screen.te zsh fixes

[Colin Walters <walters@verbum.org>]

[-- Attachment #1: Type: text/plain, Size: 425 bytes --]

Hi,

Similar fixes to screen.te needed for the zsh symlinks.  Patch attached.

You know though, I am thinking more and more that we should treat
/etc/alternatives specially for setfiles.  We could follow the symlink
and label it with the type of the file it points to.  That way we
wouldn't have to add all these special etc_t:{lnk_file} { read }
permissions to various programs that are able to execute bin_t or
whatever.



[-- Attachment #2: screen-te.patch --]
[-- Type: text/plain, Size: 816 bytes --]

--- /usr/share/selinux/policy/default/macros/program/screen_macros.te	Sat May 24 22:07:24 2003
+++ screen_macros.te	Sat Jun 28 02:32:23 2003
@@ -63,7 +63,7 @@
 allow $1_screen_t proc_t:dir search;
 allow $1_screen_t proc_t:lnk_file read;
 dontaudit $1_screen_t device_t:chr_file { getattr };
-allow $1_screen_t etc_t:file { read getattr };
+allow $1_screen_t etc_t:{file lnk_file} { read getattr };
 allow $1_screen_t self:dir { search read };
 allow $1_screen_t self:lnk_file { read };
 allow $1_screen_t device_t:dir search;
@@ -72,6 +72,7 @@
 allow $1_screen_t self:unix_stream_socket create_socket_perms;
 can_exec($1_screen_t, shell_exec_t)
 allow $1_screen_t bin_t:dir search;
+allow $1_screen_t bin_t:lnk_file { read };
 
 dontaudit $1_screen_t file_type:{ chr_file blk_file } getattr;
 ')