From: sven.vermeulen@siphos.be (Sven Vermeulen)
Date: Wed, 17 Oct 2012 14:46:44 +0200
Subject: [refpolicy] [PATCH] Changes to the kernel policy module
In-Reply-To: <1350476958-5883-1-git-send-email-dominick.grift@gmail.com>
References: <1350476958-5883-1-git-send-email-dominick.grift@gmail.com>
Message-ID: <CAPzO=Nzp_3ROx-VvxNDyHq5GBMtzbs=mA+_eRHsC8whJ3RcFEA@mail.gmail.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

For which socket is this? Why isn't the stream_connect_pattern needed here?
On Oct 17, 2012 2:29 PM, "Dominick Grift" <dominick.grift@gmail.com> wrote:

>
> Interface is needed by at least plymouth
>
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> diff --git a/policy/modules/kernel/kernel.if
> b/policy/modules/kernel/kernel.if
> index 4bf45cb..7cbf5d6 100644
> --- a/policy/modules/kernel/kernel.if
> +++ b/policy/modules/kernel/kernel.if
> @@ -565,6 +565,25 @@
>
>  ########################################
>  ## <summary>
> +##     Connect to kernel using a unix
> +##     domain stream socket.
> +## </summary>
> +## <param name="domain">
> +##     <summary>
> +##     Domain allowed access.
> +##     </summary>
> +## </param>
> +#
> +interface(`kernel_stream_connect',`
> +       gen_require(`
> +               type kernel_t;
> +       ')
> +
> +       allow $1 kernel_t:unix_stream_socket connectto;
> +')
> +
> +########################################
> +## <summary>
>  ##     Get information on all System V IPC objects.
>  ## </summary>
>  ## <param name="domain">
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20121017/76256525/attachment.html