1 files changed, 102 insertions, 0 deletions

diff --git a/recipes-security/refpolicy/refpolicy/0030-policy-modules-kernel-files-add-rules-for-the-symlin.patch b/recipes-security/refpolicy/refpolicy/0030-policy-modules-kernel-files-add-rules-for-the-symlin.patch
new file mode 100644
index 0000000..ee329b1
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0030-policy-modules-kernel-files-add-rules-for-the-symlin.patch
@@ -0,0 +1,102 @@
+From b4110d4f30f6dc82c810ceaf24911b1fadb0e7c4 Mon Sep 17 00:00:00 2001
+From: Xin Ouyang <Xin.Ouyang@windriver.com>
+Date: Thu, 22 Aug 2013 13:37:23 +0800
+Subject: [PATCH] policy/modules/kernel/files: add rules for the symlink of
+ /tmp
+
+/tmp is a symlink in poky, so we need allow rules for files to read
+lnk_file while doing search/list/delete/rw.. in /tmp/ directory.
+
+Upstream-Status: Inappropriate [embedded specific]
+
+Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
+Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ policy/modules/kernel/files.fc | 1 +
+ policy/modules/kernel/files.if | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
+index 9a6f9d2d4..0f511c830 100644
+--- a/policy/modules/kernel/files.fc
++++ b/policy/modules/kernel/files.fc
+@@ -171,6 +171,7 @@ HOME_ROOT/lost\+found/.*    <<none>>
+ # /tmp
+ #
+ /tmp                   -d      gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
++/tmp                   -l      gen_context(system_u:object_r:tmp_t,s0)
+ /tmp/.*                                <<none>>
+ /tmp/\.journal                 <<none>>
+ 
+diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
+index 9e4344d24..14b34a467 100644
+--- a/policy/modules/kernel/files.if
++++ b/policy/modules/kernel/files.if
+@@ -4780,6 +4780,7 @@ interface(`files_search_tmp',`
+        ')
+ 
+        allow $1 tmp_t:dir search_dir_perms;
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4816,6 +4817,7 @@ interface(`files_list_tmp',`
+        ')
+ 
+        allow $1 tmp_t:dir list_dir_perms;
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4852,6 +4854,7 @@ interface(`files_delete_tmp_dir_entry',`
+        ')
+ 
+        allow $1 tmp_t:dir del_entry_dir_perms;
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4870,6 +4873,7 @@ interface(`files_read_generic_tmp_files',`
+        ')
+ 
+        read_files_pattern($1, tmp_t, tmp_t)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4888,6 +4892,7 @@ interface(`files_manage_generic_tmp_dirs',`
+        ')
+ 
+        manage_dirs_pattern($1, tmp_t, tmp_t)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4924,6 +4929,7 @@ interface(`files_manage_generic_tmp_files',`
+        ')
+ 
+        manage_files_pattern($1, tmp_t, tmp_t)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4960,6 +4966,7 @@ interface(`files_rw_generic_tmp_sockets',`
+        ')
+ 
+        rw_sock_files_pattern($1, tmp_t, tmp_t)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -5167,6 +5174,7 @@ interface(`files_tmp_filetrans',`
+        ')
+ 
+        filetrans_pattern($1, tmp_t, $2, $3, $4)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+-- 
+2.25.1
+