From 170a46d6c5ee8de7dcdd69236ffcfed164068b53 Mon Sep 17 00:00:00 2001 From: Jeremy Solt Date: Thu, 1 Apr 2010 10:49:29 -0400 Subject: [PATCH] memcached patch from Dan Walsh Moved term_dontaudits up for style --- policy/modules/services/memcached.te | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/policy/modules/services/memcached.te b/policy/modules/services/memcached.te index 7c5818c44..9c946afc0 100644 --- a/policy/modules/services/memcached.te +++ b/policy/modules/services/memcached.te @@ -22,9 +22,12 @@ files_pid_file(memcached_var_run_t) # allow memcached_t self:capability { setuid setgid }; +dontaudit memcached_t self:capability sys_tty_config; +allow memcached_t self:process { fork setrlimit signal_perms }; allow memcached_t self:tcp_socket create_stream_socket_perms; allow memcached_t self:udp_socket { create_socket_perms listen }; allow memcached_t self:fifo_file rw_fifo_file_perms; +allow memcached_t self:unix_stream_socket create_stream_socket_perms; corenet_all_recvfrom_unlabeled(memcached_t) corenet_udp_sendrecv_generic_if(memcached_t) @@ -42,10 +45,15 @@ manage_dirs_pattern(memcached_t, memcached_var_run_t, memcached_var_run_t) manage_files_pattern(memcached_t, memcached_var_run_t, memcached_var_run_t) files_pid_filetrans(memcached_t, memcached_var_run_t, { file dir }) +kernel_read_kernel_sysctls(memcached_t) kernel_read_system_state(memcached_t) files_read_etc_files(memcached_t) -miscfiles_read_localization(memcached_t) +term_dontaudit_use_all_ptys(memcached_t) +term_dontaudit_use_all_ttys(memcached_t) +term_dontaudit_use_console(memcached_t) -sysnet_dns_name_resolve(memcached_t) +auth_use_nsswitch(memcached_t) + +miscfiles_read_localization(memcached_t)