[refpolicy] [PATCH/RFC 3/19]: patch set to update the git reference policy

[guido@trentalancia.com (Guido Trentalancia)]

Hi Dominick,

just a quick question on one of your comments...

On Mon, 24/01/2011 at 15.21 +0100, Dominick Grift wrote:
> On 01/24/2011 01:43 AM, Guido Trentalancia wrote:
> > diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
> > --- refpolicy-git-18012011/policy/modules/admin/readahead.te	2011-01-08 19:07:21.165729194 +0100
> > +++ refpolicy-git-18012011-update/policy/modules/admin/readahead.te	2011-01-18 23:13:49.754846681 +0100
> > @@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
> >  
> >  auth_dontaudit_read_shadow(readahead_t)
> >  
> > +init_read_fifo_file(readahead_t)
> >  init_use_fds(readahead_t)
> >  init_use_script_ptys(readahead_t)
> >  init_getattr_initctl(readahead_t)
> > diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
> > --- refpolicy-git-18012011/policy/modules/system/init.if	2011-01-08 19:07:21.351758570 +0100
> > +++ refpolicy-git-18012011-new/policy/modules/system/init.if	2011-01-23 00:29:43.873713518 +0100
> > @@ -947,6 +947,24 @@ interface(`init_read_state',`
> >  
> >  ########################################
> >  ## <summary>
> > +##      Read init fifo file.
> > +## </summary>
> > +## <param name="domain">
> > +##      <summary>
> > +##      Domain allowed access.
> > +##      </summary>
> > +## </param>
> > +#
> > +interface(`init_read_fifo_file',`
> > +		gen_require(`
> > +		attribute init_t;
> > +	')
> > +
> > +	read_fifo_files_pattern($1, init_t, init_t)
> > +')
> 
> no need to for pattern here use: allow $1 init_t:fifo_file
> r_fifo_file_perms;

Why should we avoid the use of the pattern here ? It gives better
readability and also it grants permission to search the parent dir.

Regards,

Guido