From: pebenito@ieee.org (Chris PeBenito)
Date: Tue, 12 Sep 2017 19:18:22 -0400
Subject: [refpolicy] [PATCH 2/2] mozilla: Add neccessary map permissions
In-Reply-To: <20170912220727.6828-2-aranea@aixah.de>
References: <20170912220727.6828-1-aranea@aixah.de>
	<20170912220727.6828-2-aranea@aixah.de>
Message-ID: <e6f66463-0acb-749c-e0c5-3f874a60676d@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 09/12/2017 06:07 PM, Luis Ressel via refpolicy wrote:
> The mozilla_home_t access is needed for sqlite (ff won't even start up
> without it), while the mozilla_tmp_t mapping appears to be related to
> the handling of addons.
> ---
>   mozilla.te | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/mozilla.te b/mozilla.te
> index 5cba449..68248f8 100644
> --- a/mozilla.te
> +++ b/mozilla.te
> @@ -88,7 +88,7 @@ allow mozilla_t mozilla_plugin_t:unix_stream_socket rw_socket_perms;
>   allow mozilla_t mozilla_plugin_t:fd use;
>   
>   allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:dir manage_dir_perms;
> -allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:file manage_file_perms;
> +allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:file { manage_file_perms map };
>   allow mozilla_t mozilla_home_t:lnk_file manage_lnk_file_perms;
>   userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".galeon")
>   userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".mozilla")
> @@ -100,6 +100,7 @@ filetrans_pattern(mozilla_t, mozilla_home_t, mozilla_plugin_home_t, dir, "plugin
>   manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
>   manage_lnk_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
>   manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
> +allow mozilla_t mozilla_tmp_t:file map;
>   files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir })
>   
>   manage_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)

Merged.

-- 
Chris PeBenito