_t tclass=netlink_socket
permissive=1
type=AVC msg=audit(1408829044.820:489): avc: denied { getattr }
for pid=5950 comm="iw" scontext=system_u:system_r:ifconfig_t
tcontext=system_u:system_r:ifconfig_t tclass=netlink_socket
permissive=1
type=AVC msg=audit(1408829044.820:490): avc: denied { write } for
pid=5950 comm="iw" scontext=system_u:system_r:ifconfig_t
tcontext=system_u:system_r:ifconfig_t tclass=netlink_socket
permissive=1
Allowing ifconfig_t to create generic netlink sockets fixes this.
(On a side note, the AVC denials were caused by TLP, a tool which
applies "laptop configuration" when switching between AC and battery
with the help of a udev script)
2014-10-23 08:07:44 -04:00
491683b3e2
Module version bump for init_daemon_pid_file from Sven Vermeulen.
2014-06-30 14:34:51 -04:00
4a94489be7
Use init_daemon_pid_file instead of init_daemon_run_dir
...
Update non-contrib modules to use init_daemon_pid_file instead of
init_daemon_run_dir.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2014-06-26 08:34:27 -04:00
84f2b380cf
Module version bump for ifconfig fc entry from Sven Vermeulen.
2014-05-27 09:08:12 -04:00
10ff4d0fa3
Bump module versions for release.
2014-03-11 08:16:57 -04:00
3208ff94c4
Module version bump for second lot of patches from Dominick Grift.
2013-12-03 13:03:35 -05:00
521bbf8586
These { read write } tty_device_t chr files on boot up in Debian
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-12-03 10:39:21 -05:00
1a01976fc4
Module version bump for first batch of patches from Dominick Grift.
2013-12-02 14:22:29 -05:00
012f1b2311
sysbnetwork: dhclient searches /var/lib/ntp
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-12-02 08:43:32 -05:00
6c19504654
sysnetwork: dhcpc: networkmanager interface calls from Fedora. In Debian i was able to confirm the need for networkmanager_manage_lib_files(dhcpc_t) since dhclient reads /var/lib/NetworkManager/dhclient-eth0.conf
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-12-02 08:43:32 -05:00
eb4512f6eb
Module version bump for dhcpc fixes from Dominick Grift.
2013-09-27 17:15:22 -04:00
f0e0066a7b
Reorder dhcpc additions.
2013-09-27 17:15:02 -04:00
b1599e01fe
sysnetwork: dhcpc binds socket to random high udp ports sysnetwork: do not audit attempts by ifconfig to read, and write dhcpc udp sockets (looks like a leaked fd)
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-27 17:13:12 -04:00
cf905e8ef1
Module version bumps for dhcpc leaked fds to hostname.
2013-09-27 15:55:52 -04:00
f0ad29f609
Module version bump for debian ifstate changes from Dominick Grift.
2013-09-27 14:42:47 -04:00
ac5d072465
sysnetwork: Debian stores network interface configuration in /run/network (ifstate), That directory is created by the /etc/init.d/networking script.
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-27 14:39:29 -04:00
55ac5a503d
Module version bump for ethtool reading pm-powersave.lock from Dominick Grift.
2013-09-26 09:14:07 -04:00
7c6ba1570e
sysnetwork: ethtool reads /run/pm-utils/locks/pm-powersave.lock
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-26 08:57:19 -04:00
d174521a64
Bump module versions for release.
2013-04-24 16:14:52 -04:00
be2e70be8d
Module version bump for fixes from Dominick Grift.
2013-01-03 10:53:34 -05:00
104456aa17
Module version bump for interfaces used by virt from Dominick Grift.
2012-10-30 14:17:25 -04:00
a2cc003740
Module version bump for minor logging and sysnet changes from Sven Vermeulen.
2012-10-30 13:39:46 -04:00
7ed91bfafd
Support flushing routing cache
...
To flush the routing cache, ifconfig_t (through the "ip" command) requires
sys_admin capability. If not:
~# ip route flush cache
Cannot flush routing cache
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-10-30 13:28:02 -04:00
e4f0112175
Module version bump for dhcp6 ports, from Russell Coker.
2012-10-19 08:39:02 -04:00
f9bee5a60b
Label port 5546 as dhcpc_port_t and allow dhcpc_t to bind to TCP for client control
...
Client control is used by the wide dhcp6 client, which can be controlled
via dhcp6ctl. This works by communicating over port 5546.
2012-10-19 08:19:28 -04:00
afdb509245
Module version bump for changes from Dominick Grift and Sven Vermeulen.
2012-10-09 11:01:42 -04:00
4ea2bc7eba
Changes to the sysnetwork policy module
...
dhcpc is a dbus_system_domain()
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2012-10-09 10:18:36 -04:00
0a6013cd4f
Module version bump for /run/dhcpc directory creation by dhcp from Sven Vermeulen.
2012-08-21 15:25:13 -04:00
452942ca99
DHCP client's hooks create /run/dhcpc directory
...
This directory contains the working files for updating network-related files
(like resolv.conf for name servers) before they are copied to the fixed
location. Although already in use previously, this location (/var/run/dhcpc or
/var/run/dhcpcd) was statically defined on the system.
With the introduction of /run and systems having /var/run -> /run, this is now a
dynamically created directory by dhcpc_t. Hence, the policy is enhanced allowing
dhcpc_t to create dhcpc_var_run_t directories, and include a file transition for
directories created in the var_run_t location(s).
Changes since v1
----------------
- Use create_dirs_pattern instead of manage_dirs_pattern
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-08-21 15:07:47 -04:00
3516535aa6
Bump module versions for release.
2012-07-25 14:33:06 -04:00
4f24b1841c
Add optional name for kernel and system filetrans interfaces.
2012-05-10 09:53:45 -04:00
9e56720a39
Module version bump and changelog for various dontaudits from Sven Vermenulen.
2012-04-20 16:06:54 -04:00
f65edd8280
Bump module versions for release.
2012-02-15 14:32:45 -05:00
3cbb3701cd
Module version bumps for debian fc patch from Russell Coker.
2011-11-16 15:31:48 -05:00
7d6b1e5889
Module version bump and changelog for role attributes usage.
2011-09-21 09:16:34 -04:00
f9145eae44
Add role attributes to dhcpc.
2011-09-21 08:27:37 -04:00
66e03ec8b2
Module version bump for LDAPS patch. Move a line.
2011-08-24 09:38:58 -04:00
12904f9fe8
Module version bump for dhcp client patch from Sven Vermeulen.
2011-08-24 09:15:33 -04:00
4976982e85
Allow dhcp client to update kernel routing table plus context updates
...
This small patch updates the dhcpc_t (DHCP client domain) to allow updating the
kernel's routing tables (as that is a primary purpose of a DHCP client) as well
as interact with the kernel through the net_sysctls.
Also, one client (dhcpcd) uses /var/run/dhcpcd so add that in the file context
definition as well.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-08-24 09:13:33 -04:00
aa4dad379b
Module version bump for release.
2011-07-26 08:11:01 -04:00
86460648a6
Sysnetwork patch from Miroslav Grepl.
...
* adds support for "ip xfrm" command which allows assign a context
2011-03-21 09:48:05 -04:00
8103e7c1f4
Module version bump for sysnetwork interface from Guido Trentalancia.
2011-02-28 09:35:02 -05:00
bca0cdb86e
Remove duplicate/redundant rules, from Russell Coker.
2010-07-07 08:41:20 -04:00
48f99a81c0
Whitespace change: drop unnecessary blank line at the start of .te files.
2010-06-10 08:16:35 -04:00
29af4c13e7
Bump module versions for release.
2010-05-24 15:32:01 -04:00
1fa92b8a55
Sysnetwork patch from Dan Walsh.
2010-03-18 15:40:04 -04:00
aadcb968f9
Move netlink route sockets from nsswitch to DNS name resolve.
2010-02-17 20:28:59 -05:00
c3c753f786
Remove concept of user from terminal module interfaces dealing with ptynode and ttynode since these attributes are not specific to users.
2010-02-11 14:20:10 -05:00
7d2f96783c
Module version number bump for 1031ee6.
2010-02-08 13:37:42 -05:00
Nicolas Iooss
Chris PeBenito
Sven Vermeulen
Dominick Grift
Russell Coker
Chris PeBenito