[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     f990dd9d3b062bab42a51baf00500cdc2b48e63b
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Dec 19 12:48:12 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Dec 19 12:48:12 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f990dd9d

Allow sysadmin to call rpcinfo

When calling rpcinfo -p to find out the available RPC services, we got the
following error:

rpcinfo: can't contact portmapper: RPC: Remote system error - Permission denied

Adding the rpcbind_stream_connect to sysadm_t resolved this as the denial showed
the following:

Dec 19 13:45:59 hpl kernel: [18164.749818] type=1400 audit(1355921159.325:1387):
avc:  denied  { connectto } for  pid=30087 comm="rpcinfo"
path="/run/rpcbind.sock" scontext=staff_u:sysadm_r:sysadm_t
tcontext=system_u:system_r:rpcbind_t tclass=unix_stream_socket

---
 policy/modules/roles/sysadm.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 8ecfdcb..0d22033 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -547,6 +547,10 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		rpcbind_stream_connect(sysadm_t)
+	')
+
+	optional_policy(`
 		shorewall_admin(sysadm_t, sysadm_r)
 	')
 ')