dontaudit using firstboot fifo_file

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 78 bytes --]

firstboot starts certain daemons (ntp) which attempt to access its fifo_file


[-- Attachment #2: firstboot.patch --]
[-- Type: text/x-patch, Size: 977 bytes --]

--- nsaserefpolicy/policy/modules/admin/firstboot.if	2007-01-02 12:57:51.000000000 -0500
+++ serefpolicy-2.5.10/policy/modules/admin/firstboot.if	2007-03-22 15:06:58.000000000 -0400
@@ -124,3 +124,21 @@
 
 	allow $1 firstboot_t:fifo_file { read write };
 ')
+
+########################################
+## <summary>
+##	dontaudit Read and Write to a firstboot unnamed pipe.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`firstboot_dontaudit_rw_pipes',`
+	gen_require(`
+		type firstboot_t;
+	')
+
+	dontaudit $1 firstboot_t:fifo_file { read write };
+')
--- nsaserefpolicy/policy/modules/services/ntp.te	2007-03-20 23:38:08.000000000 -0400
+++ serefpolicy-2.5.10/policy/modules/services/ntp.te	2007-03-22 15:06:59.000000000 -0400
@@ -131,6 +131,7 @@
 
 optional_policy(`
 	firstboot_dontaudit_use_fds(ntpd_t)
+	firstboot_dontaudit_rw_pipes(ntpd_t)
 ')
 
 optional_policy(`