Updates on contrib

PATCH New Sven Vermeulen 2 participants 17 messages Nov 22, 2012 – Nov 27, 2012

lore

Share & tools

lore

Sven Vermeulen

author

2012-11-22 19:21 UTC #0 lore raw

cover Updates on contrib

Another set of updates for the contrib module.

Sven Vermeulen (7):
Moving sandbox code to sandbox section Allow sandbox to log violations
Fix typo in clockspeed comment
Support openvpn status file
Asterisk voicemail messages are generated from tmp Make rtkit calls optional
Gentoo installs dovecot certs in /etc/ssl/dovecot

 asterisk.te   |    1 +
 clockspeed.if |    2 +-
 dovecot.fc    |    2 ++
 openvpn.fc    |    1 +
 openvpn.if    |    4 ++--
 openvpn.te    |    6 ++++++
 portage.te    |   14 +++++++++-----
 pulseaudio.te |    6 ++++--
 8 files changed, 26 insertions(+), 10 deletions(-)

Signature · 1 line

1.7.8.6

Sven Vermeulen

author

2012-11-22 19:21 UTC #1 lore raw

PATCH 1/7 Moving sandbox code to sandbox section

Some portage_sandbox_t code is sitting in the main portage_t section. Moving this to its own sandbox location.

Signed-off-by Sven Vermeulen <[email protected]>

---
 portage.te |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)

portage.te +6 -5

index 7d2fc08..074828c 100644
@@ -176,11 +176,6 @@ dontaudit portage_fetch_t portage_devpts_t:chr_file { read write };
 # transition to sandbox for compiling
 domain_trans(portage_t, portage_exec_t, portage_sandbox_t)
 corecmd_shell_spec_domtrans(portage_t, portage_sandbox_t)
-allow portage_sandbox_t portage_t:fd use;
-allow portage_sandbox_t portage_t:fifo_file rw_fifo_file_perms;
-allow portage_sandbox_t portage_t:process sigchld;
-allow portage_sandbox_t self:process ptrace;
-dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
 
 # run scripts out of the build directory
 can_exec(portage_t, portage_tmp_t)

@@ -338,6 +333,12 @@ optional_policy(`
 # - SELinux-enforced sandbox
 #
 
+allow portage_sandbox_t portage_t:fd use;
+allow portage_sandbox_t portage_t:fifo_file rw_fifo_file_perms;
+allow portage_sandbox_t portage_t:process sigchld;
+allow portage_sandbox_t self:process ptrace;
+dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
+
 portage_compile_domain(portage_sandbox_t)
 
 auth_use_nsswitch(portage_sandbox_t)

Signature · 1 line

1.7.8.6

grift

2012-11-27 12:53 UTC #2 lore raw

PATCH 1/7 Moving sandbox code to sandbox section

Quoted 27 lines · Sven Vermeulen

Some portage_sandbox_t code is sitting in the main portage_t section. Moving this to its own sandbox location.

Signed-off-by Sven Vermeulen <[email protected]>

---
 portage.te |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)

portage.te +0 -5

index 7d2fc08..074828c 100644
@@ -176,11 +176,6 @@ dontaudit portage_fetch_t portage_devpts_t:chr_file { read write };
 # transition to sandbox for compiling
 domain_trans(portage_t, portage_exec_t, portage_sandbox_t)
 corecmd_shell_spec_domtrans(portage_t, portage_sandbox_t)
-allow portage_sandbox_t portage_t:fd use;
-allow portage_sandbox_t portage_t:fifo_file rw_fifo_file_perms;
-allow portage_sandbox_t portage_t:process sigchld;
-allow portage_sandbox_t self:process ptrace;
-dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
 
 # run scripts out of the build directory
 can_exec(portage_t, portage_tmp_t)

@@ -338,6 +333,12 @@ optional_policy(`
 # - SELinux-enforced sandbox
 #

portage.te optional_policy(` · line 344

Quoted 10 lines

portage.te +6 -0

 
+allow portage_sandbox_t portage_t:fd use;
+allow portage_sandbox_t portage_t:fifo_file rw_fifo_file_perms;
+allow portage_sandbox_t portage_t:process sigchld;
+allow portage_sandbox_t self:process ptrace;
+dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
+
 portage_compile_domain(portage_sandbox_t)
 
 auth_use_nsswitch(portage_sandbox_t)

I guess i could merge this but this could be better

instead of domain_trans(portage_t, portage_exec_t, portage_sandbox_t) you could use: spec_domtrans_pattern(portage_t, portage_exec_t, portage_sandbox_t)

That allows you to be able to remove:

+allow portage_sandbox_t portage_t:fd use;
+allow portage_sandbox_t portage_t:fifo_file rw_fifo_file_perms; +allow portage_sandbox_t portage_t:process sigchld;

Since that is included in the spec_domtrans_pattern()

it also allows you to remove the explicit setexec since that is also included in this pattern.

If you do that then the ordering of rules is also cleaned up since self rules should be on top.

Sven Vermeulen

author

2012-11-22 19:21 UTC #3 lore raw

PATCH 2/7 Allow sandbox to log violations

In reply to Sven Vermeulen

When the sandbox (running in portage_sandbox_t) detects a violation, it will try to log this into /var/log/sandbox. However, the portage_sandbox_t domain currently is not allowed to do anything with this logs. As a result, the violations are not logged.

Allow the portage_sandbox_t domain to generate logs (as portage_log_t) as well as clean them up (sandbox will remove older violation logs if the process id of the current violation would result in an existing log file to be overwritten).

Signed-off-by Sven Vermeulen <[email protected]>

---
 portage.te |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

portage.te +3 -0

index 074828c..ebb3139 100644
@@ -339,6 +339,9 @@ allow portage_sandbox_t portage_t:process sigchld;
 allow portage_sandbox_t self:process ptrace;
 dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
 
+allow portage_sandbox_t portage_log_t:file manage_file_perms;
+logging_log_filetrans(portage_sandbox_t, portage_log_t, file)
+
 portage_compile_domain(portage_sandbox_t)
 
 auth_use_nsswitch(portage_sandbox_t)

Signature · 1 line

1.7.8.6

grift

2012-11-27 12:59 UTC #4 lore raw

PATCH 2/7 Allow sandbox to log violations

Quoted 20 lines · Sven Vermeulen

When the sandbox (running in portage_sandbox_t) detects a violation, it will try to log this into /var/log/sandbox. However, the portage_sandbox_t domain currently is not allowed to do anything with this logs. As a result, the violations are not logged.
Allow the portage_sandbox_t domain to generate logs (as portage_log_t) as well as clean them up (sandbox will remove older violation logs if the process id of the current violation would result in an existing log file to be overwritten).
Signed-off-by Sven Vermeulen <[email protected]>
---
 portage.te |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
portage.te +0 -0
index 074828c..ebb3139 100644

portage.te allow portage_sandbox_t portage_t:process sigchld; · line 344

Quoted 6 lines

portage.te +3 -0

@@ -339,6 +339,9 @@ allow portage_sandbox_t portage_t:process sigchld;
 allow portage_sandbox_t self:process ptrace;
 dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
 
+allow portage_sandbox_t portage_log_t:file manage_file_perms;
+logging_log_filetrans(portage_sandbox_t, portage_log_t, file)
+

Would be nice if we would be able to tighten this up just a little bit.

Would this work:
allow portage_sandbox_t portage_log_t:file { create_file_perms delete_file_perms setattr_file_perms append_file_perms };

That would leave out the write permission. Not very useful since sandbox can still delete the whole file but still

If it is undesired or if that will not work then i will merge this as is

Quoted 3 lines

portage.te +0 -0

 portage_compile_domain(portage_sandbox_t)
 
 auth_use_nsswitch(portage_sandbox_t)

Sven Vermeulen

author

2012-11-27 20:05 UTC #5 lore raw

PATCH 2/7 Allow sandbox to log violations

Quoted 6 lines · grift

portage.te allow portage_sandbox_t portage_t:process sigchld; · line 344
Quoted 3 lines
portage.te +3 -0
+allow portage_sandbox_t portage_log_t:file manage_file_perms;
+logging_log_filetrans(portage_sandbox_t, portage_log_t, file)
+
Would be nice if we would be able to tighten this up just a little bit.

Quoted 7 lines

Would this work:
allow portage_sandbox_t portage_log_t:file { create_file_perms delete_file_perms setattr_file_perms append_file_perms };
That would leave out the write permission. Not very useful since sandbox can still delete the whole file but still

That works as well apparently (auditallow'ed the write and didn't saw it in the logs). I'll try with those privileges here in our repository and send it up again later with those changes.

Wkr,
Sven Vermeulen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20121127/5f3507ae/attachment.html

Sven Vermeulen

author

2012-11-22 19:21 UTC #6 lore raw

PATCH 3/7 Fix typo in clockspeed comment

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 clockspeed.if |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

clockspeed.if +1 -1

index b6a51d7..2cb7bf7 100644
@@ -3,7 +3,7 @@
 ########################################
 ## <summary>
 ##	Execute clockspeed utilities in
-$$	the clockspeed_cli domain.
+##	the clockspeed_cli domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

Signature · 1 line

1.7.8.6

grift

2012-11-27 13:33 UTC #7 lore raw

PATCH 3/7 Fix typo in clockspeed comment

Quoted 10 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 clockspeed.if |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
clockspeed.if +0 -0
index b6a51d7..2cb7bf7 100644

clockspeed.if line 9

Quoted 8 lines

clockspeed.if +1 -1

@@ -3,7 +3,7 @@
 ########################################
 ## <summary>
 ##	Execute clockspeed utilities in
-$$	the clockspeed_cli domain.
+##	the clockspeed_cli domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

Merged , thanks

Sven Vermeulen

author

2012-11-22 19:21 UTC #8 lore raw

PATCH 4/7 Support openvpn status file

In reply to Sven Vermeulen

OpenVPN uses a status file that it constantly writes to (rather than append, as used for the other log files). As this is less of a log file and more of a state file, create a separate type and allow openvpn_t manage rights on it.

Signed-off-by Sven Vermeulen <[email protected]>

---
 openvpn.fc |    1 +
 openvpn.if |    4 ++--
 openvpn.te |    6 ++++++
 3 files changed, 9 insertions(+), 2 deletions(-)

openvpn.fc +1 -0

index 9f86d3d..db5adfe 100644
@@ -5,6 +5,7 @@
 
 /usr/sbin/openvpn	--	gen_context(system_u:object_r:openvpn_exec_t,s0)
 
+/var/log/openvpn-status\.log	--	gen_context(system_u:object_r:openvpn_status_t,s0)
 /var/log/openvpn.*	gen_context(system_u:object_r:openvpn_var_log_t,s0)
 
 /var/run/openvpn(/.*)?	gen_context(system_u:object_r:openvpn_var_run_t,s0)

openvpn.if +2 -2

index c11f537..03f4e60 100644
@@ -142,7 +142,7 @@ interface(`openvpn_read_config',`
 #
 interface(`openvpn_admin',`
 	gen_require(`
-		type openvpn_t, openvpn_etc_t, openvpn_var_log_t;
+		type openvpn_t, openvpn_etc_t, openvpn_var_log_t, openvpn_status_t;
 		type openvpn_var_run_t, openvpn_initrc_exec_t, openvpn_etc_rw_t;
 	')

@@ -158,7 +158,7 @@ interface(`openvpn_admin',`
 	admin_pattern($1, { openvpn_etc_t openvpn_etc_rw_t })
 
 	logging_list_logs($1)
-	admin_pattern($1, openvpn_var_log_t)
+	admin_pattern($1, { openvpn_status_t openvpn_var_log_t })
 
 	files_list_pids($1)
 	admin_pattern($1, openvpn_var_run_t)

openvpn.te +6 -0

index 58607b0..9643979 100644
@@ -29,6 +29,9 @@ files_config_file(openvpn_etc_rw_t)
 type openvpn_initrc_exec_t;
 init_script_file(openvpn_initrc_exec_t)
 
+type openvpn_status_t;
+logging_log_file(openvpn_status_t)
+
 type openvpn_var_log_t;
 logging_log_file(openvpn_var_log_t)

@@ -53,6 +56,9 @@ allow openvpn_t openvpn_etc_t:dir list_dir_perms;
 allow openvpn_t openvpn_etc_t:file read_file_perms;
 allow openvpn_t openvpn_etc_t:lnk_file read_lnk_file_perms;
 
+allow openvpn_t openvpn_status_t:file manage_file_perms;
+logging_log_filetrans(openvpn_t, openvpn_status_t, file, "openvpn-status.log")
+
 manage_files_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t)
 filetrans_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t, file)

Signature · 1 line

1.7.8.6

grift

2012-11-27 13:35 UTC #9 lore raw

PATCH 4/7 Support openvpn status file

Quoted 60 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 openvpn.fc |    1 +
 openvpn.if |    4 ++--
 openvpn.te |    6 ++++++
 3 files changed, 9 insertions(+), 2 deletions(-)

openvpn.fc +1 -0

index 9f86d3d..db5adfe 100644
@@ -5,6 +5,7 @@
 
 /usr/sbin/openvpn	--	gen_context(system_u:object_r:openvpn_exec_t,s0)
 
+/var/log/openvpn-status\.log	--	gen_context(system_u:object_r:openvpn_status_t,s0)
 /var/log/openvpn.*	gen_context(system_u:object_r:openvpn_var_log_t,s0)
 
 /var/run/openvpn(/.*)?	gen_context(system_u:object_r:openvpn_var_run_t,s0)

openvpn.if +2 -2

index c11f537..03f4e60 100644
@@ -142,7 +142,7 @@ interface(`openvpn_read_config',`
 #
 interface(`openvpn_admin',`
 	gen_require(`
-		type openvpn_t, openvpn_etc_t, openvpn_var_log_t;
+		type openvpn_t, openvpn_etc_t, openvpn_var_log_t, openvpn_status_t;
 		type openvpn_var_run_t, openvpn_initrc_exec_t, openvpn_etc_rw_t;
 	')

@@ -158,7 +158,7 @@ interface(`openvpn_admin',`
 	admin_pattern($1, { openvpn_etc_t openvpn_etc_rw_t })
 
 	logging_list_logs($1)
-	admin_pattern($1, openvpn_var_log_t)
+	admin_pattern($1, { openvpn_status_t openvpn_var_log_t })
 
 	files_list_pids($1)
 	admin_pattern($1, openvpn_var_run_t)

openvpn.te +3 -0

index 58607b0..9643979 100644
@@ -29,6 +29,9 @@ files_config_file(openvpn_etc_rw_t)
 type openvpn_initrc_exec_t;
 init_script_file(openvpn_initrc_exec_t)
 
+type openvpn_status_t;
+logging_log_file(openvpn_status_t)
+
 type openvpn_var_log_t;
 logging_log_file(openvpn_var_log_t)

openvpn.te allow openvpn_t openvpn_etc_t:dir list_dir_perms; · line 64

Quoted 9 lines

openvpn.te +3 -0

@@ -53,6 +56,9 @@ allow openvpn_t openvpn_etc_t:dir list_dir_perms;
 allow openvpn_t openvpn_etc_t:file read_file_perms;
 allow openvpn_t openvpn_etc_t:lnk_file read_lnk_file_perms;
 
+allow openvpn_t openvpn_status_t:file manage_file_perms;
+logging_log_filetrans(openvpn_t, openvpn_status_t, file, "openvpn-status.log")
+
 manage_files_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t)
 filetrans_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t, file)

Not sure if this is worth it and where other modules store this file but i merged it with some minor clean up, thanks

grift

2012-11-27 13:36 UTC #10 lore raw

PATCH 4/7 Support openvpn status file

Quoted 64 lines · grift

Quoted 63 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 openvpn.fc |    1 +
 openvpn.if |    4 ++--
 openvpn.te |    6 ++++++
 3 files changed, 9 insertions(+), 2 deletions(-)

openvpn.fc +1 -0

index 9f86d3d..db5adfe 100644
@@ -5,6 +5,7 @@
 
 /usr/sbin/openvpn	--	gen_context(system_u:object_r:openvpn_exec_t,s0)
 
+/var/log/openvpn-status\.log	--	gen_context(system_u:object_r:openvpn_status_t,s0)
 /var/log/openvpn.*	gen_context(system_u:object_r:openvpn_var_log_t,s0)
 
 /var/run/openvpn(/.*)?	gen_context(system_u:object_r:openvpn_var_run_t,s0)

openvpn.if +2 -2

index c11f537..03f4e60 100644
@@ -142,7 +142,7 @@ interface(`openvpn_read_config',`
 #
 interface(`openvpn_admin',`
 	gen_require(`
-		type openvpn_t, openvpn_etc_t, openvpn_var_log_t;
+		type openvpn_t, openvpn_etc_t, openvpn_var_log_t, openvpn_status_t;
 		type openvpn_var_run_t, openvpn_initrc_exec_t, openvpn_etc_rw_t;
 	')

@@ -158,7 +158,7 @@ interface(`openvpn_admin',`
 	admin_pattern($1, { openvpn_etc_t openvpn_etc_rw_t })
 
 	logging_list_logs($1)
-	admin_pattern($1, openvpn_var_log_t)
+	admin_pattern($1, { openvpn_status_t openvpn_var_log_t })
 
 	files_list_pids($1)
 	admin_pattern($1, openvpn_var_run_t)

openvpn.te +3 -0

index 58607b0..9643979 100644
@@ -29,6 +29,9 @@ files_config_file(openvpn_etc_rw_t)
 type openvpn_initrc_exec_t;
 init_script_file(openvpn_initrc_exec_t)
 
+type openvpn_status_t;
+logging_log_file(openvpn_status_t)
+
 type openvpn_var_log_t;
 logging_log_file(openvpn_var_log_t)

@@ -53,6 +56,9 @@ allow openvpn_t openvpn_etc_t:dir list_dir_perms;
 allow openvpn_t openvpn_etc_t:file read_file_perms;
 allow openvpn_t openvpn_etc_t:lnk_file read_lnk_file_perms;

Quoted 10 lines

openvpn.te allow openvpn_t openvpn_etc_t:dir list_dir_perms; · line 64
Quoted 6 lines
openvpn.te +3 -0
+allow openvpn_t openvpn_status_t:file manage_file_perms;
+logging_log_filetrans(openvpn_t, openvpn_status_t, file, "openvpn-status.log")
+
 manage_files_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t)
 filetrans_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t, file)
 
Not sure if this is worth it and where other modules store this file but i merged it with some minor clean up, thanks

I meant "other distributions"

Sven Vermeulen

author

2012-11-22 19:21 UTC #11 lore raw

PATCH 5/7 Asterisk voicemail messages are generated from tmp

In reply to Sven Vermeulen

When asterisk creates a voicemail message to send to the end user, the message recording is a temporary file (labeled asterisk_tmp_t) which is then picked up by the system mailer. Hence, we need to mark asterisk_tmp_t as mta_system_content().

Signed-off-by Sven Vermeulen <[email protected]>

---
 asterisk.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

asterisk.te +1 -0

index 084b4a9..ac8543a 100644
@@ -164,6 +164,7 @@ optional_policy(`
 
 optional_policy(`
 	mta_send_mail(asterisk_t)
+	mta_system_content(asterisk_tmp_t)
 ')
 
 optional_policy(`

Signature · 1 line

1.7.8.6

grift

Applied

2012-11-27 13:37 UTC #12 lore raw

PATCH 5/7 Asterisk voicemail messages are generated from tmp

Quoted 15 lines · Sven Vermeulen

When asterisk creates a voicemail message to send to the end user, the message recording is a temporary file (labeled asterisk_tmp_t) which is then picked up by the system mailer. Hence, we need to mark asterisk_tmp_t as mta_system_content().
Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
asterisk.te +0 -0
index 084b4a9..ac8543a 100644

asterisk.te optional_policy(` · line 170

Quoted 7 lines

asterisk.te +1 -0

@@ -164,6 +164,7 @@ optional_policy(`
 
 optional_policy(`
 	mta_send_mail(asterisk_t)
+	mta_system_content(asterisk_tmp_t)
 ')
 
 optional_policy(`

Merged, thanks

Sven Vermeulen

author

2012-11-22 19:21 UTC #13 lore raw

PATCH 6/7 Make rtkit calls optional

In reply to Sven Vermeulen

The rtkit module is not a mandatory component for pulseaudio, so should be within an optional_policy() clause.

Signed-off-by Sven Vermeulen <[email protected]>

---
 pulseaudio.te |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

pulseaudio.te +4 -2

index 99e371b..b42f0f7 100644
@@ -224,8 +224,6 @@ pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file, ".esd_auth")
 pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file, ".pulse-cookie")
 pulseaudio_signull(pulseaudio_client)
 
-rtkit_scheduled(pulseaudio_client)
-
 # TODO: ~/.cache
 userdom_manage_user_home_content_files(pulseaudio_client)

@@ -249,3 +247,7 @@ tunable_policy(`use_samba_home_dirs',`
 optional_policy(`
 	pulseaudio_dbus_chat(pulseaudio_client)
 ')
+
+optional_policy(`
+	rtkit_scheduled(pulseaudio_client)
+')

Signature · 1 line

1.7.8.6

grift

2012-11-27 13:39 UTC #14 lore raw

PATCH 6/7 Make rtkit calls optional

Quoted 22 lines · Sven Vermeulen

The rtkit module is not a mandatory component for pulseaudio, so should be within an optional_policy() clause.

Signed-off-by Sven Vermeulen <[email protected]>

---
 pulseaudio.te |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

pulseaudio.te +0 -2

index 99e371b..b42f0f7 100644
@@ -224,8 +224,6 @@ pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file, ".esd_auth")
 pulseaudio_home_filetrans_pulseaudio_home(pulseaudio_client, file, ".pulse-cookie")
 pulseaudio_signull(pulseaudio_client)
 
-rtkit_scheduled(pulseaudio_client)
-
 # TODO: ~/.cache
 userdom_manage_user_home_content_files(pulseaudio_client)

pulseaudio.te tunable_policy(`use_samba_home_dirs',` · line 253

Quoted 7 lines

pulseaudio.te +4 -0

@@ -249,3 +247,7 @@ tunable_policy(`use_samba_home_dirs',`
 optional_policy(`
 	pulseaudio_dbus_chat(pulseaudio_client)
 ')
+
+optional_policy(`
+	rtkit_scheduled(pulseaudio_client)
+')

Is it not mandatory? Merged, Thanks

Sven Vermeulen

author

2012-11-22 19:21 UTC #15 lore raw

PATCH 7/7 Gentoo installs dovecot certs in /etc/ssl/dovecot

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 dovecot.fc |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

dovecot.fc +2 -0

index 499f1fc..c880070 100644
@@ -13,6 +13,8 @@
 /usr/share/ssl/certs/dovecot\.pem	--	gen_context(system_u:object_r:dovecot_cert_t,s0)
 /usr/share/ssl/private/dovecot\.pem	--	gen_context(system_u:object_r:dovecot_cert_t,s0)
 
+/etc/ssl/dovecot(/.*)?	gen_context(system_u:object_r:dovecot_cert_t,s0)
+
 /usr/lib/dovecot/auth	--	gen_context(system_u:object_r:dovecot_auth_exec_t,s0)
 /usr/lib/dovecot/deliver	--	gen_context(system_u:object_r:dovecot_deliver_exec_t,s0)
 /usr/lib/dovecot/dovecot-auth	--	gen_context(system_u:object_r:dovecot_auth_exec_t,s0)

Signature · 1 line

1.7.8.6

grift

Applied

2012-11-27 13:40 UTC #16 lore raw

PATCH 7/7 Gentoo installs dovecot certs in /etc/ssl/dovecot

Quoted 10 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 dovecot.fc |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
dovecot.fc +0 -0
index 499f1fc..c880070 100644

dovecot.fc line 20

Quoted 8 lines

dovecot.fc +2 -0

@@ -13,6 +13,8 @@
 /usr/share/ssl/certs/dovecot\.pem	--	gen_context(system_u:object_r:dovecot_cert_t,s0)
 /usr/share/ssl/private/dovecot\.pem	--	gen_context(system_u:object_r:dovecot_cert_t,s0)
 
+/etc/ssl/dovecot(/.*)?	gen_context(system_u:object_r:dovecot_cert_t,s0)
+
 /usr/lib/dovecot/auth	--	gen_context(system_u:object_r:dovecot_auth_exec_t,s0)
 /usr/lib/dovecot/deliver	--	gen_context(system_u:object_r:dovecot_deliver_exec_t,s0)
 /usr/lib/dovecot/dovecot-auth	--	gen_context(system_u:object_r:dovecot_auth_exec_t,s0)

Merged, thanks