[refpolicy] [PATCH] Only label administrative postgres commands as postgresql_exec_t

[dwalsh@redhat.com (Daniel J Walsh)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/18/2013 11:46 AM, Luis Ressel wrote:
> On Mon, 18 Nov 2013 09:09:49 -0500 Daniel J Walsh <dwalsh@redhat.com>
> wrote:
> 
>> I hate adding ifdef code to fc files, it is usually just clutter.  If I
>> have an init script named /etc/init\.d/postgresql-.*	 I would figure all
>> distributions would want this labeled this way.
>> 
>> If this labeling makes sense for other distributions, then we should 
>> remove the ifdef.
>> 
>> Also bin_t should never be listed in an fc file other then 
>> corecommands.fc
> 
> Sorry, the ifdefs were there in the original gentoo patch, but it makes 
> sense to me to drop them. But how else should I label these files, if not
> bin_t? Yet another separate type like "postgresql_user_exec_t"?
> 
> 
> Regards, Luis Ressel
> 
I believe by default then should be bin_t unless they match someother regex.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlKKc4kACgkQrlYvE4MpobOUCACeJZNXl6Ln8FoXSp845tdpMCF2
1IwAoKQXRD0iZ4gyesvoQrTqdIu7/as2
=8Kgl
-----END PGP SIGNATURE-----