PERFORCE change 24372 for review

[Brian Feldman]

http://perforce.freebsd.org/chv.cgi?CH=24372

Change 24372 by green at green_laptop_2 on 2003/01/29 05:30:27

	Since /home is frequently a link to /usr/home, login(1) needs
	permission to read home directory types of link files as well.

Affected files ...

.. //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/login.te#2 edit

Differences ...

==== //depot/projects/trustedbsd/sebsd/contrib/sebsd/policy/domains/program/login.te#2 (text+ko) ====

@@ -33,11 +33,13 @@
 
 # Run shells in user_t by default.
 domain_auto_trans(local_login_t, shell_exec_t, user_t)
+allow local_login_t user_home_t:lnk_file read;
 allow local_login_t user_home_t:dir r_dir_perms;
 allow local_login_t user_home_t:file r_file_perms;
 
 # Allow shells to be created in sysadm_t as well.
 domain_trans(local_login_t, shell_exec_t, sysadm_t)
+allow local_login_t sysadm_home_t:lnk_file read;
 allow local_login_t sysadm_home_t:dir r_dir_perms;
 allow local_login_t sysadm_home_t:file r_file_perms;
 
@@ -113,6 +115,7 @@
 
 # Run shells in user_t by default.
 domain_auto_trans(remote_login_t, shell_exec_t, user_t)
+allow remote_login_t user_home_t:lnk_file read;
 allow remote_login_t user_home_t:dir r_dir_perms;
 allow remote_login_t user_home_t:file r_file_perms;
 
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message