Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Laurent Bigonville <bigon@debian.org>
To:     selinux-refpolicy@vger.kernel.org
Subject: [RFC 1/3] Add an interface to allow the specified domain to mmap the general network configuration files
Date:   Fri, 13 Dec 2019 14:20:14 +0100
Message-Id: <20191213132016.308556-2-bigon@debian.org>
In-Reply-To: <20191213132016.308556-1-bigon@debian.org>
References: <20191213132016.308556-1-bigon@debian.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

From: Laurent Bigonville <bigon@bigon.be>

Signed-off-by: Laurent Bigonville <bigon@bigon.be>
---
 policy/modules/system/sysnetwork.if | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if
index 77eab21e..1f785c7c 100644
--- a/policy/modules/system/sysnetwork.if
+++ b/policy/modules/system/sysnetwork.if
@@ -364,6 +364,31 @@ interface(`sysnet_read_config',`
 	')
 ')
 
+#######################################
+## <summary>
+##     Map network config files.
+## </summary>
+## <desc>
+##     <p>
+##     Allow the specified domain to mmap the
+##     general network configuration files.
+##     </p>
+## </desc>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`sysnet_map_config',`
+	gen_require(`
+		type net_conf_t;
+	')
+
+	files_search_etc($1)
+	allow $1 net_conf_t:file map;
+')
+
 #######################################
 ## <summary>
 ##	Do not audit attempts to read network config files.
-- 
2.24.0