Re: Reissue previous patch

[James Carter <jwcart2@epoch.ncsc.mil>]

On Thu, 2004-12-02 at 09:16, Daniel J Walsh wrote:
> James Carter wrote:
> 
<snip>
> >>diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/ssh_macros.te policy-1.19.7/macros/program/ssh_macros.te
> >>--- nsapolicy/macros/program/ssh_macros.te	2004-11-30 05:59:40.000000000 -0500
> >>+++ policy-1.19.7/macros/program/ssh_macros.te	2004-11-30 06:18:45.000000000 -0500
> >>@@ -82,7 +82,7 @@
> >> 
> >> # Grant permissions needed to create TCP and UDP sockets and
> >> # to access the network.
> >>-can_network($1_ssh_t)
> >>+can_network_client_tcp($1_ssh_t)
> >> can_ypbind($1_ssh_t)
> >> 
> >> # Use capabilities.
> >>    
> >>
> >
> >I used can_network_client() instead.
> >
> >The following was needed by ssh during my normal usage of it (like
> >updating the CVS tree on sourceforge.)
> >
> >allow user_ssh_t self:udp_socket create
> >
> >  
> >
> I think this is caused by the resolver.  This is why I would like to get 
> to the point of using
> can_resolve() where we specify the exact port that you can connect to.

You're right.  I changed it to use can_network_client_tcp() and
can_resolve().

-- 
James Carter <jwcart2@epoch.ncsc.mil>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.