From: gentoo+selinux@lerya.net (Vincent Brillault)
Date: Sat,  2 Aug 2014 20:35:34 +0200
Subject: [refpolicy] [PATCH 0/2] Give access to
	/proc/sys/vm/overcommit_memory to all domains
Message-ID: <1407004536-2301-1-git-send-email-gentoo+selinux@lerya.net>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

Dear all,

Since a "recent" change in glibc (https://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb583c0e585e83a01253299afed9ea9a11), a lot of different domains try to read /proc/sys/vm/overcommit_memory.
This generates a lot of AVC like the following:
allow * sysctl_vm_t:dir search;
allow * sysctl_vm_t:file { read open };

This access seems to be useless unless /proc/sys/vm/overcommit_memory contains '2', so the denials probably don't hurt, but I see no reason not to allow this access.
More details can be found on https://bugzilla.redhat.com/show_bug.cgi?id=872729
The first patch is directly taken from the fedora policy, I only rebased it (and added a comment)

Cheers,
Vincent Brillault