commit: a0fdf53ebd17756a85e551a25a99acfd64c9fdd6 Author: Amadeusz Sławiński <amade <AT> asmblr <DOT> net> AuthorDate: Wed Oct 18 08:42:26 2017 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sun Oct 29 13:57:28 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=a0fdf53e
allow dac_read_search for portage_fetch_t it already has dac_override allowed, so it just quiets denial Signed-off-by: Amadeusz Sławiński <amade <AT> asmblr.net> policy/modules/contrib/portage.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/contrib/portage.te b/policy/modules/contrib/portage.te index 5d58b326..5905d4dc 100644 --- a/policy/modules/contrib/portage.te +++ b/policy/modules/contrib/portage.te @@ -251,7 +251,7 @@ dontaudit portage_t device_type:blk_file read_blk_file_perms; # allow portage_fetch_t self:process signal; -allow portage_fetch_t self:capability { chown dac_override fowner fsetid }; +allow portage_fetch_t self:capability { chown dac_read_search dac_override fowner fsetid }; allow portage_fetch_t self:fifo_file rw_fifo_file_perms; allow portage_fetch_t self:tcp_socket { accept listen }; allow portage_fetch_t self:unix_stream_socket create_socket_perms;