ntp policy

["Christopher J. PeBenito" <cpebenito@tresys.com>]

While converting the ntpd policy over to a reference policy module, I
came across a few lines which bring up questions.

	# so the start script can change firewall entries
	allow initrc_t net_conf_t:file { getattr read ioctl };

This looks like a distro-specific access, or perhaps it just made its
way in by accident?

	# for cron jobs
	# system_crond_t is not right, cron is not doing what it should
	ifdef(`crond.te', `
	system_crond_entry(ntpd_exec_t, ntpd_t)
	')

It is unclear to me what the comment means.  Also, shouldn't this be
ntpdate_exec_t instead of ntpd_exec_t?

	can_udp_send(ntpd_t, sysadm_t)
	can_udp_send(sysadm_t, ntpd_t)

There is no comment for these.  Are they needed for sysadm to run
ntpdate?

	ifdef(`winbind.te', `
	allow ntpd_t winbind_var_run_t:dir r_dir_perms;
	allow ntpd_t winbind_var_run_t:sock_file rw_file_perms;
	')

Generally when using a sock_file, a domain is connecting/sending to
another domain over a unix domain socket; however, after doing a few
rule searches in apol, I find no evidence that ntpd_t connects/sends to
winbind_t.  Is there some other purpose for these rules, or am I missing
something?

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.