nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usermanage: Run /etc/cron\.daily/cracklib-runtime in the crack_t domain in Debian

Browse Source 
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
This commit is contained in:
Dominick Grift 2013-11-09 10:44:54 +01:00 committed by Chris PeBenito
parent 3208ff94c4
commit 6042255ede
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/admin/usermanage.fc
View File

@ -2,6 +2,10 @@ ifdef(`distro_gentoo',`
/bin/passwd -- gen_context(system_u:object_r:passwd_exec_t,s0) /bin/passwd -- gen_context(system_u:object_r:passwd_exec_t,s0)
') ')
ifdef(`distro_debian',`
/etc/cron\.daily/cracklib-runtime -- gen_context(system_u:object_r:crack_exec_t,s0)
')
/usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0) /usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0)
/usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0) /usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0)
/usr/bin/chsh -- gen_context(system_u:object_r:chfn_exec_t,s0) /usr/bin/chsh -- gen_context(system_u:object_r:chfn_exec_t,s0)

3
policy/modules/admin/usermanage.te
View File

@ -171,10 +171,13 @@ logging_send_syslog_msg(crack_t)
userdom_dontaudit_search_user_home_dirs(crack_t) userdom_dontaudit_search_user_home_dirs(crack_t)
ifdef(`distro_debian',` ifdef(`distro_debian',`
allow crack_t self:process getsched;
# the package cracklib-runtime on Debian contains a daily maintenance # the package cracklib-runtime on Debian contains a daily maintenance
# script /etc/cron.daily/cracklib-runtime, that calls # script /etc/cron.daily/cracklib-runtime, that calls
# update-cracklib and that calls crack_mkdict, which is a shell script. # update-cracklib and that calls crack_mkdict, which is a shell script.
corecmd_exec_shell(crack_t) corecmd_exec_shell(crack_t)
dev_search_sysfs(crack_t)
miscfiles_read_localization(crack_t)
') ')
optional_policy(` optional_policy(`