[patch] 0001-Ulogd-policy-fixes.patch

0001-Ulogd-policy-fixes.patch (text/plain), 1.31 KB, created by vespian on 2013-03-03 11:57:36 UTC

From d5325dd8ee9d502db873680c1640afc36ec60b8b Mon Sep 17 00:00:00 2001
From: Pawel Rozlach <[e-mail]>
Date: Sun, 3 Mar 2013 12:39:07 +0100
Subject: [PATCH] Ulogd policy fixes

This patch fixes:
- ulogd handling NFLOG log sources
- add missing capabilities to the process
- allow for reading ngroups_max /proc entries
---
 policy/modules/contrib/ulogd.te | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/policy/modules/contrib/ulogd.te b/policy/modules/contrib/ulogd.te
index c6acbbe..85a49a6 100644
--- a/policy/modules/contrib/ulogd.te
+++ b/policy/modules/contrib/ulogd.te
@@ -26,12 +26,17 @@ logging_log_file(ulogd_var_log_t)
 # Local policy
 #
 
-allow ulogd_t self:capability { net_admin sys_nice };
+allow ulogd_t self:capability { net_admin sys_nice dac_override setuid setgid};
 allow ulogd_t self:process setsched;
 allow ulogd_t self:netlink_nflog_socket create_socket_perms;
 allow ulogd_t self:netlink_socket create_socket_perms;
 allow ulogd_t self:tcp_socket create_stream_socket_perms;
 
+#Allow /proc/sys/kernel/ngroups_max reading:
+kernel_read_kernel_sysctls(ulogd_t);
+#Allow operation on NFLOG objects:
+allow ulogd_t self:netlink_socket create_socket_perms;
+
 read_files_pattern(ulogd_t, ulogd_etc_t, ulogd_etc_t)
 
 list_dirs_pattern(ulogd_t, ulogd_modules_t, ulogd_modules_t)
-- 
1.7.12.4