ipsec changes including a new interface which is used by the sysnetwork module... Index: refpolicy/policy/modules/system/ipsec.if =================================================================== --- refpolicy.orig/policy/modules/system/ipsec.if 2008-07-19 19:15:43.000000000 +0200 +++ refpolicy/policy/modules/system/ipsec.if 2008-08-03 21:32:40.000000000 +0200 @@ -150,6 +150,26 @@ manage_files_pattern($1,ipsec_var_run_t,ipsec_var_run_t) ') + +######################################## +## <summary> +## write the ipsec_var_run_t files. +## </summary> +## <param name="domain"> +## <summary> +## The type of the process performing this action. +## </summary> +## </param> +# +interface(`ipsec_write_pid',` + gen_require(` + type ipsec_var_run_t; + ') + + files_search_pids($1) + write_files_pattern($1,ipsec_var_run_t,ipsec_var_run_t) +') + ######################################## ## <summary> ## Execute racoon in the racoon domain. Index: refpolicy/policy/modules/system/ipsec.te =================================================================== --- refpolicy.orig/policy/modules/system/ipsec.te 2008-07-19 19:15:43.000000000 +0200 +++ refpolicy/policy/modules/system/ipsec.te 2008-08-03 21:33:27.000000000 +0200 @@ -69,8 +69,8 @@ read_files_pattern(ipsec_t,ipsec_key_file_t,ipsec_key_file_t) read_lnk_files_pattern(ipsec_t,ipsec_key_file_t,ipsec_key_file_t) -allow ipsec_t ipsec_var_run_t:file manage_file_perms; -allow ipsec_t ipsec_var_run_t:sock_file manage_sock_file_perms; +manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t) +manage_sock_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t) files_pid_filetrans(ipsec_t,ipsec_var_run_t,{ file sock_file }) can_exec(ipsec_t, ipsec_mgmt_exec_t) Index: refpolicy/policy/modules/system/sysnetwork.te =================================================================== --- refpolicy.orig/policy/modules/system/sysnetwork.te 2008-08-03 21:37:35.000000000 +0200 +++ refpolicy/policy/modules/system/sysnetwork.te 2008-08-03 21:38:27.000000000 +0200 @@ -332,6 +332,10 @@ ') optional_policy(` + ipsec_write_pid(ifconfig_t) +') + +optional_policy(` kernel_read_xen_state(ifconfig_t) kernel_write_xen_state(ifconfig_t) xen_append_log(ifconfig_t) -- David Härdeman -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.