Re: mysql policy

[Tom <tom@lemuria.org>]

[-- Attachment #1: Type: text/plain, Size: 611 bytes --]

Here's a small patch to mysqld.te which solves the startup problem for
me and lets mysqld run without any error.
I believe these changes do not open any security problems as they don't
give init access to the databases. One could do away with the
requirement to write into the /var/lib/mysql directory with a few
changes to the safe_mysqld startup script, but I don't think it would
make much of a difference, security-wise.


-- 
PGP/GPG key: http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

[-- Attachment #2: mysqld.diff --]
[-- Type: text/plain, Size: 713 bytes --]

--- default/domains/program/mysqld.te   2002-10-27 02:29:00.000000000 +0200
+++ current/domains/program/mysqld.te   2002-10-28 17:32:28.000000000 +0100
@@ -26,6 +26,8 @@
 allow initrc_t var_run_mysqld_t:sock_file write;

 allow initrc_t mysqld_log_t:file { write append setattr ioctl };
+allow initrc_t etc_mysqld_t:file { read };
+allow initrc_t mysqld_db_t:dir { write };

 allow mysqld_t self:capability { setgid setuid };
 allow mysqld_t self:process getsched;
@@ -34,7 +36,8 @@

 # Allow access to the mysqld databases
 create_dir_file(mysqld_t, mysqld_db_t)
-allow mysqld_t var_lib_t:dir search;
+allow mysqld_t var_lib_t:dir { getattr search };
+

 # read config files
 r_dir_file(mysqld_t, etc_mysqld_t)