Skip to contentSkip to conversation

: patch set to update the git reference policy

PATCH New Guido Trentalancia 2 participants 4 messages Jan 24, 2011

lore
Share & tools
lore

Guido Trentalancia

author
#0 lore raw

PATCH 14/19 : patch set to update the git reference policy

policy/modules/system/logging.te +2 -0
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/logging.te refpolicy-git-18012011-new/policy/modules/system/logging.te
@@ -223,6 +223,8 @@ allow audisp_t self:unix_dgram_socket cr
 
 allow audisp_t auditd_t:unix_stream_socket rw_socket_perms;
 
+allow audisp_t proc_t:file read_file_perms;
+
 manage_sock_files_pattern(audisp_t, audisp_var_run_t, audisp_var_run_t)
 files_pid_filetrans(audisp_t, audisp_var_run_t, sock_file)
#1 lore raw

PATCH 14/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

policy/modules/system/logging.te allow audisp_t self:unix_dgram_socket cr · line 226

Quoted 8 lines · Guido Trentalancia

diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/logging.te refpolicy-git-18012011-new/policy/modules/system/logging.te

policy/modules/system/logging.te +1 -0
@@ -223,6 +223,8 @@ allow audisp_t self:unix_dgram_socket cr
 
 allow audisp_t auditd_t:unix_stream_socket rw_socket_perms;
 
+allow audisp_t proc_t:file read_file_perms;

usage of proc_t is not allowed here. use:

kernel_read_system_state(audisp_t)

Quoted 10 lines
policy/modules/system/logging.te +1 -0
+
 manage_sock_files_pattern(audisp_t, audisp_var_run_t, audisp_var_run_t)
 files_pid_filetrans(audisp_t, audisp_var_run_t, sock_file)

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk09g4cACgkQMlxVo39jgT8rugCfWiuhmkrBk40I+piTPDeQF8bG FJsAn3l5nOhdFsKnGUZ6vQy8QQ/sP7iH
=ngQf
-----END PGP SIGNATURE-----

author
#2 lore raw

PATCH 14/19 : patch set to update the git reference policy

Quoted 6 lines · Dominick Grift
Quoted 5 lines · Guido Trentalancia

diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/logging.te refpolicy-git-18012011-new/policy/modules/system/logging.te

policy/modules/system/logging.te +0 -0
@@ -223,6 +223,8 @@ allow audisp_t self:unix_dgram_socket cr
Quoted 7 lines

policy/modules/system/logging.te allow audisp_t self:unix_dgram_socket cr · line 226

Quoted 3 lines
policy/modules/system/logging.te +1 -0
 allow audisp_t auditd_t:unix_stream_socket rw_socket_perms;
 
+allow audisp_t proc_t:file read_file_perms;

usage of proc_t is not allowed here. use:

kernel_read_system_state(audisp_t)

Ok, it will be changed accordingly. Wasn't aware of that restriction, is it the style guidelines thing ? Of course, proc_t is not defined there...

There were other comments to other pieces of the set. Will check the rest later this evening or tomorrow as it requires a bit more time.

Thanks very much for your comments.

Regards,

Guido

#3 lore raw

PATCH 14/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 13 lines · Guido Trentalancia
Quoted 12 lines · Dominick Grift

policy/modules/system/logging.te allow audisp_t self:unix_dgram_socket cr · line 226

Quoted 8 lines · Guido Trentalancia

diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/logging.te refpolicy-git-18012011-new/policy/modules/system/logging.te

policy/modules/system/logging.te +1 -0
@@ -223,6 +223,8 @@ allow audisp_t self:unix_dgram_socket cr
 
 allow audisp_t auditd_t:unix_stream_socket rw_socket_perms;
 
+allow audisp_t proc_t:file read_file_perms;

usage of proc_t is not allowed here. use:

Quoted 5 lines
Quoted 1 line

kernel_read_system_state(audisp_t)

Ok, it will be changed accordingly. Wasn't aware of that restriction, is it the style guidelines thing ? Of course, proc_t is not defined there...

I guess atleast some unwritten rules. but it may or may not be mentioned in the style guide.

But if you study refpolicy long enough you will probably see that pattern.

Quoted 10 lines

There were other comments to other pieces of the set. Will check the rest later this evening or tomorrow as it requires a bit more time.

Thanks very much for your comments.

Regards,

Guido

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk09oNUACgkQMlxVo39jgT84TwCguwWul+QDcfBnp7qEOvh7Zjd+ dbYAnAjfSXdfWeheY9hPO5CFdRUVTMXQ
=D62H
-----END PGP SIGNATURE-----