-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Allow ifconfig_t to write to files in /var/run/ipsec -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkibFwkACgkQrlYvE4MpobPsNwCeIGWI+PsOndYFq5pBpey14Lyx 2aAAoKADa/n/FNj15fs45vUgGSaTZJZQ =Ur2n -----END PGP SIGNATURE-----
--- nsaserefpolicy/policy/modules/system/ipsec.if 2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.2/policy/modules/system/ipsec.if 2008-08-06 16:19:00.000000000 -0400
@@ -150,6 +150,26 @@
manage_files_pattern($1,ipsec_var_run_t,ipsec_var_run_t)
')
+
+########################################
+## <summary>
+## write the ipsec_var_run_t files.
+## </summary>
+## <param name="domain">
+## <summary>
+## The type of the process performing this action.
+## </summary>
+## </param>
+#
+interface(`ipsec_write_pid',`
+ gen_require(`
+ type ipsec_var_run_t;
+ ')
+
+ files_search_pids($1)
+ write_files_pattern($1, ipsec_var_run_t, ipsec_var_run_t)
+')
+
########################################
## <summary>
## Execute racoon in the racoon domain.
--- nsaserefpolicy/policy/modules/system/ipsec.te 2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.2/policy/modules/system/ipsec.te 2008-08-06 16:19:00.000000000 -0400
@@ -69,8 +69,8 @@
read_files_pattern(ipsec_t,ipsec_key_file_t,ipsec_key_file_t)
read_lnk_files_pattern(ipsec_t,ipsec_key_file_t,ipsec_key_file_t)
-allow ipsec_t ipsec_var_run_t:file manage_file_perms;
-allow ipsec_t ipsec_var_run_t:sock_file manage_sock_file_perms;
+manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
+manage_sock_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
files_pid_filetrans(ipsec_t,ipsec_var_run_t,{ file sock_file })
can_exec(ipsec_t, ipsec_mgmt_exec_t)
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.5.2/policy/modules/system/sysnetwork.te 2008-08-06 16:19:00.000000000 -0400
@@ -324,6 +337,10 @@
')
optional_policy(`
+ ipsec_write_pid(ifconfig_t)
+')
+
+optional_policy(`
nis_use_ypbind(ifconfig_t)
')
Attachment:
system_ipsec.patch.sig
Description: Binary data
