← Back to branch summary

~ubuntu-branches/ubuntu/natty/refpolicy-ubuntu/natty

« back to all changes in this revision

Viewing changes to policy/modules/services/nscd.te

  • Committer: Bazaar Package Importer
  • Author(s): Caleb Case
  • Date: 2009-10-19 01:48:39 UTC
  • mfrom: (1.1.1 upstream)
  • Revision ID: james.westby@ubuntu.com-20091019014839-0rpi67ygkrjya30k
Tags: 0.2.20090730-0ubuntu1
https://launchpad.net/bugs/434084
* Updated to upstream release 2.20090730
* Handle Upstart direct execution of daemons.
* Pre-depend on selinux to ensure that the trigger is handled (LP: #434084).

Show diffs side-by-side

added added

removed removed

Lines of Context:
policy/modules/services/nscd.te
1
1
 
2
 
policy_module(nscd, 1.8.2)
 
2
policy_module(nscd, 1.8.3)
3
3
 
4
4
gen_require(`
5
5
        class nscd all_nscd_perms;
20
20
type nscd_exec_t;
21
21
init_daemon_domain(nscd_t, nscd_exec_t)
22
22
 
 
23
type nscd_initrc_exec_t;
 
24
init_script_file(nscd_initrc_exec_t)
 
25
 
23
26
type nscd_log_t;
24
27
logging_log_file(nscd_log_t)
25
28
 
28
31
# Local policy
29
32
#
30
33
 
31
 
allow nscd_t self:capability { kill setgid setuid audit_write };
 
34
allow nscd_t self:capability { kill setgid setuid };
32
35
dontaudit nscd_t self:capability sys_tty_config;
33
 
allow nscd_t self:process { getattr setsched signal_perms };
 
36
allow nscd_t self:process { getattr getcap setcap setsched signal_perms };
34
37
allow nscd_t self:fifo_file read_fifo_file_perms;
35
38
allow nscd_t self:unix_stream_socket create_stream_socket_perms;
36
39
allow nscd_t self:unix_dgram_socket create_socket_perms;
37
40
allow nscd_t self:netlink_selinux_socket create_socket_perms;
38
 
allow nscd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
39
41
allow nscd_t self:tcp_socket create_socket_perms;
40
42
allow nscd_t self:udp_socket create_socket_perms;
41
43
 
50
52
manage_sock_files_pattern(nscd_t, nscd_var_run_t, nscd_var_run_t)
51
53
files_pid_filetrans(nscd_t, nscd_var_run_t, { file sock_file })
52
54
 
 
55
corecmd_search_bin(nscd_t)
 
56
can_exec(nscd_t, nscd_exec_t)
 
57
 
53
58
kernel_read_kernel_sysctls(nscd_t)
54
59
kernel_list_proc(nscd_t)
55
60
kernel_read_proc_symlinks(nscd_t)
73
78
corenet_udp_sendrecv_generic_node(nscd_t)
74
79
corenet_tcp_sendrecv_all_ports(nscd_t)
75
80
corenet_udp_sendrecv_all_ports(nscd_t)
 
81
corenet_udp_bind_generic_node(nscd_t)
76
82
corenet_tcp_connect_all_ports(nscd_t)
77
83
corenet_sendrecv_all_client_packets(nscd_t)
78
84
corenet_rw_tun_tap_dev(nscd_t)
90
96
# Needed to read files created by firstboot "/etc/hesiod.conf"
91
97
files_read_etc_runtime_files(nscd_t)
92
98
 
 
99
logging_send_audit_msgs(nscd_t)
93
100
logging_send_syslog_msg(nscd_t)
94
101
 
95
102
miscfiles_read_localization(nscd_t)
105
112
userdom_dontaudit_search_user_home_dirs(nscd_t)
106
113
 
107
114
optional_policy(`
 
115
        cron_read_system_job_tmp_files(nscd_t)
 
116
')
 
117
 
 
118
optional_policy(`
 
119
        kerberos_use(nscd_t)
 
120
')
 
121
 
 
122
optional_policy(`
108
123
        udev_read_db(nscd_t)
109
124
')
110
125