From: dominick.grift@gmail.com (grift)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] [PATCH 3/9] Run packagekit under apt_t context on Debian distribution
Date: Thu, 06 Dec 2012 16:40:36 +0100 [thread overview]
Message-ID: <1354808436.25618.76.camel@localhost> (raw)
In-Reply-To: <1354745012-24557-3-git-send-email-bigon@debian.org>
On Wed, 2012-12-05 at 23:03 +0100, Laurent Bigonville wrote:
> From: Laurent Bigonville <bigon@bigon.be>
>
> Properly label the daemon and the needed files and directories
>
> Also allow the daemon to transition to its own context when started by
> the system dbus
This was merged, thanks
> ---
> apt.fc | 3 +++
> apt.te | 4 ++++
> rpm.fc | 4 ++--
> 3 files changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/apt.fc b/apt.fc
> index 93d315c..1fd6888 100644
> --- a/apt.fc
> +++ b/apt.fc
> @@ -2,7 +2,10 @@ ifndef(`distro_redhat',`
> /usr/bin/apt-get -- gen_context(system_u:object_r:apt_exec_t,s0)
> /usr/bin/apt-shell -- gen_context(system_u:object_r:apt_exec_t,s0)
> /usr/bin/aptitude -- gen_context(system_u:object_r:apt_exec_t,s0)
> +/usr/lib/packagekit/packagekitd -- gen_context(system_u:object_r:apt_exec_t,s0)
> /usr/sbin/synaptic -- gen_context(system_u:object_r:apt_exec_t,s0)
> +/var/cache/PackageKit(/.*)? gen_context(system_u:object_r:apt_var_cache_t,s0)
> +/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:apt_var_lib_t,s0)
> ')
>
> /var/cache/apt(/.*)? gen_context(system_u:object_r:apt_var_cache_t,s0)
> diff --git a/apt.te b/apt.te
> index 5ffc8b8..aaa43cc 100644
> --- a/apt.te
> +++ b/apt.te
> @@ -125,6 +125,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + dbus_system_domain(apt_t, apt_exec_t)
> +')
> +
> +optional_policy(`
> dpkg_read_db(apt_t)
> dpkg_domtrans(apt_t)
> dpkg_lock_db(apt_t)
> diff --git a/rpm.fc b/rpm.fc
> index e37a2d5..ebe91fc 100644
> --- a/rpm.fc
> +++ b/rpm.fc
> @@ -31,17 +31,17 @@ ifdef(`distro_redhat',`
> /usr/bin/apt-shell -- gen_context(system_u:object_r:rpm_exec_t,s0)
> /usr/bin/aptitude -- gen_context(system_u:object_r:rpm_exec_t,s0)
> /usr/sbin/synaptic -- gen_context(system_u:object_r:rpm_exec_t,s0)
> +/var/cache/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
> +/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
> ')
>
> /usr/share/yumex/yumex-yum-backend -- gen_context(system_u:object_r:rpm_exec_t,s0)
> /usr/share/yumex/yum_childtask\.py -- gen_context(system_u:object_r:rpm_exec_t,s0)
>
> /var/cache/bcfg2(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
> -/var/cache/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
> /var/cache/yum(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
>
> /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
> -/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
> /var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
> /var/lib/YaST2(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
> /var/lib/yum(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
next prev parent reply other threads:[~2012-12-06 15:40 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-12-05 22:03 [refpolicy] [PATCH 1/9] Add several named transition for directories created in /var/run by initscripts Laurent Bigonville
2012-12-05 22:03 ` [refpolicy] [PATCH 2/9] rpcbind.te: Add named file transition for pidfile created by initscript Laurent Bigonville
2012-12-05 22:03 ` [refpolicy] [PATCH 3/9] Run packagekit under apt_t context on Debian distribution Laurent Bigonville
2012-12-06 15:40 ` grift [this message]
2012-12-05 22:03 ` [refpolicy] [PATCH 4/9] Add proper label for colord daemon in debian Laurent Bigonville
2012-12-05 23:09 ` [refpolicy] [PATCH 4/9 v2] " Laurent Bigonville
2012-12-06 15:41 ` grift
2012-12-05 22:03 ` [refpolicy] [PATCH 5/9] Allow the system dbus to search cgroup directories Laurent Bigonville
2012-12-06 15:42 ` grift
2012-12-05 22:03 ` [refpolicy] [PATCH 6/9] Ensure that consolekit can create /var/run/console directory on Debian Laurent Bigonville
2012-12-05 22:13 ` grift
2012-12-09 13:14 ` grift
2012-12-05 22:03 ` [refpolicy] [PATCH 7/9] Allow virtd_t context to read sysctl_crypto_t Laurent Bigonville
2012-12-06 15:44 ` grift
2012-12-05 22:03 ` [refpolicy] [PATCH 8/9] Allow colord_t " Laurent Bigonville
2012-12-06 15:45 ` grift
2012-12-05 22:03 ` [refpolicy] [PATCH 9/9] Add proper label for gconfd-2 daemon in Debian Laurent Bigonville
2012-12-05 22:06 ` grift
2012-12-05 22:52 ` [refpolicy] [PATCH 9/9 v2] " Laurent Bigonville
2012-12-06 15:46 ` grift
2012-12-06 15:39 ` [refpolicy] [PATCH 1/9] Add several named transition for directories created in /var/run by initscripts grift
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1354808436.25618.76.camel@localhost \
--to=dominick.grift@gmail.com \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.