From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 4C8F3138206 for ; Thu, 18 Jan 2018 16:37:13 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id CBE8CE08BB; Thu, 18 Jan 2018 16:37:11 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A81C8E08B1 for ; Thu, 18 Jan 2018 16:37:11 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 9A814335C3E for ; Thu, 18 Jan 2018 16:37:10 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 271BB1C2 for ; Thu, 18 Jan 2018 16:37:07 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1516292774.809e957e64f147b25cc5bdb1f02d0cfe9669af96.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/dkim.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 809e957e64f147b25cc5bdb1f02d0cfe9669af96 X-VCS-Branch: master Date: Thu, 18 Jan 2018 16:37:07 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 7b3a3c36-0e51-42b0-a747-5ac34c18123a X-Archives-Hash: 887b5a4e4db37872d54ffb09e2fe443d commit: 809e957e64f147b25cc5bdb1f02d0cfe9669af96 Author: Christian Göttsche googlemail com> AuthorDate: Mon Jan 1 11:22:30 2018 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Thu Jan 18 16:26:14 2018 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=809e957e dkim: update policy/modules/contrib/dkim.te | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/policy/modules/contrib/dkim.te b/policy/modules/contrib/dkim.te index 4ddefbf8..29880efb 100644 --- a/policy/modules/contrib/dkim.te +++ b/policy/modules/contrib/dkim.te @@ -23,23 +23,24 @@ init_daemon_pid_file(dkim_milter_data_t, dir, "opendkim") # Local policy # -allow dkim_milter_t self:capability { dac_override setgid setuid }; +allow dkim_milter_t self:capability { dac_read_search dac_override setgid setuid }; allow dkim_milter_t self:process { signal signull }; allow dkim_milter_t self:unix_stream_socket create_stream_socket_perms; read_files_pattern(dkim_milter_t, dkim_milter_private_key_t, dkim_milter_private_key_t) +# /proc/sys/kernel/ngroups_max kernel_read_kernel_sysctls(dkim_milter_t) kernel_read_vm_overcommit_sysctl(dkim_milter_t) corenet_udp_bind_generic_node(dkim_milter_t) corenet_udp_bind_all_unreserved_ports(dkim_milter_t) -corenet_dontaudit_udp_bind_all_ports(dkim_milter_t) dev_read_urand(dkim_milter_t) # for cpu/online dev_read_sysfs(dkim_milter_t) +files_pid_filetrans(dkim_milter_t, dkim_milter_data_t, { dir file }) files_read_usr_files(dkim_milter_t) files_search_spool(dkim_milter_t)