From: cgzones@googlemail.com (=?UTF-8?q?Christian=20G=C3=B6ttsche?=) Date: Fri, 9 Jun 2017 15:30:24 +0200 Subject: [refpolicy] [PATCH] netutils: update Message-ID: <20170609133024.7315-1-cgzones@googlemail.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com From: cgzones v2: - keep files_read_etc_files interfaces --- policy/modules/admin/netutils.fc | 1 + policy/modules/admin/netutils.te | 15 +++------------ 2 files changed, 4 insertions(+), 12 deletions(-) diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc index 4f77e1cc6..54c0793f7 100644 --- a/policy/modules/admin/netutils.fc +++ b/policy/modules/admin/netutils.fc @@ -3,6 +3,7 @@ /usr/bin/hping2 -- gen_context(system_u:object_r:ping_exec_t,s0) /usr/bin/iptstate -- gen_context(system_u:object_r:netutils_exec_t,s0) /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0) +/usr/bin/mtr -- gen_context(system_u:object_r:traceroute_exec_t,s0) /usr/bin/nmap -- gen_context(system_u:object_r:traceroute_exec_t,s0) /usr/bin/ping.* -- gen_context(system_u:object_r:ping_exec_t,s0) /usr/bin/send_arp -- gen_context(system_u:object_r:ping_exec_t,s0) diff --git a/policy/modules/admin/netutils.te b/policy/modules/admin/netutils.te index 4ea58479c..8f8f98042 100644 --- a/policy/modules/admin/netutils.te +++ b/policy/modules/admin/netutils.te @@ -49,7 +49,6 @@ manage_dirs_pattern(netutils_t, netutils_tmp_t, netutils_tmp_t) manage_files_pattern(netutils_t, netutils_tmp_t, netutils_tmp_t) files_tmp_filetrans(netutils_t, netutils_tmp_t, { file dir }) -kernel_search_proc(netutils_t) kernel_read_network_state(netutils_t) kernel_read_all_sysctls(netutils_t) @@ -86,9 +85,7 @@ logging_send_syslog_msg(netutils_t) miscfiles_read_localization(netutils_t) -term_dontaudit_use_console(netutils_t) -userdom_use_user_terminals(netutils_t) -userdom_use_all_users_fds(netutils_t) +userdom_use_inherited_user_terminals(netutils_t) optional_policy(` nis_use_ypbind(netutils_t) @@ -127,12 +124,9 @@ corenet_tcp_sendrecv_all_ports(ping_t) dev_read_urand(ping_t) -fs_dontaudit_getattr_xattr_fs(ping_t) - domain_use_interactive_fds(ping_t) files_read_etc_files(ping_t) -files_dontaudit_search_var(ping_t) kernel_read_system_state(ping_t) @@ -142,7 +136,7 @@ logging_send_syslog_msg(ping_t) miscfiles_read_localization(ping_t) -userdom_use_user_terminals(ping_t) +userdom_use_inherited_user_terminals(ping_t) ifdef(`hide_broken_symptoms',` init_dontaudit_use_fds(ping_t) @@ -197,12 +191,9 @@ corenet_tcp_connect_all_ports(traceroute_t) corenet_sendrecv_all_client_packets(traceroute_t) corenet_sendrecv_traceroute_server_packets(traceroute_t) -fs_dontaudit_getattr_xattr_fs(traceroute_t) - domain_use_interactive_fds(traceroute_t) files_read_etc_files(traceroute_t) -files_dontaudit_search_var(traceroute_t) init_use_fds(traceroute_t) @@ -212,7 +203,7 @@ logging_send_syslog_msg(traceroute_t) miscfiles_read_localization(traceroute_t) -userdom_use_user_terminals(traceroute_t) +userdom_use_inherited_user_terminals(traceroute_t) #rules needed for nmap dev_read_rand(traceroute_t) -- 2.11.0