[refpolicy] [PATCH 19/20] udev: This is specific to debian i think. Some how the /usr/lib/avahi/avahi-daemon-check-dns\.sh ends up in the udev_t domain

[refpolicy] [PATCH 19/20] udev: This is specific to debian i think. Some how the /usr/lib/avahi/avahi-daemon-check-dns\.sh ends up in the udev_t domain

[Dominick Grift]

The script basically does what the name suggests, and additionally it
need to be able to stop and start avahi-daemon via its init script

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
---
 policy/modules/system/udev.te | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index d8b9856..6a5e1e2 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -177,6 +177,16 @@ sysnet_etc_filetrans_config(udev_t)
 
 userdom_dontaudit_search_user_home_content(udev_t)
 
+ifdef(`distro_debian',`
+	optional_policy(`
+		kernel_read_vm_sysctls(udev_t)
+		corenet_udp_bind_generic_node(udev_t)
+		miscfiles_read_generic_certs(udev_t)
+		avahi_initrc_domtrans(udev_t)
+		avahi_manage_pid_files(udev_t)
+	')
+')
+
 ifdef(`distro_gentoo',`
 	# during boot, init scripts use /dev/.rcsysinit
 	# existance to determine if we are in early booting
-- 
1.8.3.1

[refpolicy] [PATCH 19/20] udev: This is specific to debian i think. Some how the /usr/lib/avahi/avahi-daemon-check-dns\.sh ends up in the udev_t domain

[Christopher J. PeBenito]

On Tue 24 Sep 2013 09:40:29 AM EDT, Dominick Grift wrote:
> The script basically does what the name suggests, and additionally it
> need to be able to stop and start avahi-daemon via its init script
>
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> ---
>  policy/modules/system/udev.te | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
> index d8b9856..6a5e1e2 100644
> --- a/policy/modules/system/udev.te
> +++ b/policy/modules/system/udev.te
> @@ -177,6 +177,16 @@ sysnet_etc_filetrans_config(udev_t)
>
>  userdom_dontaudit_search_user_home_content(udev_t)
>
> +ifdef(`distro_debian',`
> +	optional_policy(`
> +		kernel_read_vm_sysctls(udev_t)
> +		corenet_udp_bind_generic_node(udev_t)
> +		miscfiles_read_generic_certs(udev_t)
> +		avahi_initrc_domtrans(udev_t)
> +		avahi_manage_pid_files(udev_t)
> +	')
> +')
> +
>  ifdef(`distro_gentoo',`
>  	# during boot, init scripts use /dev/.rcsysinit
>  	# existance to determine if we are in early booting

Merged.

--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com