nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

modutils: update to run in confined mode

Browse Source 
Update the modutils module so that it can run in confined
mode instead of unconfined mode.

Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
This commit is contained in:
Guido Trentalancia 2016-12-23 02:15:14 +01:00 committed by Chris PeBenito
parent b0c13980d2
commit 732234f8b6
2 changed files with 3 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/kernel/files.if
View File

@ -4100,6 +4100,7 @@ interface(`files_manage_kernel_modules',`
type modules_object_t; type modules_object_t;
') ')
allow $1 modules_object_t:dir rw_dir_perms;
manage_files_pattern($1, modules_object_t, modules_object_t) manage_files_pattern($1, modules_object_t, modules_object_t)
') ')

10
policy/modules/system/modutils.te
View File

@ -89,8 +89,8 @@ files_read_usr_files(kmod_t)
files_exec_etc_files(kmod_t) files_exec_etc_files(kmod_t)
# for nscd: # for nscd:
files_dontaudit_search_pids(kmod_t) files_dontaudit_search_pids(kmod_t)
# for locking: (cjp: ????) # to manage modules.dep
files_write_kernel_modules(kmod_t) files_manage_kernel_modules(kmod_t)
fs_getattr_xattr_fs(kmod_t) fs_getattr_xattr_fs(kmod_t)
fs_dontaudit_use_tmpfs_chr_dev(kmod_t) fs_dontaudit_use_tmpfs_chr_dev(kmod_t)
@ -165,12 +165,6 @@ optional_policy(`
rpm_rw_pipes(kmod_t) rpm_rw_pipes(kmod_t)
') ')
optional_policy(`
unconfined_domain(kmod_t)
unconfined_dontaudit_rw_pipes(kmod_t)
unconfined_domtrans_to(kmod_t, kmod_exec_t)
')
optional_policy(` optional_policy(`
# cjp: why is this needed: # cjp: why is this needed:
dev_rw_xserver_misc(kmod_t) dev_rw_xserver_misc(kmod_t)