Skip to contentSkip to conversation

: patch to allow reading hal pid files from ifconfig_t

PATCH New Guido Trentalancia 4 participants 5 messages Feb 16, 2011 – Feb 28, 2011

lore
Share & tools
lore

Guido Trentalancia

author
#0 lore raw

PATCH 28/34 : patch to allow reading hal pid files from ifconfig_t

This patch allows to read hal pid files from the ifconfig_t context.

policy/modules/system/sysnetwork.te +1 -0
diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/system/sysnetwork.te refpolicy-git-15022011-new-modified/policy/modules/system/sysnetwork.te
@@ -327,6 +327,7 @@ ifdef(`hide_broken_symptoms',`
 optional_policy(`
 	hal_dontaudit_rw_pipes(ifconfig_t)
 	hal_dontaudit_rw_dgram_sockets(ifconfig_t)
+	hal_read_pid_files(ifconfig_t)
 ')
 
 optional_policy(`
#1 lore raw

PATCH 28/34 : patch to allow reading hal pid files from ifconfig_t

Quoted 7 lines · Guido Trentalancia

This patch allows to read hal pid files from the ifconfig_t context.

diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/system/sysnetwork.te refpolicy-git-15022011-new-modified/policy/modules/system/sysnetwork.te

policy/modules/system/sysnetwork.te ifdef(`hide_broken_symptoms',` · line 333

Quoted 7 lines
policy/modules/system/sysnetwork.te +1 -0
@@ -327,6 +327,7 @@ ifdef(`hide_broken_symptoms',`
 optional_policy(`
 	hal_dontaudit_rw_pipes(ifconfig_t)
 	hal_dontaudit_rw_dgram_sockets(ifconfig_t)
+	hal_read_pid_files(ifconfig_t)
 ')
 
 optional_policy(`

Why would this be necessary? Are you sure its not another leak (especially considering the other dontaudits)?

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#2 lore raw

PATCH 28/34 : patch to allow reading hal pid files from ifconfig_t

Quoted 14 lines · Christopher J. PeBenito
Quoted 13 lines · Guido Trentalancia

This patch allows to read hal pid files from the ifconfig_t context.

diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/system/sysnetwork.te refpolicy-git-15022011-new-modified/policy/modules/system/sysnetwork.te

policy/modules/system/sysnetwork.te +1 -0
@@ -327,6 +327,7 @@ ifdef(`hide_broken_symptoms',`
  optional_policy(`
  	hal_dontaudit_rw_pipes(ifconfig_t)
  	hal_dontaudit_rw_dgram_sockets(ifconfig_t)
+	hal_read_pid_files(ifconfig_t)
  ')
Quoted 4 lines

policy/modules/system/sysnetwork.te ifdef(`hide_broken_symptoms',` · line 333

Quoted 1 line
policy/modules/system/sysnetwork.te +0 -0
  optional_policy(`

Why would this be necessary? Are you sure its not another leak (especially considering the other dontaudits)?

We have in Fedora

hal_dontaudit_read_pid_files(ifconfig_t)

AFAIK this is a leak.

author
#3 lore raw

PATCH 28/34 : patch to allow reading hal pid files from ifconfig_t

In reply to Christopher J. PeBenito
Quoted 14 lines · Christopher J. PeBenito
Quoted 13 lines · Guido Trentalancia

This patch allows to read hal pid files from the ifconfig_t context.

diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/system/sysnetwork.te refpolicy-git-15022011-new-modified/policy/modules/system/sysnetwork.te

policy/modules/system/sysnetwork.te +1 -0
@@ -327,6 +327,7 @@ ifdef(`hide_broken_symptoms',`
 optional_policy(`
 	hal_dontaudit_rw_pipes(ifconfig_t)
 	hal_dontaudit_rw_dgram_sockets(ifconfig_t)
+	hal_read_pid_files(ifconfig_t)
 ')
Quoted 4 lines

policy/modules/system/sysnetwork.te ifdef(`hide_broken_symptoms',` · line 333

Quoted 1 line
policy/modules/system/sysnetwork.te +0 -0
 optional_policy(`

Why would this be necessary? Are you sure its not another leak (especially considering the other dontaudits)?

Yes, that is not strictly necessary. What do you mean exactly for a leak ?

Regards,

Guido

#4 lore raw

PATCH 28/34 : patch to allow reading hal pid files from ifconfig_t

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 23 lines · Guido Trentalancia
Quoted 14 lines · Christopher J. PeBenito
Quoted 13 lines · Guido Trentalancia

This patch allows to read hal pid files from the ifconfig_t context.

diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/system/sysnetwork.te refpolicy-git-15022011-new-modified/policy/modules/system/sysnetwork.te

policy/modules/system/sysnetwork.te +1 -0
@@ -327,6 +327,7 @@ ifdef(`hide_broken_symptoms',`
 optional_policy(`
 	hal_dontaudit_rw_pipes(ifconfig_t)
 	hal_dontaudit_rw_dgram_sockets(ifconfig_t)
+	hal_read_pid_files(ifconfig_t)
 ')
Quoted 4 lines

policy/modules/system/sysnetwork.te ifdef(`hide_broken_symptoms',` · line 333

Quoted 1 line
policy/modules/system/sysnetwork.te +0 -0
 optional_policy(`

Why would this be necessary? Are you sure its not another leak (especially considering the other dontaudits)?

Yes, that is not strictly necessary. What do you mean exactly for a leak ?

Quoted 8 lines

Regards,

Guido

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

http://danwalsh.livejournal.com/6117.html?thread=16613
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1r6+QACgkQrlYvE4MpobMQlgCgsXvKbJOASK9hh8uMWPFTF1Jz etAAnRn6N7mpw/QkcDj78XWq5eC3aHCa
=J1QJ
-----END PGP SIGNATURE-----