[refpolicy] Write permission for /proc/net/xt_recent/

[refpolicy] Write permission for /proc/net/xt_recent/

[Luis Ressel]

Hello,


On my systems, it's neccessary for sysadm_t to be allowed to write to
proc_net_t files, specifically to the files in /proc/net/xt_recent/,
which allow manual control of the "recent" module of iptables. I don't
think it's neccessary to add another type for these files, as the other
proc_net_t files aren't writeable anyway. So I'd propose
"allow sysadm_t proc_net_t:file write;"

I don't have a patch, as I'm not sure where to put this (in
roles/sysadm.te or somewhere else) and if a new interface should be
added for it.


Regards,
Luis Ressel


-- 
Luis Ressel <aranea@aixah.de>
GPG fpr: F08D 2AF6 655E 25DE 52BC  E53D 08F5 7F90 3029 B5BD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 966 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140125/d3e26b77/attachment.bin 

[refpolicy] Write permission for /proc/net/xt_recent/

[Christopher J. PeBenito]

On 1/25/2014 11:36 AM, Luis Ressel wrote:
> On my systems, it's neccessary for sysadm_t to be allowed to write to
> proc_net_t files, specifically to the files in /proc/net/xt_recent/,
> which allow manual control of the "recent" module of iptables. I don't

What program is used to do this?  Perhaps that should be iptables_exec_t instead.


> I don't have a patch, as I'm not sure where to put this (in
> roles/sysadm.te or somewhere else) and if a new interface should be
> added for it.

Accesses of types in other modules need to use interfaces.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] Write permission for /proc/net/xt_recent/

[Luis Ressel]

On Fri, 31 Jan 2014 22:37:02 -0500
"Christopher J. PeBenito" <cpebenito@tresys.com> wrote:

> On 1/25/2014 11:36 AM, Luis Ressel wrote:
> > On my systems, it's neccessary for sysadm_t to be allowed to write
> > to proc_net_t files, specifically to the files
> > in /proc/net/xt_recent/, which allow manual control of the "recent"
> > module of iptables. I don't
> 
> What program is used to do this?  Perhaps that should be
> iptables_exec_t instead.

I'm writing to those files manually via echo. I'll just write a helper
script then and label it accordingly.


--
Luis Ressel <aranea@aixah.de>
GPG fpr: F08D 2AF6 655E 25DE 52BC  E53D 08F5 7F90 3029 B5BD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 966 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140201/ff7e3ae3/attachment.bin