From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Thu, 7 Aug 2014 20:05:35 +0200 Subject: [refpolicy] [PATCH 2/5] Introduce interface to relabel from/to pidfile associated types In-Reply-To: <1407434738-11937-1-git-send-email-sven.vermeulen@siphos.be> References: <1407434738-11937-1-git-send-email-sven.vermeulen@siphos.be> Message-ID: <1407434738-11937-3-git-send-email-sven.vermeulen@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com This interface can be used by domains needing wide relabel privileges towards the *_var_run_t and var_run_t types. Signed-off-by: Jason Zaman Signed-off-by: Sven Vermeulen --- policy/modules/kernel/files.if | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index f2da032..fd56414 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -6304,6 +6304,28 @@ interface(`files_delete_all_pid_dirs',` delete_dirs_pattern($1, pidfile, pidfile) ') +######################################### +## +## Allow relabeling from and to any pidfile associated type +## +## +## +## Domain allowed access. +## +## +# +interface(`files_relabel_all_pids',` + gen_require(` + attribute pidfile; + ') + + allow $1 pidfile:dir list_dir_perms; + + relabel_dirs_pattern($1, pidfile, pidfile) + relabel_files_pattern($1, pidfile, pidfile) + relabel_lnk_files_pattern($1, pidfile, pidfile) +') + ######################################## ## ## Create, read, write and delete all -- 1.8.5.5