* [refpolicy] [PATCH v3] ipsec: add missing permissions for pluto
@ 2018-07-26 22:37 Yuli Khodorkovskiy
2018-07-28 13:03 ` Chris PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Yuli Khodorkovskiy @ 2018-07-26 22:37 UTC (permalink / raw)
To: refpolicy
When using libreswan, pluto needs permissions for building the
Security Association Database and for setting contexts on IPSec
policy and SAs.
Signed-off-by: Yuli Khodorkovskiy <yuli@crunchydata.com>
---
policy/modules/system/ipsec.te | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 867aefc4..fe113277 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -151,12 +151,16 @@ corenet_udp_bind_isakmp_port(ipsec_t)
corenet_udp_bind_ipsecnat_port(ipsec_t)
corenet_sendrecv_generic_server_packets(ipsec_t)
corenet_sendrecv_isakmp_server_packets(ipsec_t)
+# allow pluto to build Security Association Database
+corenet_setcontext_all_spds(ipsec_t)
dev_read_sysfs(ipsec_t)
dev_read_rand(ipsec_t)
dev_read_urand(ipsec_t)
domain_use_interactive_fds(ipsec_t)
+# allow pluto to set contexts on ipsec policy and SAs
+domain_ipsec_setcontext_all_domains(ipsec_t)
files_list_tmp(ipsec_t)
files_read_etc_files(ipsec_t)
--
2.18.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [refpolicy] [PATCH v3] ipsec: add missing permissions for pluto
2018-07-26 22:37 [refpolicy] [PATCH v3] ipsec: add missing permissions for pluto Yuli Khodorkovskiy
@ 2018-07-28 13:03 ` Chris PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Chris PeBenito @ 2018-07-28 13:03 UTC (permalink / raw)
To: refpolicy
On 07/26/2018 06:37 PM, Yuli Khodorkovskiy via refpolicy wrote:
> When using libreswan, pluto needs permissions for building the
> Security Association Database and for setting contexts on IPSec
> policy and SAs.
>
> Signed-off-by: Yuli Khodorkovskiy <yuli@crunchydata.com>
> ---
> policy/modules/system/ipsec.te | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
> index 867aefc4..fe113277 100644
> --- a/policy/modules/system/ipsec.te
> +++ b/policy/modules/system/ipsec.te
> @@ -151,12 +151,16 @@ corenet_udp_bind_isakmp_port(ipsec_t)
> corenet_udp_bind_ipsecnat_port(ipsec_t)
> corenet_sendrecv_generic_server_packets(ipsec_t)
> corenet_sendrecv_isakmp_server_packets(ipsec_t)
> +# allow pluto to build Security Association Database
> +corenet_setcontext_all_spds(ipsec_t)
>
> dev_read_sysfs(ipsec_t)
> dev_read_rand(ipsec_t)
> dev_read_urand(ipsec_t)
>
> domain_use_interactive_fds(ipsec_t)
> +# allow pluto to set contexts on ipsec policy and SAs
> +domain_ipsec_setcontext_all_domains(ipsec_t)
>
> files_list_tmp(ipsec_t)
> files_read_etc_files(ipsec_t)
Merged.
--
Chris PeBenito
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-07-28 13:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-26 22:37 [refpolicy] [PATCH v3] ipsec: add missing permissions for pluto Yuli Khodorkovskiy
2018-07-28 13:03 ` Chris PeBenito
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).