[refpolicy] [PATCH 2/7] Support shared memory

[sven.vermeulen@siphos.be (Sven Vermeulen)]

Zabbix servers use shared memory to keep common information and structures.
This is implemented on tmpfs. We support this by introducing a
zabbix_tmpfs_t type and allow the server proper access to it.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/services/zabbix.te |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te
index 3dd76ca..bec98e9 100644
--- a/policy/modules/services/zabbix.te
+++ b/policy/modules/services/zabbix.te
@@ -16,6 +16,10 @@ init_script_file(zabbix_initrc_exec_t)
 type zabbix_log_t;
 logging_log_file(zabbix_log_t)
 
+# shared memory
+type zabbix_tmpfs_t;
+files_tmpfs_file(zabbix_tmpfs_t);
+
 # pid files
 type zabbix_var_run_t;
 files_pid_file(zabbix_var_run_t)
@@ -30,6 +34,7 @@ allow zabbix_t self:fifo_file rw_file_perms;
 allow zabbix_t self:process { setsched getsched signal };
 allow zabbix_t self:unix_stream_socket create_stream_socket_perms;
 allow zabbix_t self:sem create_sem_perms;
+allow zabbix_t self:shm create_shm_perms;
 
 # log files
 allow zabbix_t zabbix_log_t:dir setattr;
@@ -41,6 +46,10 @@ manage_dirs_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t)
 manage_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t)
 files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file })
 
+# shared memory
+rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t)
+fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, { dir file })
+
 files_read_etc_files(zabbix_t)
 
 miscfiles_read_localization(zabbix_t)
-- 
1.7.3.4