2016-12-06 22:49:02

by Mira Ressel

Subject: [refpolicy] [PATCH] kernel.if: Allow listing /proc/sys/net/unix

The kernel_read_unix_sysctls() and kernel_rw_unix_sysctls() currenly
don't allow listing the /proc/sys/net/unix directory, contrary to the
other sysctl interfaces.
---
policy/modules/kernel/kernel.if | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 0ca25406..f03a3241 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -1758,7 +1758,7 @@ interface(`kernel_read_unix_sysctls',`

read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)

- list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
+ list_dirs_pattern($1, { proc_t sysctl_t }, { sysctl_net_t sysctl_net_unix_t })
')

########################################
@@ -1780,7 +1780,7 @@ interface(`kernel_rw_unix_sysctls',`

rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)

- list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
+ list_dirs_pattern($1, { proc_t sysctl_t }, { sysctl_net_t sysctl_net_unix_t })
')

########################################
--
2.11.0

2016-12-07 01:27:06

by Chris PeBenito

Subject: [refpolicy] [PATCH] kernel.if: Allow listing /proc/sys/net/unix

On 12/06/16 17:49, Luis Ressel via refpolicy wrote:
> The kernel_read_unix_sysctls() and kernel_rw_unix_sysctls() currenly
> don't allow listing the /proc/sys/net/unix directory, contrary to the
> other sysctl interfaces.
> ---
> policy/modules/kernel/kernel.if | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
> index 0ca25406..f03a3241 100644
> --- a/policy/modules/kernel/kernel.if
> +++ b/policy/modules/kernel/kernel.if
> @@ -1758,7 +1758,7 @@ interface(`kernel_read_unix_sysctls',`
>
> read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)
>
> - list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
> + list_dirs_pattern($1, { proc_t sysctl_t }, { sysctl_net_t sysctl_net_unix_t })
> ')
>
> ########################################
> @@ -1780,7 +1780,7 @@ interface(`kernel_rw_unix_sysctls',`
>
> rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)
>
> - list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
> + list_dirs_pattern($1, { proc_t sysctl_t }, { sysctl_net_t sysctl_net_unix_t })
> ')
>
> ########################################


Merged.


--
Chris PeBenito