[refpolicy] [PATCH 1/2] pcscd.if: Permit access to pid files inside /var/run/pcscd/.

[refpolicy] [PATCH 1/2] pcscd.if: Permit access to pid files inside /var/run/pcscd/.

[Luis Ressel]

Gentoo places pcscd's pid file in /var/run/pcscd/ instead of /var/run/,
but pcscd_read_pid_files() doesn't grant enough permissions for this.
---
 pcscd.if | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pcscd.if b/pcscd.if
index 43d50f9..7f77d32 100644
--- a/pcscd.if
+++ b/pcscd.if
@@ -50,7 +50,7 @@ interface(`pcscd_read_pid_files',`
 	')
 
 	files_search_pids($1)
-	allow $1 pcscd_var_run_t:file read_file_perms;
+	read_files_pattern($1, pcscd_var_run_t, pcscd_var_run_t)
 ')
 
 ########################################
-- 
1.8.5.4

[refpolicy] [PATCH 2/2] Allow gpg-agent's scdaemon to connect to pcscd.

[Luis Ressel]

---
 gpg.te | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/gpg.te b/gpg.te
index 4cfa305..06a4679 100644
--- a/gpg.te
+++ b/gpg.te
@@ -1,4 +1,4 @@
-policy_module(gpg, 2.8.2)
+policy_module(gpg, 2.8.3)
 
 ########################################
 #
@@ -273,6 +273,10 @@ optional_policy(`
 	mozilla_dontaudit_rw_user_home_files(gpg_agent_t)
 ')
 
+optional_policy(`
+	pcscd_stream_connect(gpg_agent_t)
+')
+
 ##############################
 #
 # Pinentry local policy
-- 
1.8.5.4

[refpolicy] [PATCH 2/2] Allow gpg-agent's scdaemon to connect to pcscd.

[Christopher J. PeBenito]

On 2/14/2014 2:35 PM, Luis Ressel wrote:
> ---
>  gpg.te | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/gpg.te b/gpg.te
> index 4cfa305..06a4679 100644
> --- a/gpg.te
> +++ b/gpg.te
> @@ -1,4 +1,4 @@
> -policy_module(gpg, 2.8.2)
> +policy_module(gpg, 2.8.3)
>  
>  ########################################
>  #
> @@ -273,6 +273,10 @@ optional_policy(`
>  	mozilla_dontaudit_rw_user_home_files(gpg_agent_t)
>  ')
>  
> +optional_policy(`
> +	pcscd_stream_connect(gpg_agent_t)
> +')
> +
>  ##############################
>  #
>  # Pinentry local policy

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] [PATCH 1/2] pcscd.if: Permit access to pid files inside /var/run/pcscd/.

[Christopher J. PeBenito]

On 2/14/2014 2:35 PM, Luis Ressel wrote:
> Gentoo places pcscd's pid file in /var/run/pcscd/ instead of /var/run/,
> but pcscd_read_pid_files() doesn't grant enough permissions for this.
> ---
>  pcscd.if | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/pcscd.if b/pcscd.if
> index 43d50f9..7f77d32 100644
> --- a/pcscd.if
> +++ b/pcscd.if
> @@ -50,7 +50,7 @@ interface(`pcscd_read_pid_files',`
>  	')
>  
>  	files_search_pids($1)
> -	allow $1 pcscd_var_run_t:file read_file_perms;
> +	read_files_pattern($1, pcscd_var_run_t, pcscd_var_run_t)
>  ')
>  
>  ########################################
 
Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com