From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Mon, 29 Oct 2012 19:49:35 +0100 Subject: [refpolicy] [PATCH 2/4] Remove transition to ldconfig In-Reply-To: <1351536577-12839-1-git-send-email-sven.vermeulen@siphos.be> References: <1351536577-12839-1-git-send-email-sven.vermeulen@siphos.be> Message-ID: <1351536577-12839-3-git-send-email-sven.vermeulen@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Up until now, we had ldconfig_t as the only domain that the portage compile domains (like portage_sandbox_t) can transition towards. But this is not necessary, and even lead to a few hickups (like sandbox requiring ptrace towards the ldconfig domain). Remove the domain transition, and just execute ldconfig when needed. Everything remains within the sandbox domain. Signed-off-by: Sven Vermeulen --- portage.if | 4 +--- 1 files changed, 1 insertions(+), 3 deletions(-) diff --git a/portage.if b/portage.if index 1ae194e..67e8c12 100644 --- a/portage.if +++ b/portage.if @@ -177,9 +177,7 @@ interface(`portage_compile_domain',` libs_exec_lib_files($1) # some config scripts use ldd libs_exec_ld_so($1) - # this violates the idea of sandbox, but - # regular sandbox allows it - libs_domtrans_ldconfig($1) + libs_exec_ldconfig($1) logging_send_syslog_msg($1) -- 1.7.8.6