From: guido@trentalancia.com (Guido Trentalancia)
Date: Mon, 24 Jan 2011 21:54:16 +0100
Subject: [refpolicy] [PATCH/RFC 15/19]: patch set to update the git
 reference policy
In-Reply-To: <4D3D8545.30607@gmail.com>
References: <1295829871.3862.74.camel@tesla.lan>  <4D3D8545.30607@gmail.com>
Message-ID: <1295902456.31686.17.camel@tesla.lan>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Mon, 24/01/2011 at 14.57 +0100, Dominick Grift wrote:
> On 01/24/2011 01:44 AM, Guido Trentalancia wrote:
> > diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/selinuxutil.te refpolicy-git-18012011-new/policy/modules/system/selinuxutil.te
> > --- refpolicy-git-18012011/policy/modules/system/selinuxutil.te	2011-01-17 19:36:10.814131755 +0100
> > +++ refpolicy-git-18012011-new/policy/modules/system/selinuxutil.te	2011-01-23 04:14:02.662963912 +0100
> > @@ -444,6 +444,7 @@ files_read_etc_files(semanage_t)
> >  files_read_etc_runtime_files(semanage_t)
> >  files_read_usr_files(semanage_t)
> >  files_list_pids(semanage_t)
> > +files_search_default(semanage_t)
> 
> There should not be any default_t directories. Thus this shouldnt be
> allowed.

This stems from the fact that at some point I came to a state where
while working from the terminal (as opposed to working from a graphical
terminal), semanage had trouble dealing with some temporary local
modules that I was working with for testing purposes (they were labelled
default_t)...

Of course it can be removed. So, in general default_t should never
appear anywhere in the policy ? Just for curiosity, what is the reason
behind that ? If it is allowed to carry out operations on usr and
etc_runtime files, why shouldn't it allowed to carry out operations on
default_t ?

Regards,

Guido