2012-10-06 14:23:30

by sven.vermeulen

Subject: [refpolicy] [PATCH 1/1] Allow search within postgresql var directory for the stream connect interface

Domains that are granted postgresql_stream_connect() need to be able to search
through the postgresql_var_run_t directory (in which the socket is located).

Signed-off-by: Sven Vermeulen <[email protected]>
---
policy/modules/services/postgresql.if | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
index ecef19f..79ccc90 100644
--- a/policy/modules/services/postgresql.if
+++ b/policy/modules/services/postgresql.if
@@ -431,6 +431,7 @@ interface(`postgresql_stream_connect',`
files_search_pids($1)
allow $1 postgresql_t:unix_stream_socket connectto;
allow $1 postgresql_var_run_t:sock_file write;
+ allow $1 postgresql_var_run_t:dir search_dir_perms;
# Some versions of postgresql put the sock file in /tmp
allow $1 postgresql_tmp_t:sock_file write;
')
--
1.7.8.6

2012-10-09 14:20:25

by cpebenito

Subject: [refpolicy] [PATCH 1/1] Allow search within postgresql var directory for the stream connect interface

On 10/06/12 10:23, Sven Vermeulen wrote:
> Domains that are granted postgresql_stream_connect() need to be able to search
> through the postgresql_var_run_t directory (in which the socket is located).
>
> Signed-off-by: Sven Vermeulen <[email protected]>
> ---
> policy/modules/services/postgresql.if | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
> index ecef19f..79ccc90 100644
> --- a/policy/modules/services/postgresql.if
> +++ b/policy/modules/services/postgresql.if
> @@ -431,6 +431,7 @@ interface(`postgresql_stream_connect',`
> files_search_pids($1)
> allow $1 postgresql_t:unix_stream_socket connectto;
> allow $1 postgresql_var_run_t:sock_file write;
> + allow $1 postgresql_var_run_t:dir search_dir_perms;
> # Some versions of postgresql put the sock file in /tmp
> allow $1 postgresql_tmp_t:sock_file write;
> ')

Looks like a good candidate to use stream_connect_pattern().

--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com