Re: gentoo policy for dante

[petre rodan <kaiowas@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1192 bytes --]


Hi Daniel,

Daniel J Walsh wrote:
> Small change on previous patch.
> 
> Please ignore previous patch and use this one.
> 
[..]
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/stunnel.te policy-1.19.4/domains/program/unused/stunnel.te
> --- nsapolicy/domains/program/unused/stunnel.te	2004-11-18 14:44:59.000000000 -0500
> +++ policy-1.19.4/domains/program/unused/stunnel.te	2004-11-21 00:17:07.934617676 -0500
> @@ -2,21 +2,10 @@
>  #
>  # Author:   petre rodan <kaiowas@gentoo.org>
>  #
> +inetd_child_domain(stunnel, tcp)
>  
> -type stunnel_port_t, port_type;
> -
> -daemon_domain(stunnel)
> -
> -can_network(stunnel_t)
> -
> -type stunnel_etc_t, file_type, sysadmfile;
> -
> -allow stunnel_t self:capability { setgid setuid sys_chroot };
> -allow stunnel_t self:fifo_file { read write };
> -allow stunnel_t self:tcp_socket { read write };
> -allow stunnel_t self:unix_stream_socket { connect create };

please put this in a distro or a inetd ifdef.
stunnel is in no way dependent on inetd, and gentoo has dropped inetd support (so we don't even have that macro you're using).

thanks,
peter

-- 
petre rodan
<kaiowas@gentoo.org>
Developer,
Hardened Gentoo Linux

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]