Re: policy patch

[Russell Coker <russell@coker.com.au>]

[-- Attachment #1: Type: text/plain, Size: 973 bytes --]

On Tue, 24 Aug 2004 22:23, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> On Tue, 2004-08-24 at 04:18, Russell Coker wrote:
> > diff1 removes some unnecessary dontaudit lines from syslogd.te, if there
> > is to be one single domain accessing devpts_t:chr_file then syslogd_t is
> > not it, and if a log file gets type unlabeled_t then it's something we
> > want audited.
>
> Both rules were added by Dan, so please coordinate such changes with
> him.  The dontaudit rules for devpts_t:chr_file are for the targeted
> policy, which has no derived types for ptys or ttys; daemon restart will

In that case we should modify the daemon_core_rules() macro to solve it 
properly.  I've attached a patch which should fix this.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[-- Attachment #2: diff --]
[-- Type: text/x-diff, Size: 411 bytes --]

--- /usr/src/se/policy/macros/global_macros.te	2004-08-24 16:01:30.000000000 +1000
+++ macros/global_macros.te	2004-08-25 02:52:43.000000000 +1000
@@ -292,6 +292,9 @@
 ifdef(`automount.te', `
 allow $1_t autofs_t:dir { search getattr };
 ')dnl end if automount.te
+ifdef(`targeted_policy', `
+dontaudit $1_t devpts_t:chr_file { read write };
+')dnl end if targeted_policy
 
 ')dnl end macro daemon_core_rules