PERFORCE change 24332 for review

[Brian Feldman]

http://perforce.freebsd.org/chv.cgi?CH=24332

Change 24332 by green at green_laptop_2 on 2003/01/28 09:17:34

	Add self:fd * to the various domains that need it so far.

Affected files ...

.. //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/cleanvar.te#2 edit
.. //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/ldconfig.te#2 edit
.. //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/ntpd.te#2 edit
.. //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/save-entropy.te#2 edit
.. //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/usbd.te#2 edit

Differences ...

==== //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/cleanvar.te#2 (text+ko) ====

@@ -12,6 +12,7 @@
 role system_r types cleanvar_t;
 
 domain_auto_trans(initrc_t, cleanvar_exec_t, cleanvar_t)
+allow cleanvar_t self:fd *;
 allow cleanvar_t { var_run_t var_spool_t }:dir { rw_dir_perms };
 # We really need /var/{run,spool}/*...
 allow cleanvar_t { pidfile var_spool_t }:file { getattr unlink };

==== //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/ldconfig.te#2 (text+ko) ====

@@ -16,6 +16,7 @@
 ifdef(`newrole.te', `allow ldconfig_t newrole_t:fd use;')
 
 uses_shlib(ldconfig_t)
+allow ldconfig_t self:fd *;
 
 file_type_auto_trans(ldconfig_t, var_run_t, ld_so_cache_t)
 file_type_auto_trans(ldconfig_t, lib_t, shlib_t)

==== //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/ntpd.te#2 (text+ko) ====

@@ -23,6 +23,7 @@
 allow ntpd_t { var_lib_ntp_t var_log_ntp_t var_run_ntp_t }:dir rw_dir_perms;
 allow ntpd_t { var_lib_ntp_t var_log_ntp_t var_run_ntp_t var_run_ntpd_t }:file create_file_perms;
 allow ntpd_t var_run_ntpd_t:file rw_file_perms;
+allow ntpd_t self:fd *;
 
 allow ntpd_t self:capability { sys_time net_bind_service ipc_lock };
 dontaudit ntpd_t self:capability fsetid;

==== //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/save-entropy.te#2 (text+ko) ====

@@ -24,3 +24,4 @@
 file_type_auto_trans(save_entropy_t, var_db_t, var_db_entropy_t)
 allow save_entropy_t var_db_entropy_t:dir rw_dir_perms;
 allow save_entropy_t var_db_entropy_t:file create_file_perms;
+allow save_entropy_t self:fd *;

==== //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/usbd.te#2 (text+ko) ====

@@ -15,6 +15,7 @@
 domain_auto_trans(initrc_t, usbd_exec_t, usbd_t)
 allow usbd_t etc_t:dir r_dir_perms;
 allow usbd_t etc_t:file r_file_perms;
+allow usbd_t self:fd *;
 
 uses_shlib(usbd_t)
 can_exec_any(usbd_t)
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message