* [refpolicy] [PATCH] added autofs support
@ 2012-10-02 7:25 Matthew Thode
2012-10-02 8:55 ` Dominick Grift
0 siblings, 1 reply; 5+ messages in thread
From: Matthew Thode @ 2012-10-02 7:25 UTC (permalink / raw)
To: refpolicy
adds autofs support to portage, needed for using portage on nfs on autofs.
---
portage.te | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/portage.te b/portage.te
index 630f16f..128e7d6 100644
--- a/portage.te
+++ b/portage.te
@@ -298,6 +298,9 @@ files_read_usr_files(portage_fetch_t)
files_search_var_lib(portage_fetch_t)
files_dontaudit_search_pids(portage_fetch_t)
+fs_search_auto_mountpoints(portage_fetch_t)
+dev_rw_autofs(portage_fetch_t)
+
logging_list_logs(portage_fetch_t)
logging_dontaudit_search_logs(portage_fetch_t)
--
1.7.8.6
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [refpolicy] [PATCH] added autofs support
2012-10-02 7:25 [refpolicy] [PATCH] added autofs support Matthew Thode
@ 2012-10-02 8:55 ` Dominick Grift
2012-10-02 13:59 ` [refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch Matthew Thode
0 siblings, 1 reply; 5+ messages in thread
From: Dominick Grift @ 2012-10-02 8:55 UTC (permalink / raw)
To: refpolicy
On Tue, 2012-10-02 at 02:25 -0500, Matthew Thode wrote:
> adds autofs support to portage, needed for using portage on nfs on autofs.
>
> ---
> portage.te | 3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/portage.te b/portage.te
> index 630f16f..128e7d6 100644
> --- a/portage.te
> +++ b/portage.te
> @@ -298,6 +298,9 @@ files_read_usr_files(portage_fetch_t)
> files_search_var_lib(portage_fetch_t)
> files_dontaudit_search_pids(portage_fetch_t)
>
> +fs_search_auto_mountpoints(portage_fetch_t)
> +dev_rw_autofs(portage_fetch_t)
> +
> logging_list_logs(portage_fetch_t)
> logging_dontaudit_search_logs(portage_fetch_t)
>
This is wrong but this reply is mainly just a note to self.
So far i established that we need the following instead:
+tunable_policy(`portage_use_nfs',`
+ fs_getattr_nfs(portage_t)
+')
+fs_search_auto_mountpoints(portage_fetch_t)
+auth_use_nsswitch(portage_fetch_t)
^ permalink raw reply [flat|nested] 5+ messages in thread
* [refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch
2012-10-02 8:55 ` Dominick Grift
@ 2012-10-02 13:59 ` Matthew Thode
2012-10-09 14:09 ` Christopher J. PeBenito
0 siblings, 1 reply; 5+ messages in thread
From: Matthew Thode @ 2012-10-02 13:59 UTC (permalink / raw)
To: refpolicy
subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D
---
portage.te | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/portage.te b/portage.te
index 128e7d6..321b1ac 100644
--- a/portage.te
+++ b/portage.te
@@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
selinux_get_fs_mount(portage_t)
auth_manage_shadow(portage_t)
+auth_use_nsswitch(portage_fetch_t)
+auth_use_nsswitch(portage_sandbox_t)
# merging baselayout will need this:
init_exec(portage_t)
@@ -299,7 +301,6 @@ files_search_var_lib(portage_fetch_t)
files_dontaudit_search_pids(portage_fetch_t)
fs_search_auto_mountpoints(portage_fetch_t)
-dev_rw_autofs(portage_fetch_t)
logging_list_logs(portage_fetch_t)
logging_dontaudit_search_logs(portage_fetch_t)
@@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
')
tunable_policy(`portage_use_nfs',`
+ fs_getattr_nfs(portage_t)
fs_getattr_nfs(portage_fetch_t)
fs_manage_nfs_dirs(portage_fetch_t)
fs_manage_nfs_files(portage_fetch_t)
--
1.7.8.6
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch
2012-10-02 13:59 ` [refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch Matthew Thode
@ 2012-10-09 14:09 ` Christopher J. PeBenito
2012-10-09 15:03 ` Dominick Grift
0 siblings, 1 reply; 5+ messages in thread
From: Christopher J. PeBenito @ 2012-10-09 14:09 UTC (permalink / raw)
To: refpolicy
On 10/02/12 09:59, Matthew Thode wrote:
> subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D
>
> ---
> portage.te | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/portage.te b/portage.te
> index 128e7d6..321b1ac 100644
> --- a/portage.te
> +++ b/portage.te
> @@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
> selinux_get_fs_mount(portage_t)
>
> auth_manage_shadow(portage_t)
> +auth_use_nsswitch(portage_fetch_t)
> +auth_use_nsswitch(portage_sandbox_t)
>
> # merging baselayout will need this:
> init_exec(portage_t)
[cut]
> @@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
> ')
>
> tunable_policy(`portage_use_nfs',`
> + fs_getattr_nfs(portage_t)
> fs_getattr_nfs(portage_fetch_t)
> fs_manage_nfs_dirs(portage_fetch_t)
> fs_manage_nfs_files(portage_fetch_t)
The lines should go with the sections, i.e. the portage_fetch_t addition should go in the portage_fetch_t section, and the portage_sandbox_t addition should go in the portage_sandbox_t section.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 5+ messages in thread
* [refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch
2012-10-09 14:09 ` Christopher J. PeBenito
@ 2012-10-09 15:03 ` Dominick Grift
0 siblings, 0 replies; 5+ messages in thread
From: Dominick Grift @ 2012-10-09 15:03 UTC (permalink / raw)
To: refpolicy
On Tue, 2012-10-09 at 10:09 -0400, Christopher J. PeBenito wrote:
> On 10/02/12 09:59, Matthew Thode wrote:
> > subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D
> >
> > ---
> > portage.te | 4 +++-
> > 1 files changed, 3 insertions(+), 1 deletions(-)
> >
> > diff --git a/portage.te b/portage.te
> > index 128e7d6..321b1ac 100644
> > --- a/portage.te
> > +++ b/portage.te
> > @@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
> > selinux_get_fs_mount(portage_t)
> >
> > auth_manage_shadow(portage_t)
> > +auth_use_nsswitch(portage_fetch_t)
> > +auth_use_nsswitch(portage_sandbox_t)
> >
> > # merging baselayout will need this:
> > init_exec(portage_t)
> [cut]
> > @@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
> > ')
> >
> > tunable_policy(`portage_use_nfs',`
> > + fs_getattr_nfs(portage_t)
> > fs_getattr_nfs(portage_fetch_t)
> > fs_manage_nfs_dirs(portage_fetch_t)
> > fs_manage_nfs_files(portage_fetch_t)
>
> The lines should go with the sections, i.e. the portage_fetch_t addition should go in the portage_fetch_t section, and the portage_sandbox_t addition should go in the portage_sandbox_t section.
>
This has already been taken care of
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-10-09 15:03 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-10-02 7:25 [refpolicy] [PATCH] added autofs support Matthew Thode
2012-10-02 8:55 ` Dominick Grift
2012-10-02 13:59 ` [refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch Matthew Thode
2012-10-09 14:09 ` Christopher J. PeBenito
2012-10-09 15:03 ` Dominick Grift
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.