1 files changed, 102 insertions, 0 deletions

diff --git a/recipes-security/refpolicy/refpolicy/0034-policy-modules-kernel-files-add-rules-for-the-symlin.patch b/recipes-security/refpolicy/refpolicy/0034-policy-modules-kernel-files-add-rules-for-the-symlin.patch
new file mode 100644
index 0000000..33dc366
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0034-policy-modules-kernel-files-add-rules-for-the-symlin.patch
@@ -0,0 +1,102 @@
+From 3ff1a004b77f44857dadfef3b78a49a55d90c665 Mon Sep 17 00:00:00 2001
+From: Xin Ouyang <Xin.Ouyang@windriver.com>
+Date: Thu, 22 Aug 2013 13:37:23 +0800
+Subject: [PATCH] policy/modules/kernel/files: add rules for the symlink of
+ /tmp
+
+/tmp is a symlink in poky, so we need allow rules for files to read
+lnk_file while doing search/list/delete/rw.. in /tmp/ directory.
+
+Upstream-Status: Inappropriate [embedded specific]
+
+Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
+Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ policy/modules/kernel/files.fc | 1 +
+ policy/modules/kernel/files.if | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
+index a3993f5cc..f69900945 100644
+--- a/policy/modules/kernel/files.fc
++++ b/policy/modules/kernel/files.fc
+@@ -176,6 +176,7 @@ HOME_ROOT/lost\+found/.*    <<none>>
+ # /tmp
+ #
+ /tmp                   -d      gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
++/tmp                   -l      gen_context(system_u:object_r:tmp_t,s0)
+ /tmp/.*                                <<none>>
+ /tmp/\.journal                 <<none>>
+ 
+diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
+index 6a53f886b..ad19738b3 100644
+--- a/policy/modules/kernel/files.if
++++ b/policy/modules/kernel/files.if
+@@ -4451,6 +4451,7 @@ interface(`files_search_tmp',`
+        ')
+ 
+        allow $1 tmp_t:dir search_dir_perms;
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4487,6 +4488,7 @@ interface(`files_list_tmp',`
+        ')
+ 
+        allow $1 tmp_t:dir list_dir_perms;
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4523,6 +4525,7 @@ interface(`files_delete_tmp_dir_entry',`
+        ')
+ 
+        allow $1 tmp_t:dir del_entry_dir_perms;
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4541,6 +4544,7 @@ interface(`files_read_generic_tmp_files',`
+        ')
+ 
+        read_files_pattern($1, tmp_t, tmp_t)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4559,6 +4563,7 @@ interface(`files_manage_generic_tmp_dirs',`
+        ')
+ 
+        manage_dirs_pattern($1, tmp_t, tmp_t)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4577,6 +4582,7 @@ interface(`files_manage_generic_tmp_files',`
+        ')
+ 
+        manage_files_pattern($1, tmp_t, tmp_t)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4613,6 +4619,7 @@ interface(`files_rw_generic_tmp_sockets',`
+        ')
+ 
+        rw_sock_files_pattern($1, tmp_t, tmp_t)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+@@ -4820,6 +4827,7 @@ interface(`files_tmp_filetrans',`
+        ')
+ 
+        filetrans_pattern($1, tmp_t, $2, $3, $4)
++       allow $1 tmp_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+ ########################################
+-- 
+2.17.1
+