On Thu, 2007-03-22 at 00:08 +0000, Antoine Martin wrote:
> Mike Edenfield wrote:
> > 2. This one is specific to sudo. I added a couple of rules relating to
> > sudo:
> >
> > allow sysadm_sudo_t self:netlink_route_socket r_netlink_socket_perms;
> > allow sysadm_sudo_t pam_var_run_t:dir { getattr search write };
> >
> > but I remember from looking through the older policy sources that sudo
> > actually defines more than one $1_sudo_t type that all get the same
> > rules. Is there a way in my local.te file to look up and apply my two
> > transition rules to every defined *_sudo_t type, or will I need to
> > specify each one individually?
> /usr/share/selinux/strict/include/admin/sudo.if
>
> So you should be able to add it there.
> I haven't figured out how to build from this location though, so I have
> done like you did and kept my changes to local modules. And in any case
> these changes would probably get lost on policy upgrade.No, these should be treated like the headers in /usr/include; you shouldn't be modifying them. Changes to these policy modules will only affect modules built from these headers, not to those modules that are already built. > Which brings another question, how do I get simple policy changes > merged? I've got a bunch of tweaks that I use here that other people > will want to use eventually, like mysql support for postfix - a bit like > the use flag: > > allow postfix_$1_t mysqld_t:unix_stream_socket connectto; > allow postfix_$1_t mysqld_var_run_t:dir search; > allow postfix_$1_t mysqld_var_run_t:sock_file write; Merged where? To the Gentoo policy? > Also, sorry to hijack the thread, but where can I enable > apache_read_user_content? Not sure what you mean by this. -- Chris PeBenito <[EMAIL PROTECTED]> Developer, Hardened Gentoo Linux Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243 Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243
signature.asc
Description: This is a digitally signed message part
