[refpolicy] [PATCH 1/1] Allow search within postgresql var directory for the stream connect interface

[sven.vermeulen@siphos.be (Sven Vermeulen)]

Domains that are granted postgresql_stream_connect() need to be able to search
through the postgresql_var_run_t directory (in which the socket is located).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/services/postgresql.if |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
index ecef19f..79ccc90 100644
--- a/policy/modules/services/postgresql.if
+++ b/policy/modules/services/postgresql.if
@@ -431,6 +431,7 @@ interface(`postgresql_stream_connect',`
 	files_search_pids($1)
 	allow $1 postgresql_t:unix_stream_socket connectto;
 	allow $1 postgresql_var_run_t:sock_file write;
+	allow $1 postgresql_var_run_t:dir search_dir_perms;
 	# Some versions of postgresql put the sock file in /tmp
 	allow $1 postgresql_tmp_t:sock_file write;
 ')
-- 
1.7.8.6