commit: 0dcd9b4afc2135463c0d6884a6011f8274450b41
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Mon Apr 21 15:08:23 2014 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun Apr 27 15:28:31 2014 +0000
URL:
http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=0dcd9b4a
fcron socket support
The fcron daemon creates a socket file in /var/run (called fcron.fifo)
which is used by the fcrondyn application to interact with the fcron
daemon. This application allows admins to list the defined jobs, run
jobs immediately, remove jobs, etc.
Without this, fcrondyn cannot connect to the cron daemon; fcron also
logs this at start-up:
fcron[23724]: Cannot bind socket to '/var/run/fcron.fifo': Permission
denied
Through this patch, we allow the crond daemon to create this socket and
update the admin role to allow the admin domain to stream_connect
through this socket to the crond_t domain.
Changes since v1:
- Moved named file transition outside tunable_policy
- Use user domain instead of role in cron_admin's stream_connect_pattern
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>
---
policy/modules/contrib/cron.if | 5 +++++
policy/modules/contrib/cron.te | 2 ++
2 files changed, 7 insertions(+)
diff --git a/policy/modules/contrib/cron.if b/policy/modules/contrib/cron.if
index a58ce50..2ad65f8 100644
--- a/policy/modules/contrib/cron.if
+++ b/policy/modules/contrib/cron.if
@@ -277,6 +277,11 @@ interface(`cron_admin_role',`
dontaudit $2 cronjob_t:process { ptrace signal_perms };
')
+ tunable_policy(`crond_fcron',`
+ # Support for fcrondyn
+ stream_connect_pattern($2, crond_var_run_t, crond_var_run_t,
crond_t)
+ ')
+
optional_policy(`
gen_require(`
class dbus send_msg;
diff --git a/policy/modules/contrib/cron.te b/policy/modules/contrib/cron.te
index 4ab10d8..da85d9b 100644
--- a/policy/modules/contrib/cron.te
+++ b/policy/modules/contrib/cron.te
@@ -234,6 +234,7 @@ logging_log_filetrans(crond_t, cron_log_t, file)
manage_files_pattern(crond_t, crond_var_run_t, crond_var_run_t)
files_pid_filetrans(crond_t, crond_var_run_t, file)
+files_pid_filetrans(crond_t, crond_var_run_t, sock_file, "fcron.fifo")
manage_files_pattern(crond_t, cron_spool_t, cron_spool_t)
@@ -347,6 +348,7 @@ tunable_policy(`allow_polyinstantiation',`
tunable_policy(`fcron_crond',`
allow crond_t { system_cron_spool_t user_cron_spool_t }:file
manage_file_perms;
+ allow crond_t crond_var_run_t:sock_file manage_sock_file_perms;
')
optional_policy(`
