Re: [PATCH 1/1] refpolicy: allow portmap to create portmap_t type socket

[Pascal Ouyang <xin.ouyang@windriver.com>]

于 14-2-10 下午3:58, rongqing.li@windriver.com 写道:
> From: Roy Li <rongqing.li@windriver.com>
>
> Signed-off-by: Roy Li <rongqing.li@windriver.com>
> ---
>   .../portmap-allow-portmap-to-create-socket.patch   |   28 ++++++++++++++++++++
>   .../refpolicy/refpolicy_2.20130424.inc             |    1 +
>   2 files changed, 29 insertions(+)
>   create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
>
> diff --git a/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch b/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
> new file mode 100644
> index 0000000..aa89a98
> --- /dev/null
> +++ b/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
> @@ -0,0 +1,28 @@
> +portmap: allow portmap to manage portmap_t type socket
> +
> +Upstream-Status: Pending
> +
> +portmap needs to create socket to receive message
> +
> +Signed-off-by: Roy Li <rongqing.li@windriver.com>
> +---
> + policy/modules/contrib/portmap.te |    3 +++
> + 1 file changed, 3 insertions(+)
> +
> +diff --git a/policy/modules/contrib/portmap.te b/policy/modules/contrib/portmap.te
> +index 18b255e..bacf66b 100644
> +--- a/policy/modules/contrib/portmap.te
> ++++ b/policy/modules/contrib/portmap.te
> +@@ -16,6 +16,9 @@ type portmap_helper_exec_t;
> + init_system_domain(portmap_helper_t, portmap_helper_exec_t)
> + role portmap_helper_roles types portmap_helper_t;
> +
> ++allow portmap_t self:tcp_socket create_socket_perms;
> ++allow portmap_t self:udp_socket create_socket_perms;
> ++
> + type portmap_initrc_exec_t;
> + init_script_file(portmap_initrc_exec_t)
> +
> +--
> +1.7.10.4
> +
> diff --git a/recipes-security/refpolicy/refpolicy_2.20130424.inc b/recipes-security/refpolicy/refpolicy_2.20130424.inc
> index a052a2c..5d55030 100644
> --- a/recipes-security/refpolicy/refpolicy_2.20130424.inc
> +++ b/recipes-security/refpolicy/refpolicy_2.20130424.inc
> @@ -52,6 +52,7 @@ SRC_URI += "file://poky-policy-fix-xconsole_device_t-as-a-dev_node.patch \
>               file://poky-policy-fix-dmesg-to-use-dev-kmsg.patch \
>               file://hostname-do-not-audit-attempts-by-hostname-to-read-a.patch \
>               file://sysnetwork-dhcpc-binds-socket-to-random-high-udp-por.patch \
> +            file://portmap-allow-portmap-to-create-socket.patch \
>              "
>
>   # Backport from upstream
>

Ack.

These rules are in old versions, and droped in 12d4d8.
https://github.com/xinpascal/selinux-refpolicy-contrib/commit/12d4d86602452c9b6fd6f74fc47ce29d5ae55ba9
It is better if you have time to dig.

Any way, I agree to merge this.

Thanks, Roy. :)

-- 
- Pascal