From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Sat, 3 Sep 2011 16:21:09 +0200 Subject: [refpolicy] [PATCHv2 4/8] Allow the sysadm domain to execute rc In-Reply-To: <20110903141833.GA25374@siphos.be> References: <20110903141833.GA25374@siphos.be> Message-ID: <20110903142109.GE25374@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com The /sbin/rc binary is used by the system administrator to manage runlevels (add/delete), check runlevel state, etc. all which do not require a transition to occur. Hence the /sbin/rc (now labeled rc_exec_t) is allowed to be executed without transitioning. Signed-off-by: Sven Vermeulen --- policy/modules/roles/sysadm.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index fcf7605..cf84f62 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -51,6 +51,10 @@ ifdef(`direct_sysadm_daemon',` ') ') +ifdef(`distro_gentoo',` + init_rc_exec(sysadm_t) +') + ifndef(`enable_mls',` logging_manage_audit_log(sysadm_t) logging_manage_audit_config(sysadm_t) -- 1.7.3.4