Re: named policy patch

[Daniel J Walsh <dwalsh@redhat.com>]

Russell Coker wrote:

>The attached patch allows named to correctly start on FC4T2 with the strict 
>policy when unlimitedRC is commented.
>
>  
>
>------------------------------------------------------------------------
>
>diff -u old/named.fc new/named.fc
>--- old/named.fc	2005-04-12 23:24:32.000000000 +1000
>+++ new/named.fc	2005-04-12 23:24:23.000000000 +1000
>@@ -16,6 +16,7 @@
> /etc/rndc.*		--	system_u:object_r:named_conf_t
> /etc/rndc.key  		-- 	system_u:object_r:dnssec_t
> /usr/sbin/named      	--	system_u:object_r:named_exec_t
>+/usr/sbin/named-checkconf --	system_u:object_r:named_checkconf_exec_t
> /usr/sbin/r?ndc		--	system_u:object_r:ndc_exec_t
> /var/run/ndc		-s	system_u:object_r:named_var_run_t
> /var/run/bind(/.*)?		system_u:object_r:named_var_run_t
>diff -u old/named.te new/named.te
>--- old/named.te	2005-04-12 23:24:39.000000000 +1000
>+++ new/named.te	2005-04-12 23:24:45.000000000 +1000
>@@ -15,6 +15,9 @@
> daemon_domain(named, `, nscd_client_domain')
> tmp_domain(named)
> 
>+type named_checkconf_exec_t, file_type, exec_type, sysadmfile;
>+domain_auto_trans(initrc_t, named_checkconf_exec_t, named_t)
>+
> # For /var/run/ndc used in BIND 8
> file_type_auto_trans(named_t, var_run_t, named_var_run_t, sock_file)
> 
>  
>
Why not just label chckconf as named_exec_t?

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.