* [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related
@ 2007-08-02 18:16 dwalsh
2007-08-02 19:50 ` reference policy mailing list (was [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related) Joshua Brindle
2007-09-05 17:47 ` [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related Christopher J. PeBenito
0 siblings, 2 replies; 3+ messages in thread
From: dwalsh @ 2007-08-02 18:16 UTC (permalink / raw)
To: cpebenito; +Cc: selinux
--- nsaserefpolicy/policy/modules/system/udev.te 2007-07-25 10:37:42.000000000 -0400
+++ serefpolicy-3.0.5/policy/modules/system/udev.te 2007-08-02 11:02:02.000000000 -0400
@@ -68,8 +68,9 @@
allow udev_t udev_tbl_t:file manage_file_perms;
dev_filetrans(udev_t,udev_tbl_t,file)
+manage_dirs_pattern(udev_t,udev_var_run_t,udev_var_run_t)
manage_files_pacttern(udev_t,udev_var_run_t,udev_var_run_t)
-files_pid_filetrans(udev_t,udev_var_run_t,file)
+files_pid_filetrans(udev_t,udev_var_run_t,{ file dir })
kernel_read_system_state(udev_t)
kernel_getattr_core_if(udev_t)
@@ -83,16 +84,23 @@
kernel_dgram_send(udev_t)
kernel_signal(udev_t)
+#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
+kernel_rw_net_sysctls(udev_t)
+kernel_read_network_state(udev_t)
+
corecmd_exec_all_executables(udev_t)
dev_rw_sysfs(udev_t)
dev_manage_all_dev_nodes(udev_t)
dev_rw_generic_files(udev_t)
dev_delete_generic_files(udev_t)
+dev_search_usbfs_dirs(udev_t)
+dev_relabel_all_dev_nodes(udev_t)
domain_read_all_domains_state(udev_t)
domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
+files_read_usr_files(udev_t)
files_read_etc_runtime_files(udev_t)
files_read_etc_files(udev_t)
files_exec_etc_files(udev_t)
@@ -142,9 +150,16 @@
seutil_read_file_contexts(udev_t)
seutil_domtrans_setfiles(udev_t)
+sysnet_read_dhcpc_pid(udev_t)
+sysnet_rw_dhcp_config(udev_t)
+sysnet_delete_dhcpc_pid(udev_t)
sysnet_domtrans_ifconfig(udev_t)
sysnet_domtrans_dhcpc(udev_t)
+sysnet_signal_dhcpc(udev_t)
+sysnet_etc_filetrans_config(udev_t)
+sysnet_manage_config(udev_t)
+userdom_use_sysadm_ttys(udev_t)
userdom_dontaudit_search_all_users_home_content(udev_t)
ifdef(`distro_gentoo',`
@@ -170,6 +185,10 @@
')
optional_policy(`
+ brctl_domtrans(udev_t)
+')
+
+optional_policy(`
consoletype_exec(udev_t)
')
@@ -178,6 +197,10 @@
')
optional_policy(`
+ fstools_domtrans(udev_t)
+')
+
+optional_policy(`
hal_dgram_send(udev_t)
')
@@ -188,5 +211,24 @@
')
optional_policy(`
+ openct_read_pid_files(udev_t)
+ openct_domtrans(udev_t)
+')
+
+optional_policy(`
+ pcscd_read_pub_files(udev_t)
+ pcscd_domtrans(udev_t)
+')
+
+optional_policy(`
+ xen_manage_log(udev_t)
+ kernel_write_xen_state(udev_t)
+ kernel_read_xen_state(udev_t)
+ xen_read_image_files(udev_t)
+')
+
+optional_policy(`
xserver_read_xdm_pid(udev_t)
')
+
+
--- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.0.5/policy/modules/system/brctl.fc 2007-08-02 11:02:02.000000000 -0400
@@ -0,0 +1,2 @@
+
+/usr/sbin/brctl -- gen_context(system_u:object_r:brctl_exec_t,s0)
--- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.0.5/policy/modules/system/brctl.if 2007-08-02 11:02:02.000000000 -0400
@@ -0,0 +1,25 @@
+
+## <summary>Utilities for configuring the linux ethernet bridge</summary>
+
+
+########################################
+## <summary>
+## Execute a domain transition to run brctl.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`brctl_domtrans',`
+ gen_require(`
+ type brctl_t, brctl_exec_t;
+ ')
+
+ domain_auto_trans($1,brctl_exec_t,brctl_t)
+
+ allow brctl_t $1:fd use;
+ allow brctl_t $1:fifo_file rw_file_perms;
+ allow brctl_t $1:process sigchld;
+')
--- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.0.5/policy/modules/system/brctl.te 2007-08-02 11:02:02.000000000 -0400
@@ -0,0 +1,50 @@
+policy_module(brctl,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type brctl_t;
+type brctl_exec_t;
+domain_type(brctl_t)
+init_daemon_domain(brctl_t, brctl_exec_t)
+
+########################################
+#
+# brctl local policy
+#
+
+allow brctl_t self:capability net_admin;
+
+allow brctl_t self:tcp_socket create_socket_perms;
+allow brctl_t self:unix_dgram_socket create_socket_perms;
+
+dev_rw_sysfs(brctl_t)
+
+# Init script handling
+domain_use_interactive_fds(brctl_t)
+
+kernel_load_module(brctl_t)
+kernel_read_network_state(brctl_t)
+kernel_read_sysctl(brctl_t)
+
+## internal communication is often done using fifo and unix sockets.
+allow brctl_t self:fifo_file rw_file_perms;
+allow brctl_t self:unix_stream_socket create_stream_socket_perms;
+
+files_read_etc_files(brctl_t)
+
+libs_use_ld_so(brctl_t)
+libs_use_shared_libs(brctl_t)
+
+miscfiles_read_localization(brctl_t)
+
+ifdef(`targeted_policy',`
+ term_dontaudit_use_unallocated_ttys(brctl_t)
+ term_dontaudit_use_generic_ptys(brctl_t)
+')
+
+optional_policy(`
+ xen_append_log(brctl_t)
+')
From: dwalsh@redhat.com
To: cpebenito@tresys.com
CC: selinux@tycho.nsa.gov
Subject: [PATCH] refpolicy: kernel_devices changes
--text follows this line--
--- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-06-15 14:54:30.000000000 -0400
+++ serefpolicy-3.0.5/policy/modules/kernel/devices.fc 2007-08-02 11:02:02.000000000 -0400
@@ -12,6 +12,7 @@
/dev/atibm -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/audio.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/beep -c gen_context(system_u:object_r:sound_device_t,s0)
+/dev/dmfm -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/dsp.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/efirtc -c gen_context(system_u:object_r:clock_device_t,s0)
/dev/em8300.* -c gen_context(system_u:object_r:v4l_device_t,s0)
@@ -19,6 +20,7 @@
/dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0)
/dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0)
/dev/full -c gen_context(system_u:object_r:null_device_t,s0)
+/dev/[0-9].* -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/fw.* -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/hpet -c gen_context(system_u:object_r:clock_device_t,s0)
@@ -53,7 +55,7 @@
/dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/random -c gen_context(system_u:object_r:random_device_t,s0)
/dev/raw1394.* -c gen_context(system_u:object_r:v4l_device_t,s0)
-/dev/(misc/)?rtc -c gen_context(system_u:object_r:clock_device_t,s0)
+/dev/(misc/)?rtc[0-9]* -c gen_context(system_u:object_r:clock_device_t,s0)
/dev/sequencer -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/sequencer2 -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/smpte.* -c gen_context(system_u:object_r:sound_device_t,s0)
@@ -64,7 +66,9 @@
/dev/sonypi -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/tlk[0-3] -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/urandom -c gen_context(system_u:object_r:urandom_device_t,s0)
+/dev/usbmon[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/usbdev.* -c gen_context(system_u:object_r:usb_device_t,s0)
+/dev/usb[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0)
ifdef(`distro_suse', `
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
@@ -127,3 +131,7 @@
/var/named/chroot/dev/random -c gen_context(system_u:object_r:random_device_t,s0)
/var/named/chroot/dev/zero -c gen_context(system_u:object_r:zero_device_t,s0)
')
+
+/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0)
+/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0)
+
--- nsaserefpolicy/policy/modules/kernel/devices.if 2007-06-15 14:54:30.000000000 -0400
+++ serefpolicy-3.0.5/policy/modules/kernel/devices.if 2007-08-02 11:02:02.000000000 -0400
@@ -2803,6 +2803,24 @@
########################################
## <summary>
+## Get the attributes of a directory in the usb filesystem.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dev_search_usbfs_dirs',`
+ gen_require(`
+ type usbfs_t;
+ ')
+
+ allow $1 usbfs_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
## Do not audit attempts to get the attributes
## of a directory in the usb filesystem.
## </summary>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: reference policy mailing list (was [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related)
2007-08-02 18:16 [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related dwalsh
@ 2007-08-02 19:50 ` Joshua Brindle
2007-09-05 17:47 ` [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related Christopher J. PeBenito
1 sibling, 0 replies; 3+ messages in thread
From: Joshua Brindle @ 2007-08-02 19:50 UTC (permalink / raw)
To: dwalsh; +Cc: cpebenito, selinux
dwalsh@redhat.com wrote:
This is just a friendly suggestion, would it be possible to have a
refpolicy list that is separate from the selinux list for refpolicy
updates? I only ask because refpolicy gets so many updates and is
possibly interesting to a different set of people than those interested
in SELinux development.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related
2007-08-02 18:16 [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related dwalsh
2007-08-02 19:50 ` reference policy mailing list (was [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related) Joshua Brindle
@ 2007-09-05 17:47 ` Christopher J. PeBenito
1 sibling, 0 replies; 3+ messages in thread
From: Christopher J. PeBenito @ 2007-09-05 17:47 UTC (permalink / raw)
To: dwalsh; +Cc: selinux
Merged. Moved brctl to admin layer.
On Thu, 2007-08-02 at 14:16 -0400, dwalsh@redhat.com wrote:
> --- nsaserefpolicy/policy/modules/system/udev.te 2007-07-25
> 10:37:42.000000000 -0400
> +++ serefpolicy-3.0.5/policy/modules/system/udev.te 2007-08-02
> 11:02:02.000000000 -0400
> @@ -68,8 +68,9 @@
> allow udev_t udev_tbl_t:file manage_file_perms;
> dev_filetrans(udev_t,udev_tbl_t,file)
>
> +manage_dirs_pattern(udev_t,udev_var_run_t,udev_var_run_t)
> manage_files_pacttern(udev_t,udev_var_run_t,udev_var_run_t)
> -files_pid_filetrans(udev_t,udev_var_run_t,file)
> +files_pid_filetrans(udev_t,udev_var_run_t,{ file dir })
>
> kernel_read_system_state(udev_t)
> kernel_getattr_core_if(udev_t)
> @@ -83,16 +84,23 @@
> kernel_dgram_send(udev_t)
> kernel_signal(udev_t)
>
> +#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
> +kernel_rw_net_sysctls(udev_t)
> +kernel_read_network_state(udev_t)
> +
> corecmd_exec_all_executables(udev_t)
>
> dev_rw_sysfs(udev_t)
> dev_manage_all_dev_nodes(udev_t)
> dev_rw_generic_files(udev_t)
> dev_delete_generic_files(udev_t)
> +dev_search_usbfs_dirs(udev_t)
> +dev_relabel_all_dev_nodes(udev_t)
>
> domain_read_all_domains_state(udev_t)
> domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
>
> +files_read_usr_files(udev_t)
> files_read_etc_runtime_files(udev_t)
> files_read_etc_files(udev_t)
> files_exec_etc_files(udev_t)
> @@ -142,9 +150,16 @@
> seutil_read_file_contexts(udev_t)
> seutil_domtrans_setfiles(udev_t)
>
> +sysnet_read_dhcpc_pid(udev_t)
> +sysnet_rw_dhcp_config(udev_t)
> +sysnet_delete_dhcpc_pid(udev_t)
> sysnet_domtrans_ifconfig(udev_t)
> sysnet_domtrans_dhcpc(udev_t)
> +sysnet_signal_dhcpc(udev_t)
> +sysnet_etc_filetrans_config(udev_t)
> +sysnet_manage_config(udev_t)
>
> +userdom_use_sysadm_ttys(udev_t)
> userdom_dontaudit_search_all_users_home_content(udev_t)
>
> ifdef(`distro_gentoo',`
> @@ -170,6 +185,10 @@
> ')
>
> optional_policy(`
> + brctl_domtrans(udev_t)
> +')
> +
> +optional_policy(`
> consoletype_exec(udev_t)
> ')
>
> @@ -178,6 +197,10 @@
> ')
>
> optional_policy(`
> + fstools_domtrans(udev_t)
> +')
> +
> +optional_policy(`
> hal_dgram_send(udev_t)
> ')
>
> @@ -188,5 +211,24 @@
> ')
>
> optional_policy(`
> + openct_read_pid_files(udev_t)
> + openct_domtrans(udev_t)
> +')
> +
> +optional_policy(`
> + pcscd_read_pub_files(udev_t)
> + pcscd_domtrans(udev_t)
> +')
> +
> +optional_policy(`
> + xen_manage_log(udev_t)
> + kernel_write_xen_state(udev_t)
> + kernel_read_xen_state(udev_t)
> + xen_read_image_files(udev_t)
> +')
> +
> +optional_policy(`
> xserver_read_xdm_pid(udev_t)
> ')
> +
> +
> --- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31
> 19:00:00.000000000 -0500
> +++ serefpolicy-3.0.5/policy/modules/system/brctl.fc 2007-08-02
> 11:02:02.000000000 -0400
> @@ -0,0 +1,2 @@
> +
> +/usr/sbin/brctl --
> gen_context(system_u:object_r:brctl_exec_t,s0)
> --- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31
> 19:00:00.000000000 -0500
> +++ serefpolicy-3.0.5/policy/modules/system/brctl.if 2007-08-02
> 11:02:02.000000000 -0400
> @@ -0,0 +1,25 @@
> +
> +## <summary>Utilities for configuring the linux ethernet
> bridge</summary>
> +
> +
> +########################################
> +## <summary>
> +## Execute a domain transition to run brctl.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed to transition.
> +## </summary>
> +## </param>
> +#
> +interface(`brctl_domtrans',`
> + gen_require(`
> + type brctl_t, brctl_exec_t;
> + ')
> +
> + domain_auto_trans($1,brctl_exec_t,brctl_t)
> +
> + allow brctl_t $1:fd use;
> + allow brctl_t $1:fifo_file rw_file_perms;
> + allow brctl_t $1:process sigchld;
> +')
> --- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31
> 19:00:00.000000000 -0500
> +++ serefpolicy-3.0.5/policy/modules/system/brctl.te 2007-08-02
> 11:02:02.000000000 -0400
> @@ -0,0 +1,50 @@
> +policy_module(brctl,1.0.0)
> +
> +########################################
> +#
> +# Declarations
> +#
> +
> +type brctl_t;
> +type brctl_exec_t;
> +domain_type(brctl_t)
> +init_daemon_domain(brctl_t, brctl_exec_t)
> +
> +########################################
> +#
> +# brctl local policy
> +#
> +
> +allow brctl_t self:capability net_admin;
> +
> +allow brctl_t self:tcp_socket create_socket_perms;
> +allow brctl_t self:unix_dgram_socket create_socket_perms;
> +
> +dev_rw_sysfs(brctl_t)
> +
> +# Init script handling
> +domain_use_interactive_fds(brctl_t)
> +
> +kernel_load_module(brctl_t)
> +kernel_read_network_state(brctl_t)
> +kernel_read_sysctl(brctl_t)
> +
> +## internal communication is often done using fifo and unix sockets.
> +allow brctl_t self:fifo_file rw_file_perms;
> +allow brctl_t self:unix_stream_socket create_stream_socket_perms;
> +
> +files_read_etc_files(brctl_t)
> +
> +libs_use_ld_so(brctl_t)
> +libs_use_shared_libs(brctl_t)
> +
> +miscfiles_read_localization(brctl_t)
> +
> +ifdef(`targeted_policy',`
> + term_dontaudit_use_unallocated_ttys(brctl_t)
> + term_dontaudit_use_generic_ptys(brctl_t)
> +')
> +
> +optional_policy(`
> + xen_append_log(brctl_t)
> +')
> From: dwalsh@redhat.com
> To: cpebenito@tresys.com
> CC: selinux@tycho.nsa.gov
> Subject: [PATCH] refpolicy: kernel_devices changes
> --text follows this line--
> --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-06-15
> 14:54:30.000000000 -0400
> +++ serefpolicy-3.0.5/policy/modules/kernel/devices.fc 2007-08-02
> 11:02:02.000000000 -0400
> @@ -12,6 +12,7 @@
> /dev/atibm -c
> gen_context(system_u:object_r:mouse_device_t,s0)
> /dev/audio.* -c
> gen_context(system_u:object_r:sound_device_t,s0)
> /dev/beep -c
> gen_context(system_u:object_r:sound_device_t,s0)
> +/dev/dmfm -c
> gen_context(system_u:object_r:sound_device_t,s0)
> /dev/dsp.* -c
> gen_context(system_u:object_r:sound_device_t,s0)
> /dev/efirtc -c
> gen_context(system_u:object_r:clock_device_t,s0)
> /dev/em8300.* -c
> gen_context(system_u:object_r:v4l_device_t,s0)
> @@ -19,6 +20,7 @@
> /dev/evtchn -c
> gen_context(system_u:object_r:xen_device_t,s0)
> /dev/fb[0-9]* -c
> gen_context(system_u:object_r:framebuf_device_t,s0)
> /dev/full -c
> gen_context(system_u:object_r:null_device_t,s0)
> +/dev/[0-9].* -c
> gen_context(system_u:object_r:usb_device_t,s0)
> /dev/fw.* -c
> gen_context(system_u:object_r:usb_device_t,s0)
> /dev/hiddev.* -c
> gen_context(system_u:object_r:usb_device_t,s0)
> /dev/hpet -c
> gen_context(system_u:object_r:clock_device_t,s0)
> @@ -53,7 +55,7 @@
> /dev/radio.* -c
> gen_context(system_u:object_r:v4l_device_t,s0)
> /dev/random -c
> gen_context(system_u:object_r:random_device_t,s0)
> /dev/raw1394.* -c
> gen_context(system_u:object_r:v4l_device_t,s0)
> -/dev/(misc/)?rtc -c
> gen_context(system_u:object_r:clock_device_t,s0)
> +/dev/(misc/)?rtc[0-9]* -c
> gen_context(system_u:object_r:clock_device_t,s0)
> /dev/sequencer -c
> gen_context(system_u:object_r:sound_device_t,s0)
> /dev/sequencer2 -c
> gen_context(system_u:object_r:sound_device_t,s0)
> /dev/smpte.* -c
> gen_context(system_u:object_r:sound_device_t,s0)
> @@ -64,7 +66,9 @@
> /dev/sonypi -c
> gen_context(system_u:object_r:v4l_device_t,s0)
> /dev/tlk[0-3] -c
> gen_context(system_u:object_r:v4l_device_t,s0)
> /dev/urandom -c
> gen_context(system_u:object_r:urandom_device_t,s0)
> +/dev/usbmon[0-9]+ -c
> gen_context(system_u:object_r:usb_device_t,s0)
> /dev/usbdev.* -c
> gen_context(system_u:object_r:usb_device_t,s0)
> +/dev/usb[0-9]+ -c
> gen_context(system_u:object_r:usb_device_t,s0)
> /dev/usblp.* -c
> gen_context(system_u:object_r:printer_device_t,s0)
> ifdef(`distro_suse', `
> /dev/usbscanner -c
> gen_context(system_u:object_r:scanner_device_t,s0)
> @@ -127,3 +131,7 @@
> /var/named/chroot/dev/random -c
> gen_context(system_u:object_r:random_device_t,s0)
> /var/named/chroot/dev/zero -c
> gen_context(system_u:object_r:zero_device_t,s0)
> ')
> +
> +/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0)
> +/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0)
> +
> --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-06-15
> 14:54:30.000000000 -0400
> +++ serefpolicy-3.0.5/policy/modules/kernel/devices.if 2007-08-02
> 11:02:02.000000000 -0400
> @@ -2803,6 +2803,24 @@
>
> ########################################
> ## <summary>
> +## Get the attributes of a directory in the usb filesystem.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`dev_search_usbfs_dirs',`
> + gen_require(`
> + type usbfs_t;
> + ')
> +
> + allow $1 usbfs_t:dir search_dir_perms;
> +')
> +
> +########################################
> +## <summary>
> ## Do not audit attempts to get the attributes
> ## of a directory in the usb filesystem.
> ## </summary>
>
>
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2007-09-05 17:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-08-02 18:16 [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related dwalsh
2007-08-02 19:50 ` reference policy mailing list (was [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related) Joshua Brindle
2007-09-05 17:47 ` [PATCH] refpolicy: system_udev changes including brctl policy. Mostly xen related Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.