ipsec patch

ipsec patch

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 359 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Allow ifconfig_t to write to files in /var/run/ipsec
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkibFwkACgkQrlYvE4MpobPsNwCeIGWI+PsOndYFq5pBpey14Lyx
2aAAoKADa/n/FNj15fs45vUgGSaTZJZQ
=Ur2n
-----END PGP SIGNATURE-----

[-- Attachment #2: system_ipsec.patch --]
[-- Type: text/plain, Size: 1768 bytes --]

--- nsaserefpolicy/policy/modules/system/ipsec.if	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.2/policy/modules/system/ipsec.if	2008-08-06 16:19:00.000000000 -0400
@@ -150,6 +150,26 @@
 	manage_files_pattern($1,ipsec_var_run_t,ipsec_var_run_t)
 ')
 
+
+########################################
+## <summary>
+##	write the ipsec_var_run_t files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`ipsec_write_pid',`
+	gen_require(`
+		type ipsec_var_run_t;
+	')
+
+	files_search_pids($1)
+	write_files_pattern($1, ipsec_var_run_t, ipsec_var_run_t)
+')
+
 ########################################
 ## <summary>
 ##	Execute racoon in the racoon domain.
--- nsaserefpolicy/policy/modules/system/ipsec.te	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.2/policy/modules/system/ipsec.te	2008-08-06 16:19:00.000000000 -0400
@@ -69,8 +69,8 @@
 read_files_pattern(ipsec_t,ipsec_key_file_t,ipsec_key_file_t)
 read_lnk_files_pattern(ipsec_t,ipsec_key_file_t,ipsec_key_file_t)
 
-allow ipsec_t ipsec_var_run_t:file manage_file_perms;
-allow ipsec_t ipsec_var_run_t:sock_file manage_sock_file_perms;
+manage_files_pattern(ipsec_t, ipsec_var_run_t,  ipsec_var_run_t)
+manage_sock_files_pattern(ipsec_t, ipsec_var_run_t,  ipsec_var_run_t)
 files_pid_filetrans(ipsec_t,ipsec_var_run_t,{ file sock_file })
 
 can_exec(ipsec_t, ipsec_mgmt_exec_t)
--- nsaserefpolicy/policy/modules/system/sysnetwork.te	2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.2/policy/modules/system/sysnetwork.te	2008-08-06 16:19:00.000000000 -0400
@@ -324,6 +337,10 @@
 ')
 
 optional_policy(`
+	ipsec_write_pid(ifconfig_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(ifconfig_t)
 ')
 

[-- Attachment #3: system_ipsec.patch.sig --]
[-- Type: application/octet-stream, Size: 72 bytes --]