DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C3CB42081C
Subject: Re: [PATCH] Allow clamd to use sent file descriptor
To:     David Sugar <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <20181102190937.5450-1-dsugar@tresys.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <b9f7f085-e2ba-5153-0464-d2ee4ed9b9b7@ieee.org>
Date:   Fri, 9 Nov 2018 19:10:12 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <20181102190937.5450-1-dsugar@tresys.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 11/02/2018 03:10 PM, David Sugar wrote:
> This allows a process connecting to a local clamd server to send
> an open file descriptor for A/V scanning.  This still requires
> the file type to be readable by clamd.
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/services/clamav.if | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/policy/modules/services/clamav.if b/policy/modules/services/clamav.if
> index 2adb1230..7b6df49e 100644
> --- a/policy/modules/services/clamav.if
> +++ b/policy/modules/services/clamav.if
> @@ -35,6 +35,8 @@ interface(`clamav_stream_connect',`
>   		type clamd_t, clamd_var_run_t;
>   	')
>   
> +	allow clamd_t $1:fd use;
> +
>   	files_search_pids($1)
>   	stream_connect_pattern($1, clamd_var_run_t, clamd_var_run_t, clamd_t)
>   ')

Merged.

-- 
Chris PeBenito