[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     a6df4d536a5e4b34d16599197a5151876914817e
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sun Jul  7 08:34:42 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sun Jul  7 08:34:42 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a6df4d53

Allow racoon_t to get security_t filesystem attributes

The racoon application needs to check if MLS is enabled on the system (as it
then enables the context validation for security associations). To do so, we
need to grant getattr rights on the security_t filesystem.

See also http://thread.gmane.org/gmane.comp.security.selinux/19413/focus=19418

---
 policy/modules/system/ipsec.te | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 2bbfbb3..db6d1c6 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -452,6 +452,8 @@ ifdef(`distro_gentoo',`
 
 	allow racoon_t self:unix_stream_socket create_stream_socket_perms;
 
+	selinux_getattr_fs(racoon_t)
+
 	###############################################
 	#
 	# setkey policy