Skip to contentSkip to conversation

Adding dontaudits

PATCH New Sven Vermeulen 2 participants 5 messages Apr 21, 2012 – May 4, 2012

lore
Share & tools
lore

Sven Vermeulen

author
#0 lore raw

v2 cover Adding dontaudits

Update on the dontaudit patches sent earlier, with Christopers' feedback incorporated.

Wkr,
Sven Vermeulen

author
#1 lore raw

PATCH v2 1/2 Adding dontaudit on mta

Signed-off-by Sven Vermeulen <[email protected]>
---
 mta.if |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
mta.if +2 -0
index 343cee3..4e2a5ba 100644
@@ -362,6 +362,8 @@ interface(`mta_send_mail',`
 	allow mta_user_agent $1:fd use;
 	allow mta_user_agent $1:process sigchld;
 	allow mta_user_agent $1:fifo_file rw_fifo_file_perms;
+
+	dontaudit mta_user_agent $1:unix_stream_socket rw_socket_perms;
 ')
 
 ########################################
Signature · 1 line
1.7.3.4
#2 lore raw

PATCH v2 1/2 Adding dontaudit on mta

Quoted 11 lines · Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 mta.if |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
mta.if +0 -0
index 343cee3..4e2a5ba 100644

mta.if interface(`mta_send_mail',` · line 369

Quoted 8 lines
mta.if +2 -0
@@ -362,6 +362,8 @@ interface(`mta_send_mail',`
 	allow mta_user_agent $1:fd use;
 	allow mta_user_agent $1:process sigchld;
 	allow mta_user_agent $1:fifo_file rw_fifo_file_perms;
+
+	dontaudit mta_user_agent $1:unix_stream_socket rw_socket_perms;
 ')
 
 ########################################

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#3 lore raw

PATCH 1/1 Adding dontaudits for xserver

In reply to Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/services/xserver.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
policy/modules/services/xserver.te +2 -0
index e92dddf..259a67b 100644
@@ -635,6 +635,8 @@ allow xserver_t xauth_home_t:file read_file_perms;
 manage_files_pattern(xserver_t, xserver_log_t, xserver_log_t)
 logging_log_filetrans(xserver_t, xserver_log_t, file)
 
+domain_dontaudit_search_all_domains_state(xserver_t)
+
 kernel_read_system_state(xserver_t)
 kernel_read_device_sysctls(xserver_t)
 kernel_read_modprobe_sysctls(xserver_t)
Signature · 1 line
1.7.3.4
#4 lore raw

PATCH 1/1 Adding dontaudits for xserver

Quoted 11 lines · Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/services/xserver.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
policy/modules/services/xserver.te +0 -0
index e92dddf..259a67b 100644

policy/modules/services/xserver.te allow xserver_t xauth_home_t:file read_file_perms; · line 642

Quoted 8 lines
policy/modules/services/xserver.te +2 -0
@@ -635,6 +635,8 @@ allow xserver_t xauth_home_t:file read_file_perms;
 manage_files_pattern(xserver_t, xserver_log_t, xserver_log_t)
 logging_log_filetrans(xserver_t, xserver_log_t, file)
 
+domain_dontaudit_search_all_domains_state(xserver_t)
+
 kernel_read_system_state(xserver_t)
 kernel_read_device_sysctls(xserver_t)
 kernel_read_modprobe_sysctls(xserver_t)

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com