[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/system/

[Jason Zaman]

commit:     996d64d63da9b3510b66053b8a82fd0bce7ac3fc
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Jan 20 14:21:00 2015 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Thu Jan 29 08:03:50 2015 +0000
URL:        
http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=996d64d6

udev: allow netlink_socket perms

udev needs these perms for CRDA communication (Central Regulatory Domain
Agent for wifi)

type=AVC msg=audit(1421753429.771:3718): avc:  denied  { create } for
pid=28698 comm="crda" scontext=system_u:system_r:udev_t
tcontext=system_u:system_r:udev_t tclass=netlink_socket permissive=1
type=AVC msg=audit(1421753429.771:3719): avc:  denied  { setopt } for
pid=28698 comm="crda" scontext=system_u:system_r:udev_t
tcontext=system_u:system_r:udev_t tclass=netlink_socket permissive=1
type=AVC msg=audit(1421753429.771:3720): avc:  denied  { bind } for
pid=28698 comm="crda" scontext=system_u:system_r:udev_t
tcontext=system_u:system_r:udev_t tclass=netlink_socket permissive=1
type=AVC msg=audit(1421753429.771:3721): avc:  denied  { getattr } for
pid=28698 comm="crda" scontext=system_u:system_r:udev_t
tcontext=system_u:system_r:udev_t tclass=netlink_socket permissive=1
type=AVC msg=audit(1421753429.771:3722): avc:  denied  { write } for
pid=28698 comm="crda" scontext=system_u:system_r:udev_t
tcontext=system_u:system_r:udev_t tclass=netlink_socket permissive=1
type=AVC msg=audit(1421753429.771:3723): avc:  denied  { read } for
pid=28698 comm="crda" scontext=system_u:system_r:udev_t
tcontext=system_u:system_r:udev_t tclass=netlink_socket permissive=1

---
 policy/modules/system/udev.te | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index 78e4328..d4d77f2 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -334,6 +334,8 @@ ifdef(`distro_gentoo',`
 
        # needed for predictable network interfaces naming
        allow udev_t self:netlink_route_socket rw_netlink_socket_perms;
+       # needed for crda, bug #538110
+       allow udev_t self:netlink_socket create_socket_perms;
 
        manage_dirs_pattern(udev_t, udev_tbl_t, udev_tbl_t)
        manage_files_pattern(udev_t, udev_tbl_t, udev_tbl_t)