From a26923c32ef39bb83e17ecfe07332e24e2c95191 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Wed, 28 Mar 2007 18:47:45 +0000 Subject: [PATCH] Two patches from Paul Moore to for ipsec to remove redundant rules and have setkey read the config file. --- Changelog | 2 ++ policy/modules/system/ipsec.te | 10 +++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/Changelog b/Changelog index dc1eebf4e..8fe62ff6d 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,5 @@ +- Two patches from Paul Moore to for ipsec to remove redundant rules and + have setkey read the config file. - Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te index 794838b05..e3897a0f7 100644 --- a/policy/modules/system/ipsec.te +++ b/policy/modules/system/ipsec.te @@ -1,5 +1,5 @@ -policy_module(ipsec,1.2.2) +policy_module(ipsec,1.2.3) ######################################## # @@ -330,8 +330,6 @@ logging_send_syslog_msg(racoon_t) miscfiles_read_localization(racoon_t) -seutil_read_config(setkey_t) - ######################################## # # Setkey local policy @@ -341,6 +339,10 @@ allow setkey_t self:capability net_admin; allow setkey_t self:key_socket { create read setopt write }; allow setkey_t self:netlink_route_socket create_netlink_socket_perms; +allow setkey_t ipsec_conf_file_t:dir list_dir_perms; +read_files_pattern(setkey_t,ipsec_conf_file_t,ipsec_conf_file_t) +read_lnk_files_pattern(setkey_t,ipsec_conf_file_t,ipsec_conf_file_t) + # allow setkey to set the context for ipsec SAs and policy. allow setkey_t ipsec_spd_t:association setcontext; @@ -349,6 +351,8 @@ domain_ipsec_setcontext_all_domains(setkey_t) files_read_etc_files(setkey_t) +init_dontaudit_use_fds(setkey_t) + locallogin_use_fds(setkey_t) libs_use_ld_so(setkey_t)