From: Russell Coker <russell@coker.com.au>
To: SE Linux <selinux@tycho.nsa.gov>
Subject: policy patch
Date: Sun, 4 Jul 2004 15:04:48 +1000 [thread overview]
Message-ID: <200407041504.48924.russell@coker.com.au> (raw)
[-- Attachment #1: Type: text/plain, Size: 587 bytes --]
The attached patch fixes a problem with LVM on Fedora, some annoying audit
messages from rpm, and has some of the stuff that's needed for Postgresql (NB
it's not enough to make Postgresql fully functional but it's a definite
improvement over what's currently there so it's worth having).
Steve, please put this into Sourceforge.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
[-- Attachment #2: diff --]
[-- Type: text/x-diff, Size: 2546 bytes --]
diff -ru policy-1.14/domains/program/unused/lvm.te selinux-policy-default-1.14/domains/program/unused/lvm.te
--- policy-1.14/domains/program/unused/lvm.te 2004-06-24 22:48:00.000000000 +1000
+++ selinux-policy-default-1.14/domains/program/unused/lvm.te 2004-07-02 12:59:06.000000000 +1000
@@ -93,6 +93,7 @@
dontaudit lvm_t initctl_t:fifo_file getattr;
dontaudit lvm_t sbin_t:file getattr;
allow lvm_t lvm_control_t:chr_file rw_file_perms;
+allow initrc_t lvm_control_t:chr_file unlink;
dontaudit lvm_t var_run_t:dir getattr;
allow lvm_t tmpfs_t:dir getattr;
diff -ru policy-1.14/domains/program/unused/rpm.te selinux-policy-default-1.14/domains/program/unused/rpm.te
--- policy-1.14/domains/program/unused/rpm.te 2004-06-17 23:33:14.000000000 +1000
+++ selinux-policy-default-1.14/domains/program/unused/rpm.te 2004-07-02 00:50:38.000000000 +1000
@@ -93,6 +93,8 @@
allow rpm_t sysfs_t:filesystem getattr;
allow rpm_t tmpfs_t:filesystem getattr;
dontaudit rpm_t domain:{ socket unix_dgram_socket udp_socket unix_stream_socket tcp_socket fifo_file rawip_socket packet_socket } getattr;
+allow rpm_t fs_type:dir getattr;
+allow rpm_t fs_type:filesystem getattr;
# allow compiling and loading new policy
create_dir_file(rpm_t, { policy_src_t policy_config_t })
diff -ru policy-1.14/file_contexts/program/postgresql.fc selinux-policy-default-1.14/file_contexts/program/postgresql.fc
--- policy-1.14/file_contexts/program/postgresql.fc 2004-06-24 22:48:00.000000000 +1000
+++ selinux-policy-default-1.14/file_contexts/program/postgresql.fc 2004-07-03 00:18:45.000000000 +1000
@@ -1,5 +1,18 @@
# postgresql - ldap server
/usr/lib(64)?/postgresql/bin/.* -- system_u:object_r:postgresql_exec_t
+/usr/bin/postgres -- system_u:object_r:postgresql_exec_t
+/usr/bin/pg_dump -- system_u:object_r:postgresql_exec_t
+/usr/bin/pg_dumpall -- system_u:object_r:postgresql_exec_t
+/usr/bin/pg_resetxlog -- system_u:object_r:postgresql_exec_t
+/etc/rc.d/init.d/postgresql -- system_u:object_r:postgresql_exec_t
+
+# not sure whether the following binaries need labelling
+/usr/bin/createlang -- system_u:object_r:postgresql_exec_t
+/usr/bin/droplang -- system_u:object_r:postgresql_exec_t
+/usr/bin/pg_encoding -- system_u:object_r:postgresql_exec_t
+/usr/bin/pg_id -- system_u:object_r:postgresql_exec_t
+/usr/bin/pg_restore -- system_u:object_r:postgresql_exec_t
+
/var/lib/postgres(/.*)? system_u:object_r:postgresql_db_t
/var/lib/pgsql(/.*)? system_u:object_r:postgresql_db_t
/var/run/postgresql(/.*)? system_u:object_r:postgresql_var_run_t
next reply other threads:[~2004-07-04 5:04 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-07-04 5:04 Russell Coker [this message]
2004-07-07 20:47 ` policy patch Stephen Smalley
-- strict thread matches above, loose matches on Subject: below --
2005-08-18 7:31 Russell Coker
2005-01-12 18:46 [Fwd: New policy patch] Daniel J Walsh
2005-01-21 20:36 ` James Carter
2005-03-29 16:47 ` Policy Patch Daniel J Walsh
2005-04-01 20:28 ` James Carter
2004-11-25 13:27 policy patch Russell Coker
2004-11-25 16:32 ` Luke Kenneth Casson Leighton
2004-11-25 19:05 ` Russell Coker
2004-11-25 20:34 ` Luke Kenneth Casson Leighton
2004-11-29 19:23 ` James Carter
2004-11-29 21:47 ` Daniel J Walsh
2004-11-30 16:42 ` Daniel J Walsh
2004-10-13 5:55 Russell Coker
2004-10-13 20:17 ` James Carter
2004-08-24 8:18 Russell Coker
2004-08-24 12:23 ` Stephen Smalley
2004-08-24 16:54 ` Russell Coker
2004-08-27 20:58 ` James Carter
2004-08-28 13:46 ` Russell Coker
2004-08-30 20:24 ` James Carter
2004-07-12 14:12 Russell Coker
2004-07-12 19:46 ` Luke Kenneth Casson Leighton
2004-07-11 7:59 Russell Coker
2004-07-12 13:30 ` Stephen Smalley
2002-12-03 14:47 Stephen D. Smalley
2002-11-29 11:45 Russell Coker
2002-09-21 4:39 Russell Coker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200407041504.48924.russell@coker.com.au \
--to=russell@coker.com.au \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.