Minor fixes to first boot policy

Minor fixes to first boot policy

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F10/admin_firstboot.patch

firstboot tends to leak file descritors and since it it thousands of
lines of code not likely to be fixed.  So dontaudit leaked descriptors
to unix_stream_socket

Move unconfined_domain to optional block.

- -files_etc_filetrans_etc_runtime(firstboot_t, { file dir })
We dont want to do this.  Firstboot should just edit etc files rather
then mislabeling them

Remove ancient cruft
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkikd5EACgkQrlYvE4MpobMTJgCg35zLOzqNGNL3Ca2MUxDlhHRl
ElwAoKwqvZIX5PmK9BXNe1hFepfMAsTK
=8DHt
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] Minor fixes to first boot policy

[Christopher J. PeBenito]

On Thu, 2008-08-14 at 14:21 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F10/admin_firstboot.patch
> 
> firstboot tends to leak file descritors and since it it thousands of
> lines of code not likely to be fixed.  So dontaudit leaked descriptors
> to unix_stream_socket
> 
> Move unconfined_domain to optional block.
> 
> - -files_etc_filetrans_etc_runtime(firstboot_t, { file dir })
> We dont want to do this.  Firstboot should just edit etc files rather
> then mislabeling them
> 
> Remove ancient cruft

I moved the stream socket part into its own interface and updated the
one caller.  I dropped the xserver part since that interface doesn't
exist.  The remainder is merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150