commit: aab0a8a125baba6defd5178025d458ffbd29f5e5 Author: Jason Zaman <jason <AT> perfinion <DOT> com> AuthorDate: Fri May 27 20:44:51 2016 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sun Jan 1 16:41:45 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=aab0a8a1
virt: virtlockd doesnt need ps_process_pattern policy/modules/contrib/virt.te | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/policy/modules/contrib/virt.te b/policy/modules/contrib/virt.te index 0924307..53233cb 100644 --- a/policy/modules/contrib/virt.te +++ b/policy/modules/contrib/virt.te @@ -1308,6 +1308,10 @@ kernel_dontaudit_read_system_state(virt_leaseshelper_t) allow virtlockd_t self:capability dac_override; allow virtlockd_t self:fifo_file rw_fifo_file_perms; +allow virtlockd_t virtd_t:dir list_dir_perms; +allow virtlockd_t virtd_t:file read_file_perms; +allow virtlockd_t virtd_t:lnk_file read_lnk_file_perms; + allow virtlockd_t virt_image_type:dir list_dir_perms; allow virtlockd_t virt_image_type:file rw_file_perms; @@ -1326,8 +1330,6 @@ files_pid_filetrans(virtlockd_t, virtlockd_run_t, file) can_exec(virtlockd_t, virtlockd_exec_t) -ps_process_pattern(virtlockd_t, virtd_t) - files_read_etc_files(virtlockd_t) files_list_var_lib(virtlockd_t)
