w3c.te module policy

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 657 bytes --]

Ville has been trying to build a modular policy package for w3c.  He 
created te,fc,if files similar to the ones I have attached.  The problem 
is that when he compiles them he ends up with avc messages suggesting he 
needs these additional rules:

allow httpd_t httpd_w3c_script_exec_t:file { execute execute_no_trans 
getattr ioctl read };

I have duplicated this on my machine.

 From my reading of the generated policy these should already exist.  
Examining the tmp/w3c.tmp file it looks like they are there (except for 
the execute_no_trans).  They are wrapped in a boolean though.  Is there 
something wrong in policy modules handling of booleans?



[-- Attachment #2: w3c.te --]
[-- Type: text/plain, Size: 458 bytes --]

policy_module(w3c,1.2.1)

apache_content_template(w3c)

sysnet_dns_name_resolve(httpd_w3c_script_t)

# allow httpd_w3c_script_t to connect to a relay
corenet_tcp_connect_gopher_port(httpd_w3c_script_t)
corenet_tcp_connect_ftp_port(httpd_w3c_script_t)
corenet_tcp_connect_http_port(httpd_w3c_script_t)
corenet_tcp_connect_http_cache_port(httpd_w3c_script_t)

tunable_policy(`httpd_can_network_connect',`
	corenet_tcp_connect_all_ports(httpd_w3c_script_t)
')


[-- Attachment #3: w3c.fc --]
[-- Type: text/plain, Size: 185 bytes --]

/usr/share/w3c-markup-validator(/.*)?		gen_context(system_u:object_r:httpd_config_t,s0)
/usr/share/w3c-markup-validator/check		gen_context(system_u:object_r:httpd_w3c_script_exec_t,s0)

[-- Attachment #4: w3c.if --]
[-- Type: text/plain, Size: 0 bytes --]