On Mon, 2008-08-04 at 14:35 +0200, david@xxxxxxxxxxx wrote:
> plain text document attachment (policy_modules_system_ipsec.patch)
> ipsec changes including a new interface which is used by the sysnetwork
> module...
Merged.
> Index: refpolicy/policy/modules/system/ipsec.if
> ===================================================================
> --- refpolicy.orig/policy/modules/system/ipsec.if 2008-07-19 19:15:43.000000000 +0200
> +++ refpolicy/policy/modules/system/ipsec.if 2008-08-03 21:32:40.000000000 +0200
> @@ -150,6 +150,26 @@
> manage_files_pattern($1,ipsec_var_run_t,ipsec_var_run_t)
> ')
>
> +
> +########################################
> +## <summary>
> +## write the ipsec_var_run_t files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## The type of the process performing this action.
> +## </summary>
> +## </param>
> +#
> +interface(`ipsec_write_pid',`
> + gen_require(`
> + type ipsec_var_run_t;
> + ')
> +
> + files_search_pids($1)
> + write_files_pattern($1,ipsec_var_run_t,ipsec_var_run_t)
> +')
> +
> ########################################
> ## <summary>
> ## Execute racoon in the racoon domain.
> Index: refpolicy/policy/modules/system/ipsec.te
> ===================================================================
> --- refpolicy.orig/policy/modules/system/ipsec.te 2008-07-19 19:15:43.000000000 +0200
> +++ refpolicy/policy/modules/system/ipsec.te 2008-08-03 21:33:27.000000000 +0200
> @@ -69,8 +69,8 @@
> read_files_pattern(ipsec_t,ipsec_key_file_t,ipsec_key_file_t)
> read_lnk_files_pattern(ipsec_t,ipsec_key_file_t,ipsec_key_file_t)
>
> -allow ipsec_t ipsec_var_run_t:file manage_file_perms;
> -allow ipsec_t ipsec_var_run_t:sock_file manage_sock_file_perms;
> +manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
> +manage_sock_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
> files_pid_filetrans(ipsec_t,ipsec_var_run_t,{ file sock_file })
>
> can_exec(ipsec_t, ipsec_mgmt_exec_t)
> Index: refpolicy/policy/modules/system/sysnetwork.te
> ===================================================================
> --- refpolicy.orig/policy/modules/system/sysnetwork.te 2008-08-03 21:37:35.000000000 +0200
> +++ refpolicy/policy/modules/system/sysnetwork.te 2008-08-03 21:38:27.000000000 +0200
> @@ -332,6 +332,10 @@
> ')
>
> optional_policy(`
> + ipsec_write_pid(ifconfig_t)
> +')
> +
> +optional_policy(`
> kernel_read_xen_state(ifconfig_t)
> kernel_write_xen_state(ifconfig_t)
> xen_append_log(ifconfig_t)
>
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
