Changeset: 70db6936578a for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB/rev/70db6936578a
Modified Files:
misc/selinux/monetdb.if
misc/selinux/monetdb.te
Branch: Dec2025
Log Message:
Some very minor changes to make selint happier.
Just sorting permissions and removing superfluous semicolons.
diffs (77 lines):
diff --git a/misc/selinux/monetdb.if b/misc/selinux/monetdb.if
--- a/misc/selinux/monetdb.if
+++ b/misc/selinux/monetdb.if
@@ -1,1 +1,1 @@
-## <summary></summary>
+## <summary>MonetDB - Monet Database Management System</summary>
diff --git a/misc/selinux/monetdb.te b/misc/selinux/monetdb.te
--- a/misc/selinux/monetdb.te
+++ b/misc/selinux/monetdb.te
@@ -26,11 +26,11 @@ require {
class fifo_file { getattr read write };
class file { entrypoint execute getattr manage_file_perms map open read
};
class netlink_selinux_socket create_socket_perms;
- class process { rlimitinh siginh signal sigchld sigkill signull
transition };
+ class process { rlimitinh sigchld siginh sigkill signal signull
transition };
class tcp_socket create_stream_socket_perms;
class udp_socket create_stream_socket_perms;
class unix_dgram_socket create_socket_perms;
- class unix_stream_socket { connectto create_stream_socket_perms getattr
getopt read shutdown write setopt };
+ class unix_stream_socket { connectto create_stream_socket_perms getattr
getopt read setopt shutdown write };
}
# First, we declare the monetdbd_t domain, used for the "monetdbd"
@@ -48,8 +48,8 @@ type mserver5_exec_t; # /usr/bin/mserve
init_daemon_domain(mserver5_t, mserver5_exec_t)
# see
https://selinuxproject.org/page/NB_Domain_and_Object_Transitions#Domain_Transition
allow monetdbd_t mserver5_t:process transition;
-allow monetdbd_t mserver5_exec_t:file { execute open read getattr };
-allow mserver5_t mserver5_exec_t:file { entrypoint read execute };
+allow monetdbd_t mserver5_exec_t:file { execute getattr open read };
+allow mserver5_t mserver5_exec_t:file { entrypoint execute read };
type_transition monetdbd_t mserver5_exec_t:process mserver5_t;
# monetdbd must be allowed to kill the server it started
@@ -57,7 +57,7 @@ allow monetdbd_t mserver5_t:process sigk
# on EPEL 7 we need these as well
allow mserver5_t monetdbd_t:process sigchld;
allow monetdbd_t unconfined_service_t:process { signal signull };
-allow mserver5_t proc_t:file { open read getattr }; # read /proc/meminfo
+allow mserver5_t proc_t:file { getattr open read }; # read /proc/meminfo
# declare a type for the systemd unit file (monetdbd.service)
type monetdbd_unit_file_t;
@@ -115,7 +115,7 @@ corenet_tcp_bind_generic_node(monetdbd_t
allow monetdbd_t self:tcp_socket create_stream_socket_perms;
allow monetdbd_t self:udp_socket create_stream_socket_perms;
allow monetdbd_t self:unix_dgram_socket create_socket_perms;
-allow monetdbd_t self:unix_stream_socket { create_stream_socket_perms
connectto };
+allow monetdbd_t self:unix_stream_socket { connectto
create_stream_socket_perms };
allow monetdbd_t self:netlink_selinux_socket create_socket_perms;
allow monetdbd_t proc_net_t:file read;
manage_dirs_pattern(monetdbd_t, tmp_t, tmp_t)
@@ -132,19 +132,19 @@ corenet_tcp_bind_generic_node(mserver5_t
allow mserver5_t self:tcp_socket create_stream_socket_perms;
allow mserver5_t self:udp_socket create_stream_socket_perms;
allow mserver5_t self:unix_dgram_socket create_socket_perms;
-allow mserver5_t self:unix_stream_socket { create_stream_socket_perms
connectto };
+allow mserver5_t self:unix_stream_socket { connectto
create_stream_socket_perms };
allow mserver5_t self:netlink_selinux_socket create_socket_perms;
manage_dirs_pattern(mserver5_t, tmp_t, tmp_t)
manage_sock_files_pattern(mserver5_t, tmp_t, tmp_t)
allow mserver5_t tmp_t:file create;
manage_sock_files_pattern(mserver5_t, mserver5_db_t, mserver5_db_t)
-allow mserver5_t monetdbd_t:fifo_file { read write getattr ioctl };
-allow mserver5_t monetdbd_t:unix_stream_socket { read write getattr getopt
setopt shutdown };
+allow mserver5_t monetdbd_t:fifo_file { getattr ioctl read write };
+allow mserver5_t monetdbd_t:unix_stream_socket { getattr getopt read setopt
shutdown write };
allow mserver5_t var_t:dir { read };
allow mserver5_t var_lib_t:dir { read };
# we want to be able to read some cgroup files
-fs_search_cgroup_dirs(mserver5_t);
-fs_read_cgroup_files(mserver5_t);
+fs_search_cgroup_dirs(mserver5_t)
+fs_read_cgroup_files(mserver5_t)
allow mserver5_t cgroup_t:dir search;
allow mserver5_t self:process execmem;
allow monetdbd_t var_t:dir { read };
_______________________________________________
checkin-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
