* [refpolicy] [PATCH 1/1] Make setfiles be able to send audit messages.
@ 2011-08-22 1:18 rongqing.li at windriver.com
2011-08-22 16:52 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: rongqing.li at windriver.com @ 2011-08-22 1:18 UTC (permalink / raw)
To: refpolicy
From: Roy.Li <rongqing.li@windriver.com>
When audit subsystem is enabled, and setfiles works from root
dir, setfiles would send the AUDIT_FS_RELABEL information to
audit system, If no permission to send the information to audit
by netlink, setfiles would return error.
The test cases to reproduce this defect:
=> restorecon -R /
=> echo $?
255
=>
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
---
policy/modules/system/selinuxutil.te | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index e252935..aa080e9 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -557,6 +557,8 @@ init_use_script_fds(setfiles_t)
init_use_script_ptys(setfiles_t)
init_exec_script_files(setfiles_t)
+logging_send_audit_msgs(setfiles_t)
+
logging_send_syslog_msg(setfiles_t)
miscfiles_read_localization(setfiles_t)
--
1.6.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [refpolicy] [PATCH 1/1] Make setfiles be able to send audit messages.
2011-08-22 1:18 [refpolicy] [PATCH 1/1] Make setfiles be able to send audit messages rongqing.li at windriver.com
@ 2011-08-22 16:52 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2011-08-22 16:52 UTC (permalink / raw)
To: refpolicy
On 08/21/11 21:18, rongqing.li at windriver.com wrote:
> From: Roy.Li <rongqing.li@windriver.com>
>
> When audit subsystem is enabled, and setfiles works from root
> dir, setfiles would send the AUDIT_FS_RELABEL information to
> audit system, If no permission to send the information to audit
> by netlink, setfiles would return error.
>
> The test cases to reproduce this defect:
> => restorecon -R /
> => echo $?
> 255
> =>
>
> Signed-off-by: Roy.Li <rongqing.li@windriver.com>
> ---
> policy/modules/system/selinuxutil.te | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
> index e252935..aa080e9 100644
> --- a/policy/modules/system/selinuxutil.te
> +++ b/policy/modules/system/selinuxutil.te
> @@ -557,6 +557,8 @@ init_use_script_fds(setfiles_t)
> init_use_script_ptys(setfiles_t)
> init_exec_script_files(setfiles_t)
>
> +logging_send_audit_msgs(setfiles_t)
> +
> logging_send_syslog_msg(setfiles_t)
>
> miscfiles_read_localization(setfiles_t)
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-08-22 16:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-08-22 1:18 [refpolicy] [PATCH 1/1] Make setfiles be able to send audit messages rongqing.li at windriver.com
2011-08-22 16:52 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.