From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Wed, 20 Jul 2011 19:43:13 +0200 Subject: [refpolicy] [PATCH 2/3] Update entropyd_t with privileges needed for haveged support In-Reply-To: <20110720173341.GA20050@siphos.be> References: <20110720173341.GA20050@siphos.be> Message-ID: <20110720174313.GC20050@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Haveged by itself requires a few additional privileges (create a unix socket and write access to some proc/sys/kernel files (like /proc/sys/kernel/random/write_wakeup_threshold). Signed-off-by: Sven Vermeulen --- policy/modules/services/audioentropy.te | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/policy/modules/services/audioentropy.te b/policy/modules/services/audioentropy.te index 08c1d8c..b224ebf 100644 --- a/policy/modules/services/audioentropy.te +++ b/policy/modules/services/audioentropy.te @@ -27,11 +27,12 @@ files_pid_file(entropyd_var_run_t) allow entropyd_t self:capability { dac_override ipc_lock sys_admin }; dontaudit entropyd_t self:capability sys_tty_config; allow entropyd_t self:process signal_perms; +allow entropyd_t self:unix_dgram_socket create_socket_perms; manage_files_pattern(entropyd_t, entropyd_var_run_t, entropyd_var_run_t) files_pid_filetrans(entropyd_t, entropyd_var_run_t, file) -kernel_read_kernel_sysctls(entropyd_t) +kernel_rw_kernel_sysctl(entropyd_t) kernel_list_proc(entropyd_t) kernel_read_proc_symlinks(entropyd_t) -- 1.7.3.4