* [refpolicy] [PATCH v2 1/1] Allow search within postgresql var directory for the stream connect interface
@ 2012-10-06 16:10 Sven Vermeulen
2012-10-09 14:21 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Sven Vermeulen @ 2012-10-06 16:10 UTC (permalink / raw)
To: refpolicy
Domains that are granted postgresql_stream_connect() need to be able to search
through the postgresql_var_run_t directory (in which the socket is located).
Update the interface to use the stream_connect_pattern definition to simplify
the interface and make it more readable.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
policy/modules/services/postgresql.if | 7 +++----
1 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
index ecef19f..9d2f311 100644
--- a/policy/modules/services/postgresql.if
+++ b/policy/modules/services/postgresql.if
@@ -428,11 +428,10 @@ interface(`postgresql_stream_connect',`
type postgresql_t, postgresql_var_run_t, postgresql_tmp_t;
')
+ stream_connect_pattern($1, { postgresql_var_run_t postgresql_tmp_t }, { postgresql_var_run_t postgresql_tmp_t }, postgresql_t)
+
files_search_pids($1)
- allow $1 postgresql_t:unix_stream_socket connectto;
- allow $1 postgresql_var_run_t:sock_file write;
- # Some versions of postgresql put the sock file in /tmp
- allow $1 postgresql_tmp_t:sock_file write;
+ files_search_tmp($1)
')
########################################
--
1.7.8.6
^ permalink raw reply related [flat|nested] 2+ messages in thread* [refpolicy] [PATCH v2 1/1] Allow search within postgresql var directory for the stream connect interface
2012-10-06 16:10 [refpolicy] [PATCH v2 1/1] Allow search within postgresql var directory for the stream connect interface Sven Vermeulen
@ 2012-10-09 14:21 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2012-10-09 14:21 UTC (permalink / raw)
To: refpolicy
On 10/06/12 12:10, Sven Vermeulen wrote:
> Domains that are granted postgresql_stream_connect() need to be able to search
> through the postgresql_var_run_t directory (in which the socket is located).
>
> Update the interface to use the stream_connect_pattern definition to simplify
> the interface and make it more readable.
>
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
> policy/modules/services/postgresql.if | 7 +++----
> 1 files changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
> index ecef19f..9d2f311 100644
> --- a/policy/modules/services/postgresql.if
> +++ b/policy/modules/services/postgresql.if
> @@ -428,11 +428,10 @@ interface(`postgresql_stream_connect',`
> type postgresql_t, postgresql_var_run_t, postgresql_tmp_t;
> ')
>
> + stream_connect_pattern($1, { postgresql_var_run_t postgresql_tmp_t }, { postgresql_var_run_t postgresql_tmp_t }, postgresql_t)
> +
> files_search_pids($1)
> - allow $1 postgresql_t:unix_stream_socket connectto;
> - allow $1 postgresql_var_run_t:sock_file write;
> - # Some versions of postgresql put the sock file in /tmp
> - allow $1 postgresql_tmp_t:sock_file write;
> + files_search_tmp($1)
> ')
>
> ########################################
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-10-09 14:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-10-06 16:10 [refpolicy] [PATCH v2 1/1] Allow search within postgresql var directory for the stream connect interface Sven Vermeulen
2012-10-09 14:21 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.