2011-08-22 01:18:30

by rongqing.li

Subject: [refpolicy] [PATCH 1/1] Make setfiles be able to send audit messages.

From: Roy.Li <[email protected]>

When audit subsystem is enabled, and setfiles works from root
dir, setfiles would send the AUDIT_FS_RELABEL information to
audit system, If no permission to send the information to audit
by netlink, setfiles would return error.

The test cases to reproduce this defect:
=> restorecon -R /
=> echo $?
255
=>

Signed-off-by: Roy.Li <[email protected]>
---
policy/modules/system/selinuxutil.te | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index e252935..aa080e9 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -557,6 +557,8 @@ init_use_script_fds(setfiles_t)
init_use_script_ptys(setfiles_t)
init_exec_script_files(setfiles_t)

+logging_send_audit_msgs(setfiles_t)
+
logging_send_syslog_msg(setfiles_t)

miscfiles_read_localization(setfiles_t)
--
1.6.3.1

2011-08-22 16:52:38

by cpebenito

Subject: [refpolicy] [PATCH 1/1] Make setfiles be able to send audit messages.

On 08/21/11 21:18, rongqing.li at windriver.com wrote:
> From: Roy.Li <[email protected]>
>
> When audit subsystem is enabled, and setfiles works from root
> dir, setfiles would send the AUDIT_FS_RELABEL information to
> audit system, If no permission to send the information to audit
> by netlink, setfiles would return error.
>
> The test cases to reproduce this defect:
> => restorecon -R /
> => echo $?
> 255
> =>
>
> Signed-off-by: Roy.Li <[email protected]>
> ---
> policy/modules/system/selinuxutil.te | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
> index e252935..aa080e9 100644
> --- a/policy/modules/system/selinuxutil.te
> +++ b/policy/modules/system/selinuxutil.te
> @@ -557,6 +557,8 @@ init_use_script_fds(setfiles_t)
> init_use_script_ptys(setfiles_t)
> init_exec_script_files(setfiles_t)
>
> +logging_send_audit_msgs(setfiles_t)
> +
> logging_send_syslog_msg(setfiles_t)
>
> miscfiles_read_localization(setfiles_t)

Merged.


--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com