[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/admin/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     3b7bfcfd65b3892a0a8f5b07e5d4273c671f5ad6
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Sep 18 14:07:25 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Sep 18 14:07:25 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=3b7bfcfd

Fix bug #485304 - Allow capabilities for ping

When the ping binary is not setuid, but uses capabilities, then the ping_t
domain needs to be able to get and set capabilities.

---
 policy/modules/admin/netutils.te | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/policy/modules/admin/netutils.te b/policy/modules/admin/netutils.te
index 557da97..59933cd 100644
--- a/policy/modules/admin/netutils.te
+++ b/policy/modules/admin/netutils.te
@@ -212,3 +212,13 @@ userdom_use_user_terminals(traceroute_t)
 dev_read_rand(traceroute_t)
 dev_read_urand(traceroute_t)
 files_read_usr_files(traceroute_t)
+
+ifdef(`distro_gentoo',`
+	#########################################
+	#
+	# ping_t policy
+	#
+
+	# When not using setuid ping but capabilities
+	allow ping_t self:process { getcap setcap };
+')