* Latest bluetooth requires net_bind_service
@ 2007-02-20 17:34 Daniel J Walsh
2007-02-23 18:56 ` Christopher J. PeBenito
2007-02-26 16:20 ` Christopher J. PeBenito
0 siblings, 2 replies; 4+ messages in thread
From: Daniel J Walsh @ 2007-02-20 17:34 UTC (permalink / raw)
To: Christopher J. PeBenito, SE Linux
[-- Attachment #1: Type: text/plain, Size: 20 bytes --]
Also search inotify
[-- Attachment #2: nsaserefpolicy_policy_modules_services_bluetooth.patch --]
[-- Type: text/x-patch, Size: 798 bytes --]
--- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-01-02 12:57:43.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/services/bluetooth.te 2007-02-19 16:01:52.000000000 -0500
@@ -41,7 +41,7 @@
# Bluetooth services local policy
#
-allow bluetooth_t self:capability { net_admin net_raw sys_tty_config ipc_lock };
+allow bluetooth_t self:capability { net_bind_service net_admin net_raw sys_tty_config ipc_lock };
dontaudit bluetooth_t self:capability sys_tty_config;
allow bluetooth_t self:process { getsched signal_perms };
allow bluetooth_t self:fifo_file rw_fifo_file_perms;
@@ -98,6 +98,7 @@
fs_getattr_all_fs(bluetooth_t)
fs_search_auto_mountpoints(bluetooth_t)
+fs_search_inotifyfs(bluetooth_t)
term_dontaudit_use_console(bluetooth_t)
#Handle bluetooth serial devices
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: Latest bluetooth requires net_bind_service
2007-02-20 17:34 Latest bluetooth requires net_bind_service Daniel J Walsh
@ 2007-02-23 18:56 ` Christopher J. PeBenito
2007-02-23 21:47 ` Daniel J Walsh
2007-02-26 16:20 ` Christopher J. PeBenito
1 sibling, 1 reply; 4+ messages in thread
From: Christopher J. PeBenito @ 2007-02-23 18:56 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Tue, 2007-02-20 at 12:34 -0500, Daniel J Walsh wrote:
> Also search inotify
I don't see any corenet tcp or udp binding rules, so the capability
seems out of place.
> --- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-01-02
> 12:57:43.000000000 -0500
> +++
> serefpolicy-2.5.4/policy/modules/services/bluetooth.te 2007-02-19
> 16:01:52.000000000 -0500
> @@ -41,7 +41,7 @@
> # Bluetooth services local policy
> #
>
> -allow bluetooth_t self:capability { net_admin net_raw sys_tty_config
> ipc_lock };
> +allow bluetooth_t self:capability { net_bind_service net_admin
> net_raw sys_tty_config ipc_lock };
> dontaudit bluetooth_t self:capability sys_tty_config;
> allow bluetooth_t self:process { getsched signal_perms };
> allow bluetooth_t self:fifo_file rw_fifo_file_perms;
> @@ -98,6 +98,7 @@
>
> fs_getattr_all_fs(bluetooth_t)
> fs_search_auto_mountpoints(bluetooth_t)
> +fs_search_inotifyfs(bluetooth_t)
>
> term_dontaudit_use_console(bluetooth_t)
> #Handle bluetooth serial devices
>
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: Latest bluetooth requires net_bind_service
2007-02-23 18:56 ` Christopher J. PeBenito
@ 2007-02-23 21:47 ` Daniel J Walsh
0 siblings, 0 replies; 4+ messages in thread
From: Daniel J Walsh @ 2007-02-23 21:47 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: SE Linux
Christopher J. PeBenito wrote:
> On Tue, 2007-02-20 at 12:34 -0500, Daniel J Walsh wrote:
>
>> Also search inotify
>>
>
> I don't see any corenet tcp or udp binding rules, so the capability
> seems out of place.
>
This was a kernel change. It has nothing to do with UDP/TCP networking,
but net_bind_service is now required for hidd to listen.
>
>> --- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-01-02
>> 12:57:43.000000000 -0500
>> +++
>> serefpolicy-2.5.4/policy/modules/services/bluetooth.te 2007-02-19
>> 16:01:52.000000000 -0500
>> @@ -41,7 +41,7 @@
>> # Bluetooth services local policy
>> #
>>
>> -allow bluetooth_t self:capability { net_admin net_raw sys_tty_config
>> ipc_lock };
>> +allow bluetooth_t self:capability { net_bind_service net_admin
>> net_raw sys_tty_config ipc_lock };
>> dontaudit bluetooth_t self:capability sys_tty_config;
>> allow bluetooth_t self:process { getsched signal_perms };
>> allow bluetooth_t self:fifo_file rw_fifo_file_perms;
>> @@ -98,6 +98,7 @@
>>
>> fs_getattr_all_fs(bluetooth_t)
>> fs_search_auto_mountpoints(bluetooth_t)
>> +fs_search_inotifyfs(bluetooth_t)
>>
>> term_dontaudit_use_console(bluetooth_t)
>> #Handle bluetooth serial devices
>>
>>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Latest bluetooth requires net_bind_service
2007-02-20 17:34 Latest bluetooth requires net_bind_service Daniel J Walsh
2007-02-23 18:56 ` Christopher J. PeBenito
@ 2007-02-26 16:20 ` Christopher J. PeBenito
1 sibling, 0 replies; 4+ messages in thread
From: Christopher J. PeBenito @ 2007-02-26 16:20 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Tue, 2007-02-20 at 12:34 -0500, Daniel J Walsh wrote:
> Also search inotify
Merged
> --- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-01-02 12:57:43.000000000 -0500
> +++ serefpolicy-2.5.4/policy/modules/services/bluetooth.te 2007-02-19 16:01:52.000000000 -0500
> @@ -41,7 +41,7 @@
> # Bluetooth services local policy
> #
>
> -allow bluetooth_t self:capability { net_admin net_raw sys_tty_config ipc_lock };
> +allow bluetooth_t self:capability { net_bind_service net_admin net_raw sys_tty_config ipc_lock };
> dontaudit bluetooth_t self:capability sys_tty_config;
> allow bluetooth_t self:process { getsched signal_perms };
> allow bluetooth_t self:fifo_file rw_fifo_file_perms;
> @@ -98,6 +98,7 @@
>
> fs_getattr_all_fs(bluetooth_t)
> fs_search_auto_mountpoints(bluetooth_t)
> +fs_search_inotifyfs(bluetooth_t)
>
> term_dontaudit_use_console(bluetooth_t)
> #Handle bluetooth serial devices
>
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-02-26 16:18 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-02-20 17:34 Latest bluetooth requires net_bind_service Daniel J Walsh
2007-02-23 18:56 ` Christopher J. PeBenito
2007-02-23 21:47 ` Daniel J Walsh
2007-02-26 16:20 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.