57df6fa0d5
sysnetwork: Move optional block in sysnet_dns_name_resolve().
2019-01-05 13:42:11 -05:00
73f8b85ef3
misc interfaces
...
This patch has some small interface changes as well as the policy patches to
use the new interfaces.
2019-01-05 13:36:20 -05:00
404dcf2af4
Allow sysnet_dns_name_resolve() to use resolved to resolve DNS names
...
Also allow unconfined_t to talk with the resolved daemon
2018-11-11 13:36:05 +01:00
71b2ed038c
sysnetwork: Move lines in sysnet_read_config().
2018-04-25 17:33:51 -04:00
0ae2abab2e
sysnetwork: put systemd_read_resolved_runtime in an ifdef
...
commit f865919872
2018-04-25 17:28:59 -04:00
f865919872
Interface to read /run/systemd/resolve/resolv.conf
...
With systemd, /etc/resolv.conf is a symlink to /run/systemd/resolve/resolv.conf allow domains with access to read network configuration to read this file.
Please note, this can't be in optional due to tunable_policy in nis_authenticate interface.
type=AVC msg=audit(1523455881.596:214): avc: denied { search } for pid=944 comm="chronyd" name="resolve" dev="tmpfs" ino=14267 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:systemd_resolved_var_run_t:s0 tclass=dir
type=AVC msg=audit(1523455881.596:214): avc: denied { read } for pid=944 comm="chronyd" name="resolv.conf" dev="tmpfs" ino=14277 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:systemd_resolved_var_run_t:s0 tclass=file
type=AVC msg=audit(1523455881.596:214): avc: denied { open } for pid=944 comm="chronyd" path="/run/systemd/resolve/resolv.conf" dev="tmpfs" ino=14277 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:systemd_resolved_var_run_t:s0 tclass=file
type=AVC msg=audit(1523455881.596:215): avc: denied { getattr } for pid=944 comm="chronyd" path="/run/systemd/resolve/resolv.conf" dev="tmpfs" ino=14277 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:systemd_resolved_var_run_t:s0 tclass=file
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2018-04-17 20:14:50 -04:00
1601ec59b2
Allow domains using sysnet_dns_name_resolve() interface to access NSS mymachines files
...
If the machine is using the mymachine NSS module, the domain doing DNS
resolution should be able to access files under /run/systemd/machines/
2017-12-07 18:50:30 -05:00
73d8b3026c
Systemd-related changes from Russell Coker.
2017-04-06 17:37:50 -04:00
0857061b58
hostname: do not audit attempts by hostname to read and write dhcpc udp sockets (looks like a leaked fd)
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-27 15:13:19 -04:00
b4b077f3fd
Rearrange sysnet if blocks.
2013-09-27 14:41:54 -04:00
ac5d072465
sysnetwork: Debian stores network interface configuration in /run/network (ifstate), That directory is created by the /etc/init.d/networking script.
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-27 14:39:29 -04:00
79e1e4efb9
NSCD related changes in various policy modules
...
Use nscd_use instead of nscd_socket_use. This conditionally allows
nscd_shm_use
Remove the nscd_socket_use from ssh_keygen since it was redundant
already allowed by auth_use_nsswitch
Had to make some ssh_keysign_t rules unconditional else
nscd_use(ssh_keysign_t) would not build (nested booleans) but that does
not matter, the only actual domain transition to ssh_keysign_t is
conditional so the other unconditional ssh_keygen_t rules are
conditional in practice
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-01-03 10:43:10 -05:00
176afaf5d6
For virtd
...
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2012-10-30 13:58:02 -04:00
4f24b1841c
Add optional name for kernel and system filetrans interfaces.
2012-05-10 09:53:45 -04:00
364768e8e9
Fix whitespace issues in sysnetwork.if.
2012-04-20 15:39:36 -04:00
2260ef56f8
Adding dontaudit interfaces in sysnet
...
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-04-20 15:39:04 -04:00
f9145eae44
Add role attributes to dhcpc.
2011-09-21 08:27:37 -04:00
66e03ec8b2
Module version bump for LDAPS patch. Move a line.
2011-08-24 09:38:58 -04:00
9a680874fe
Support LDAPS for nsswitch-related network activity
...
Systems that use LDAPS (LDAP over SSL/TLS) for their sysnet_* activities
currently fail since these domains do not allow proper access to the random
devices (needed for SSL/TLS). This patch adds this privilege to
sysnet_use_ldap.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-08-24 09:33:43 -04:00
a1f7561ad3
Whitespace fixes in sysnetwork.
2011-02-28 09:33:29 -05:00
f39eeece2f
patch to add a missing interface in the sysnetwork module
...
This patch adds a new interface to the sysnetwork module so
that the DHCP client state directories can be searched.
2011-02-28 09:31:39 -05:00
a0546c9d1c
System layer xml fixes.
...
Signed-off-by: Dominick Grift <domg472@gmail.com>
2010-08-05 09:25:55 -04:00
a7ee7f819a
Docs standardizing on the role portion of run interfaces. Additional docs cleanup.
2010-08-03 09:20:22 -04:00
1fa92b8a55
Sysnetwork patch from Dan Walsh.
2010-03-18 15:40:04 -04:00
d6887176c1
Improve sysnet_read_config() documentation.
2010-02-25 13:54:34 -05:00
81a0fb4024
Switch sysnet_use_portmap(), sysnet_use_ldap(), and sysnet_dns_name_resolve() to use sysnet_read_config() rather thane explicit type usage.
2010-02-25 13:53:52 -05:00
aadcb968f9
Move netlink route sockets from nsswitch to DNS name resolve.
2010-02-17 20:28:59 -05:00
3f67f722bb
trunk: whitespace fixes
2009-06-26 14:40:13 +00:00
c1262146e0
trunk: Remove node definitions and change node usage to generic nodes.
2009-01-09 19:48:02 +00:00
668b3093ff
trunk: change network interface access from all to generic network interfaces.
2009-01-06 20:24:10 +00:00
ff8f0a63f4
trunk: whitespace fixes in xml blocks.
2008-12-03 19:16:20 +00:00
296273a719
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
82d2775c92
trunk: more open perm fixes.
2008-10-20 16:10:42 +00:00
e828954c63
trunk: 4 patches from dan.
2008-03-27 15:20:16 +00:00
2ed4f5aedf
trunk: small fixes for gentoo system.
2008-03-20 14:55:17 +00:00
1900668638
trunk: Unified labeled networking policy from Paul Moore.
...
The latest revision of the labeled policy patches which enable both labeled
and unlabeled policy support for NetLabel. This revision takes into account
Chris' feedback from the first version and reduces the number of interface
calls in each domain down to two at present: one for unlabeled access, one for
NetLabel access. The older, transport layer specific interfaces, are still
present for use by third-party modules but are not used in the default policy
modules.
trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore.
This patch changes the policy to use the netmsg initial SID as the "base"
SID/context for NetLabel packets which only have MLS security attributes.
Currently we use the unlabeled initial SID which makes it very difficult to
distinquish between actual unlabeled packets and those packets which have MLS
security attributes.
2007-06-27 15:23:21 +00:00
8021cb4f63
Merge sbin_t and ls_exec_t into bin_t.
2007-03-23 23:24:59 +00:00
c0868a7a3b
merge policy patterns to trunk
2006-12-12 20:08:08 +00:00
bbcd3c97dd
add main part of role-o-matic
2006-09-06 22:07:25 +00:00
17de1b790b
remove extra level of directory
2006-07-12 20:32:27 +00:00
Chris PeBenito
Russell Coker
Laurent Bigonville
Jason Zaman
Dave Sugar
Dominick Grift
Chris PeBenito
Sven Vermeulen
Guido Trentalancia
Dominick Grift
Chris PeBenito