suggested policy change

[Justin Smith <jsmith@mcs.drexel.edu>]

Adding the rules:
# policy/domains/system/kmod.te
allow kmod_t sysctl_kernel_t:file rw_file_perms;

# policy/domains/program/modutil.te
allow insmod_t sysctl_kernel_t:file rw_file_perms;

results in the error messages:

error in the statement ending on line 25688 (token ';'): assertion
failed:  allow kmod_t sysctl_kernel_t:file { write append } was granted.


error in the statement ending on line 25688 (token ';'): assertion
failed:  allow insmod_t sysctl_kernel_t:file { write append } was
granted.

i.e., they conflict with some of the neverallow rules. Should I simply
get rid of the appropriate neverallow rules?

--

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.