* [refpolicy] [PATCH 1/1] Allow search within postgresql var directory for the stream connect interface
@ 2012-10-06 14:23 Sven Vermeulen
2012-10-09 14:20 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Sven Vermeulen @ 2012-10-06 14:23 UTC (permalink / raw)
To: refpolicy
Domains that are granted postgresql_stream_connect() need to be able to search
through the postgresql_var_run_t directory (in which the socket is located).
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
policy/modules/services/postgresql.if | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
index ecef19f..79ccc90 100644
--- a/policy/modules/services/postgresql.if
+++ b/policy/modules/services/postgresql.if
@@ -431,6 +431,7 @@ interface(`postgresql_stream_connect',`
files_search_pids($1)
allow $1 postgresql_t:unix_stream_socket connectto;
allow $1 postgresql_var_run_t:sock_file write;
+ allow $1 postgresql_var_run_t:dir search_dir_perms;
# Some versions of postgresql put the sock file in /tmp
allow $1 postgresql_tmp_t:sock_file write;
')
--
1.7.8.6
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [refpolicy] [PATCH 1/1] Allow search within postgresql var directory for the stream connect interface
2012-10-06 14:23 [refpolicy] [PATCH 1/1] Allow search within postgresql var directory for the stream connect interface Sven Vermeulen
@ 2012-10-09 14:20 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2012-10-09 14:20 UTC (permalink / raw)
To: refpolicy
On 10/06/12 10:23, Sven Vermeulen wrote:
> Domains that are granted postgresql_stream_connect() need to be able to search
> through the postgresql_var_run_t directory (in which the socket is located).
>
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
> policy/modules/services/postgresql.if | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
> index ecef19f..79ccc90 100644
> --- a/policy/modules/services/postgresql.if
> +++ b/policy/modules/services/postgresql.if
> @@ -431,6 +431,7 @@ interface(`postgresql_stream_connect',`
> files_search_pids($1)
> allow $1 postgresql_t:unix_stream_socket connectto;
> allow $1 postgresql_var_run_t:sock_file write;
> + allow $1 postgresql_var_run_t:dir search_dir_perms;
> # Some versions of postgresql put the sock file in /tmp
> allow $1 postgresql_tmp_t:sock_file write;
> ')
Looks like a good candidate to use stream_connect_pattern().
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-10-09 14:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-10-06 14:23 [refpolicy] [PATCH 1/1] Allow search within postgresql var directory for the stream connect interface Sven Vermeulen
2012-10-09 14:20 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.