From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Thu, 22 Mar 2012 21:08:59 +0100 Subject: [refpolicy] [PATCH 4/13] Adding dontaudits for portage domains In-Reply-To: <20120322200229.GA3387@siphos.be> References: <20120322200229.GA3387@siphos.be> Message-ID: <20120322200859.GE3387@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Signed-off-by: Sven Vermeulen --- portage.te | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/portage.te b/portage.te index 4735035..88eac51 100644 --- a/portage.te +++ b/portage.te @@ -146,6 +146,8 @@ optional_policy(` allow portage_t self:process { setfscreate setexec }; # - kill for mysql merging, at least allow portage_t self:capability { sys_nice kill setfcap }; +dontaudit portage_t self:capability { dac_read_search }; +dontaudit portage_t self:netlink_route_socket rw_netlink_socket_perms; # user post-sync scripts can_exec(portage_t, portage_conf_t) @@ -161,6 +163,7 @@ rsync_entry_domtrans(portage_t, portage_fetch_t) allow portage_fetch_t portage_t:fd use; allow portage_fetch_t portage_t:fifo_file rw_file_perms; allow portage_fetch_t portage_t:process sigchld; +dontaudit portage_fetch_t portage_devpts_t:chr_file { read write }; # transition to sandbox for compiling domain_trans(portage_t, portage_exec_t, portage_sandbox_t) @@ -169,10 +172,12 @@ allow portage_sandbox_t portage_t:fd use; allow portage_sandbox_t portage_t:fifo_file rw_file_perms; allow portage_sandbox_t portage_t:process sigchld; allow portage_sandbox_t self:process ptrace; +dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms; # run scripts out of the build directory can_exec(portage_t, portage_tmp_t) +kernel_dontaudit_request_load_module(portage_t) # merging baselayout will need this: kernel_write_proc_files(portage_t) @@ -288,6 +293,7 @@ files_search_var_lib(portage_fetch_t) files_dontaudit_search_pids(portage_fetch_t) logging_list_logs(portage_fetch_t) +logging_dontaudit_search_logs(portage_fetch_t) term_search_ptys(portage_fetch_t) -- 1.7.3.4