Date: Mon, 22 Jan 2007 20:08:23 GMT From: Todd Miller <millert@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 113414 for review Message-ID: <200701222008.l0MK8NLP090135@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=113414 Change 113414 by millert@millert_macbook on 2007/01/22 20:07:45 Try to disambiguate file labels for shells and cron executables. Add self mach_port permissions for syslogd_t and memberd_t. Affected files ... .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/memberd.te#8 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corecommands.fc#3 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/services/cron.fc#5 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/logging.te#7 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/memberd.te#8 (text+ko) ==== @@ -42,8 +42,8 @@ init_allow_shm(memberd_t) init_allow_bootstrap(memberd_t) -# Talk tro self -allow memberd_t self:mach_port make_send_once; +# Talk to self +allow memberd_t self:mach_port { copy_send hold_send send make_send_once }; # Talk to kernel kernel_allow_ipc(memberd_t) ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corecommands.fc#3 (text+ko) ==== @@ -8,7 +8,9 @@ /bin/ksh -- gen_context(system_u:object_r:shell_exec_t,s0) /bin/ls -- gen_context(system_u:object_r:ls_exec_t,s0) /bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0) +/bin/csh -- gen_context(system_u:object_r:shell_exec_t,s0) /bin/zsh -- gen_context(system_u:object_r:shell_exec_t,s0) +/bin/zsh-.* -- gen_context(system_u:object_r:shell_exec_t,s0) # # /sbin ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/services/cron.fc#5 (text+ko) ==== @@ -7,6 +7,9 @@ /usr/sbin/anacron -- gen_context(system_u:object_r:anacron_exec_t,s0) /usr/sbin/atd -- gen_context(system_u:object_r:crond_exec_t,s0) +/usr/sbin/atq -- gen_context(system_u:object_r:crond_exec_t,s0) +/usr/sbin/atrm -- gen_context(system_u:object_r:crond_exec_t,s0) +/usr/sbin/batch -- gen_context(system_u:object_r:crond_exec_t,s0) /usr/sbin/cron(d)? -- gen_context(system_u:object_r:crond_exec_t,s0) /usr/sbin/fcron -- gen_context(system_u:object_r:crond_exec_t,s0) ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/logging.te#7 (text+ko) ==== @@ -147,7 +147,7 @@ # Talk to self allow syslogd_t self:socket { bind listen accept read }; -allow syslogd_t self:mach_port make_send_once; +allow syslogd_t self:mach_port { copy_send hold_send send make_send_once }; # Talk to notifyd notifyd_allow_ipc(syslogd_t)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200701222008.l0MK8NLP090135>