diff options
Diffstat (limited to 'recipes-security/refpolicy/refpolicy-git/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch')
-rw-r--r-- | recipes-security/refpolicy/refpolicy-git/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch | 41 |
1 files changed, 0 insertions, 41 deletions
diff --git a/recipes-security/refpolicy/refpolicy-git/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch b/recipes-security/refpolicy/refpolicy-git/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch deleted file mode 100644 index afba90f..0000000 --- a/recipes-security/refpolicy/refpolicy-git/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch +++ /dev/null | |||
@@ -1,41 +0,0 @@ | |||
1 | From 2d81043e7c98b31b37a1ecd1f037a04c60e662aa Mon Sep 17 00:00:00 2001 | ||
2 | From: Roy Li <rongqing.li@windriver.com> | ||
3 | Date: Mon, 10 Feb 2014 18:10:12 +0800 | ||
4 | Subject: [PATCH 31/34] policy/module/ftp: add ftpd_t to | ||
5 | mls_file_write_all_levels | ||
6 | |||
7 | Proftpd will create file under /var/run, but its mls is in high, and | ||
8 | can not write to lowlevel | ||
9 | |||
10 | Upstream-Status: Pending | ||
11 | |||
12 | type=AVC msg=audit(1392347709.621:15): avc: denied { write } for pid=545 comm="proftpd" name="/" dev="tmpfs" ino=5853 scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir | ||
13 | type=AVC msg=audit(1392347709.621:15): avc: denied { add_name } for pid=545 comm="proftpd" name="proftpd.delay" scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir | ||
14 | type=SYSCALL msg=audit(1392347709.621:15): arch=c000003e syscall=2 success=yes exit=3 a0=471910 a1=42 a2=1b6 a3=8 items=0 ppid=539 pid=545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s15:c0.c1023 key=(null) | ||
15 | |||
16 | root@localhost:~# sesearch --allow -s ftpd_t -t var_run_t|grep dir|grep add_name | ||
17 | allow ftpd_t var_run_t : dir { ioctl read write getattr lock add_name remove_name search open } ; | ||
18 | root@localhost:~# | ||
19 | |||
20 | Signed-off-by: Roy Li <rongqing.li@windriver.com> | ||
21 | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> | ||
22 | --- | ||
23 | policy/modules/services/ftp.te | 2 ++ | ||
24 | 1 file changed, 2 insertions(+) | ||
25 | |||
26 | diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te | ||
27 | index 29bc077c..d582cf80 100644 | ||
28 | --- a/policy/modules/services/ftp.te | ||
29 | +++ b/policy/modules/services/ftp.te | ||
30 | @@ -150,6 +150,8 @@ role ftpdctl_roles types ftpdctl_t; | ||
31 | type ftpdctl_tmp_t; | ||
32 | files_tmp_file(ftpdctl_tmp_t) | ||
33 | |||
34 | +mls_file_write_all_levels(ftpd_t) | ||
35 | + | ||
36 | type sftpd_t; | ||
37 | domain_type(sftpd_t) | ||
38 | role system_r types sftpd_t; | ||
39 | -- | ||
40 | 2.19.1 | ||
41 | |||