From: "Sven Vermeulen" <sven.vermeulen@siphos.be>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/
Date: Mon, 11 Feb 2013 19:52:36 +0000 (UTC) [thread overview]
Message-ID: <1360612221.7f3b569f4994552e4eeec980a3aa292de991b2eb.SwifT@gentoo> (raw)
commit: 7f3b569f4994552e4eeec980a3aa292de991b2eb
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Mon Feb 11 19:50:21 2013 +0000
Commit: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Feb 11 19:50:21 2013 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=7f3b569f
Allow initrc_t to write to alsa OSS compat files
While saving and reloading the previously stored ALSA OSS state, initrc_t
needs to write this state in the /var/lib/alsa/oss/card* files.
18:45 < amade> SwifT: I blame you for my lack of music... cp: cannot create regular file /var/lib/alsa/oss/card0_pcm0c:
Permission denied
18:45 <@SwifT> amade: music is overrated
18:45 < amade> Feb 11 19:43:59 lain kernel: [16008.582246] type=1400 audit(1360608239.978:61): avc: denied { write } for
pid=19411 comm="cp" name="card0_pcm0c" dev="dm-0" ino=6706162 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:alsa_var_lib_t tclass=file
---
policy/modules/contrib/alsa.if | 21 +++++++++++++++++++++
policy/modules/system/init.te | 4 ++++
2 files changed, 25 insertions(+), 0 deletions(-)
diff --git a/policy/modules/contrib/alsa.if b/policy/modules/contrib/alsa.if
index f46c4a2..7d2e33a 100644
--- a/policy/modules/contrib/alsa.if
+++ b/policy/modules/contrib/alsa.if
@@ -286,3 +286,24 @@ interface(`alsa_domain',`
allow $1 alsadomain:shm rw_shm_perms;
allow $1 alsatmpfsfile:file rw_file_perms;
')
+
+# Gentoo specific for now, but cannot use ifdef distro_gentoo in an interface
+
+########################################
+## <summary>
+## Write Alsa lib files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`alsa_write_lib',`
+ gen_require(`
+ type alsa_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ write_files_pattern($1, alsa_var_lib_t, alsa_var_lib_t)
+')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index e6754cd..f91f807 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -927,6 +927,10 @@ ifdef(`distro_gentoo',`
logging_delete_devlog_socket(initrc_t)
optional_policy(`
+ alsa_write_lib(initrc_t)
+ ')
+
+ optional_policy(`
mysql_setattr_run_dirs(initrc_t)
')
next reply other threads:[~2013-02-11 19:52 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-11 19:52 Sven Vermeulen [this message]
-- strict thread matches above, loose matches on Subject: below --
2017-05-07 17:41 [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/ Jason Zaman
2017-02-16 11:34 Jason Zaman
2016-12-06 12:26 Jason Zaman
2014-07-15 16:16 Sven Vermeulen
2014-06-25 19:59 Sven Vermeulen
2013-12-17 8:52 Sven Vermeulen
2012-12-31 23:19 Sven Vermeulen
2012-12-08 12:41 Sven Vermeulen
2012-12-08 12:40 Sven Vermeulen
2012-12-07 17:28 Sven Vermeulen
2012-11-12 21:30 Sven Vermeulen
2012-10-29 18:41 Sven Vermeulen
2012-08-29 18:48 Sven Vermeulen
2012-08-15 13:03 Sven Vermeulen
2012-08-08 19:37 Sven Vermeulen
2012-07-24 9:24 Sven Vermeulen
2012-07-17 17:15 Sven Vermeulen
2012-07-12 20:02 Sven Vermeulen
2012-06-27 19:12 Sven Vermeulen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1360612221.7f3b569f4994552e4eeec980a3aa292de991b2eb.SwifT@gentoo \
--to=sven.vermeulen@siphos.be \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox