2015-05-25 09:33:55

by Jason Zaman

Subject: [refpolicy] [PATCH 1/2] logging: use init_startstop_service in _admin interface

The logging_admin interfaces had rules for RedHat sysvinit. This
replaces them with the interface init_startstop_service which can
easily be changed for other init systems.
---
policy/modules/system/logging.if | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index a40714e..7fd0c41 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -1003,10 +1003,7 @@ interface(`logging_admin_audit',`

logging_run_auditctl($1, $2)

- init_labeled_script_domtrans($1, auditd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 auditd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_startstop_service($1, $2, auditd_t, auditd_initrc_exec_t)
')

########################################
@@ -1061,10 +1058,7 @@ interface(`logging_admin_syslog',`

logging_manage_all_logs($1)

- init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 syslogd_initrc_exec_t system_r;
- allow $2 system_r;
+ init_startstop_service($1, $2, syslogd_t, syslogd_initrc_exec_t)
')

########################################
--
2.3.6

2015-05-25 09:33:56

by Jason Zaman

Subject: [refpolicy] [PATCH 2/2] postgresql: use init_startstop_service in _admin interface

The postgresql_admin interfaces had rules for RedHat sysvinit. This
replaces them with the interface init_startstop_service which can
easily be changed for other init systems.
---
policy/modules/services/postgresql.if | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
index 9d2f311..60395e7 100644
--- a/policy/modules/services/postgresql.if
+++ b/policy/modules/services/postgresql.if
@@ -577,10 +577,7 @@ interface(`postgresql_admin',`
allow $1 postgresql_t:process { ptrace signal_perms };
ps_process_pattern($1, postgresql_t)

- init_labeled_script_domtrans($1, postgresql_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 postgresql_initrc_exec_t system_r;
- allow $2 system_r;
+ init_startstop_service($1, $2, postgresql_t, postgresql_initrc_exec_t)

admin_pattern($1, postgresql_var_run_t)

--
2.3.6

2015-05-27 18:51:09

by cpebenito

Subject: [refpolicy] [PATCH 1/2] logging: use init_startstop_service in _admin interface

On 5/25/2015 5:33 AM, Jason Zaman wrote:
> The logging_admin interfaces had rules for RedHat sysvinit. This
> replaces them with the interface init_startstop_service which can
> easily be changed for other init systems.

Merged.


> ---
> policy/modules/system/logging.if | 10 ++--------
> 1 file changed, 2 insertions(+), 8 deletions(-)
>
> diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
> index a40714e..7fd0c41 100644
> --- a/policy/modules/system/logging.if
> +++ b/policy/modules/system/logging.if
> @@ -1003,10 +1003,7 @@ interface(`logging_admin_audit',`
>
> logging_run_auditctl($1, $2)
>
> - init_labeled_script_domtrans($1, auditd_initrc_exec_t)
> - domain_system_change_exemption($1)
> - role_transition $2 auditd_initrc_exec_t system_r;
> - allow $2 system_r;
> + init_startstop_service($1, $2, auditd_t, auditd_initrc_exec_t)
> ')
>
> ########################################
> @@ -1061,10 +1058,7 @@ interface(`logging_admin_syslog',`
>
> logging_manage_all_logs($1)
>
> - init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
> - domain_system_change_exemption($1)
> - role_transition $2 syslogd_initrc_exec_t system_r;
> - allow $2 system_r;
> + init_startstop_service($1, $2, syslogd_t, syslogd_initrc_exec_t)
> ')
>
> ########################################
>


--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com

2015-05-27 18:51:21

by cpebenito

Subject: [refpolicy] [PATCH 2/2] postgresql: use init_startstop_service in _admin interface

On 5/25/2015 5:33 AM, Jason Zaman wrote:
> The postgresql_admin interfaces had rules for RedHat sysvinit. This
> replaces them with the interface init_startstop_service which can
> easily be changed for other init systems.

Merged.


> ---
> policy/modules/services/postgresql.if | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/policy/modules/services/postgresql.if b/policy/modules/services/postgresql.if
> index 9d2f311..60395e7 100644
> --- a/policy/modules/services/postgresql.if
> +++ b/policy/modules/services/postgresql.if
> @@ -577,10 +577,7 @@ interface(`postgresql_admin',`
> allow $1 postgresql_t:process { ptrace signal_perms };
> ps_process_pattern($1, postgresql_t)
>
> - init_labeled_script_domtrans($1, postgresql_initrc_exec_t)
> - domain_system_change_exemption($1)
> - role_transition $2 postgresql_initrc_exec_t system_r;
> - allow $2 system_r;
> + init_startstop_service($1, $2, postgresql_t, postgresql_initrc_exec_t)
>
> admin_pattern($1, postgresql_var_run_t)
>
>


--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com