Re: ricci changes in policy

[Daniel J Walsh <dwalsh@redhat.com>]

Christopher J. PeBenito wrote:
> On Mon, 2007-02-26 at 12:38 -0500, dwalsh@localhost.localdomain wrote:
>   
>> ricci modstorage needs to be able to configure lvm and work with ccs
>>     
>
> Merged except for one bit:
>
>   
>> ===File /tmp/patches/done/nsaserefpolicy_policy_modules_services_ricci.patch===
>> --- nsaserefpolicy/policy/modules/services/ricci.te	2007-02-19 11:32:53.000000000 -0500
>> +++ serefpolicy-2.5.5/policy/modules/services/ricci.te	2007-02-26 11:02:34.000000000 -0500
>> @@ -448,7 +449,7 @@
>>  # ricci_modstorage local policy
>>  #
>>  
>> -allow ricci_modstorage_t self:process { setsched signal };
>> +allow ricci_modstorage_t self:process { setsched signal ptrace };
>>  allow ricci_modstorage_t self:capability { mknod sys_nice };
>>  allow ricci_modstorage_t self:fifo_file rw_fifo_file_perms;
>>  allow ricci_modstorage_t self:unix_dgram_socket create_socket_perms;
>>     
>
> Sure this shouldn't be dontaudited instead?
>
>   

We can try.  I find in some cases it is required, if the confined domain 
actually wants to read a value.  For example, hal currently reads an 
environment variable and requires ptrace.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.