From owner-p4-projects@FreeBSD.ORG Mon Jan 22 20:08:24 2007 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 6DB6116A406; Mon, 22 Jan 2007 20:08:24 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 4C4AC16A404 for ; Mon, 22 Jan 2007 20:08:24 +0000 (UTC) (envelope-from millert@freebsd.org) Received: from repoman.freebsd.org (repoman.freebsd.org [69.147.83.41]) by mx1.freebsd.org (Postfix) with ESMTP id 3D27113C467 for ; Mon, 22 Jan 2007 20:08:24 +0000 (UTC) (envelope-from millert@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id l0MK8OkY090138 for ; Mon, 22 Jan 2007 20:08:24 GMT (envelope-from millert@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id l0MK8NLP090135 for perforce@freebsd.org; Mon, 22 Jan 2007 20:08:23 GMT (envelope-from millert@freebsd.org) Date: Mon, 22 Jan 2007 20:08:23 GMT Message-Id: <200701222008.l0MK8NLP090135@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to millert@freebsd.org using -f From: Todd Miller To: Perforce Change Reviews Cc: Subject: PERFORCE change 113414 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jan 2007 20:08:24 -0000 http://perforce.freebsd.org/chv.cgi?CH=113414 Change 113414 by millert@millert_macbook on 2007/01/22 20:07:45 Try to disambiguate file labels for shells and cron executables. Add self mach_port permissions for syslogd_t and memberd_t. Affected files ... .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/memberd.te#8 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corecommands.fc#3 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/services/cron.fc#5 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/logging.te#7 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/memberd.te#8 (text+ko) ==== @@ -42,8 +42,8 @@ init_allow_shm(memberd_t) init_allow_bootstrap(memberd_t) -# Talk tro self -allow memberd_t self:mach_port make_send_once; +# Talk to self +allow memberd_t self:mach_port { copy_send hold_send send make_send_once }; # Talk to kernel kernel_allow_ipc(memberd_t) ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corecommands.fc#3 (text+ko) ==== @@ -8,7 +8,9 @@ /bin/ksh -- gen_context(system_u:object_r:shell_exec_t,s0) /bin/ls -- gen_context(system_u:object_r:ls_exec_t,s0) /bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0) +/bin/csh -- gen_context(system_u:object_r:shell_exec_t,s0) /bin/zsh -- gen_context(system_u:object_r:shell_exec_t,s0) +/bin/zsh-.* -- gen_context(system_u:object_r:shell_exec_t,s0) # # /sbin ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/services/cron.fc#5 (text+ko) ==== @@ -7,6 +7,9 @@ /usr/sbin/anacron -- gen_context(system_u:object_r:anacron_exec_t,s0) /usr/sbin/atd -- gen_context(system_u:object_r:crond_exec_t,s0) +/usr/sbin/atq -- gen_context(system_u:object_r:crond_exec_t,s0) +/usr/sbin/atrm -- gen_context(system_u:object_r:crond_exec_t,s0) +/usr/sbin/batch -- gen_context(system_u:object_r:crond_exec_t,s0) /usr/sbin/cron(d)? -- gen_context(system_u:object_r:crond_exec_t,s0) /usr/sbin/fcron -- gen_context(system_u:object_r:crond_exec_t,s0) ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/logging.te#7 (text+ko) ==== @@ -147,7 +147,7 @@ # Talk to self allow syslogd_t self:socket { bind listen accept read }; -allow syslogd_t self:mach_port make_send_once; +allow syslogd_t self:mach_port { copy_send hold_send send make_send_once }; # Talk to notifyd notifyd_allow_ipc(syslogd_t)