2011-03-09 21:06:21

by sven.vermeulen

Subject: [refpolicy] [PATCH 02/15] Allow authdaemon to create unix_stream_sockets

The authdaemon needs the create_stream_socket_perms privs in order to be able to start up.

Signed-off-by: Sven Vermeulen <[email protected]>
---
policy/modules/services/courier.te | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/policy/modules/services/courier.te b/policy/modules/services/courier.te
index 2802dbb..55d64bc 100644
--- a/policy/modules/services/courier.te
+++ b/policy/modules/services/courier.te
@@ -37,7 +37,7 @@ typealias courier_sqwebmail_exec_t alias sqwebmail_cron_exec_t;
#

allow courier_authdaemon_t self:capability { setuid setgid sys_tty_config };
-allow courier_authdaemon_t self:unix_stream_socket connectto;
+allow courier_authdaemon_t self:unix_stream_socket { create_stream_socket_perms connectto };

can_exec(courier_authdaemon_t, courier_exec_t)

--
1.7.3.4

2011-03-22 12:51:03

by cpebenito

Subject: [refpolicy] [PATCH 02/15] Allow authdaemon to create unix_stream_sockets

On 03/09/11 16:06, Sven Vermeulen wrote:
> The authdaemon needs the create_stream_socket_perms privs in order to be able to start up.
>
> Signed-off-by: Sven Vermeulen <[email protected]>
> ---
> policy/modules/services/courier.te | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/policy/modules/services/courier.te b/policy/modules/services/courier.te
> index 2802dbb..55d64bc 100644
> --- a/policy/modules/services/courier.te
> +++ b/policy/modules/services/courier.te
> @@ -37,7 +37,7 @@ typealias courier_sqwebmail_exec_t alias sqwebmail_cron_exec_t;
> #
>
> allow courier_authdaemon_t self:capability { setuid setgid sys_tty_config };
> -allow courier_authdaemon_t self:unix_stream_socket connectto;
> +allow courier_authdaemon_t self:unix_stream_socket { create_stream_socket_perms connectto };
>
> can_exec(courier_authdaemon_t, courier_exec_t)

Merged.

--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com