2018-01-04 21:51:21

by Christian Göttsche

Subject: [refpolicy] [PATCH] init: add init_rw_inherited_stream_socket

---
policy/modules/system/init.if | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)

diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 622bcec57..326581ecc 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -889,6 +889,24 @@ interface(`init_dgram_send',`
allow $1 init_t:unix_stream_socket getattr;
')

+########################################
+## <summary>
+## Read and write to inherited init unix streams.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`init_rw_inherited_stream_socket',`
+ gen_require(`
+ type init_t;
+ ')
+
+ allow $1 init_t:unix_stream_socket { getattr read write ioctl };
+')
+
########################################
## <summary>
## Allow the specified domain to read/write to
--
2.15.1

2018-01-05 21:21:12

by Chris PeBenito

Subject: [refpolicy] [PATCH] init: add init_rw_inherited_stream_socket

On 01/04/2018 04:51 PM, Christian G?ttsche via refpolicy wrote:
> ---
> policy/modules/system/init.if | 18 ++++++++++++++++++
> 1 file changed, 18 insertions(+)
>
> diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
> index 622bcec57..326581ecc 100644
> --- a/policy/modules/system/init.if
> +++ b/policy/modules/system/init.if
> @@ -889,6 +889,24 @@ interface(`init_dgram_send',`
> allow $1 init_t:unix_stream_socket getattr;
> ')
>
> +########################################
> +## <summary>
> +## Read and write to inherited init unix streams.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`init_rw_inherited_stream_socket',`
> + gen_require(`
> + type init_t;
> + ')
> +
> + allow $1 init_t:unix_stream_socket { getattr read write ioctl };
> +')
> +
> ########################################
> ## <summary>
> ## Allow the specified domain to read/write to

Merged.

--
Chris PeBenito