Allow httpd_t to change its system resources

When using lighttpd and server.max-fds is set, then the httpd_t domain requires the setrlimit (process) and sys_resource (capability) privileges. As per fedora's (and now also Gentoo's) implementation we support this through a boolean called "httpd_setrlimit" which is by default off).

Signed-off-by Sven Vermeulen <[email protected]>

---
 apache.te |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)

apache.te +12 -0

index 5b02edb..dfd3ca7 100644
@@ -100,6 +100,13 @@ gen_tunable(httpd_enable_homedirs, false)
 
 ## <desc>
 ## <p>
+## Allow httpd daemon to change its resource limits
+## </p>
+## </desc>
+gen_tunable(httpd_setrlimit, false)
+
+## <desc>
+## <p>
 ## Allow HTTPD to run SSI executables in the same domain as system CGI scripts.
 ## </p>
 ## </desc>

@@ -487,6 +494,11 @@ tunable_policy(`httpd_can_sendmail',`
 	mta_send_mail(httpd_t)
 ')
 
+tunable_policy(`httpd_setrlimit',`
+	allow httpd_t self:process setrlimit;
+	allow httpd_t self:capability sys_resource;
+')
+
 tunable_policy(`httpd_ssi_exec',`
 	corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
 	allow httpd_sys_script_t httpd_t:fd use;